Welcome to ISAserver.org

Websites get blocked

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2000 General] >> Web Publishing >> Websites get blocked

Page: [1]

Message

<< Older Topic Newer Topic >>

Websites get blocked - 15.May2003 3:41:00 PM

BlineInfoSys

Posts: 5
Joined: 16.Apr.2003
From: Lisle, IL
Status: offline

My websites will start being blocked about an hour after re-booting the box. Prior to that I don't get any log entries for packet filters. Once the websites get blocked, I get 'spoof' entries for website access and I get 'blocked' for ICMP requests in the filter log, even though I know that the machines in question are not spoofing IP addresses adn I have a rule that allows ICMP for everyone all the time.

This only happens from public access, private access is always available.

This is a fresh install of Win2K Advanced Server with a fresh install of ISA 2K. All of the latest service packs and security patches are installed for both.
I have one incoming listener configured for 204.248.50.78 TCP 80. Auto discovery is not enabled.
I have one destination set configured with www.blineinfosys.com.
I have one publishing rule pointed to the destination set above, redirected to the private IP 200.100.10.28. I have checked the box so send the original header. and I did not change the bridging ports from the defaults.
I have a protocol rule and a site and content rule that allows all traffic all the time.
There are no time restrictions on access for any user.
Any help would be greatly appreciated.

Post #: 1

Featured Links*

RE: Websites get blocked - 15.May2003 8:27:00 PM

BlineInfoSys

Posts: 5
Joined: 16.Apr.2003
From: Lisle, IL
Status: offline

Here is a sample from my filter log. I reset the box at 13:02. My notebook That I was hitting the website with is the entry for the 205.243.140.21 address.

5/15/2003, 13:02:41, 204.248.50.35, 204.248.50.78, ICMP, 8, 0, -, Spoof, 204.248.50.78, -, -
5/15/2003, 13:03:13, 204.248.50.74, 204.248.50.79, Udp, 137, 137, -, BLOCKED, 204.248.50.78, -, -

...

5/15/2003, 13:04:43, 204.248.50.74, 204.248.50.79, Udp, 138, 138, -, BLOCKED, 204.248.50.78, -, -
5/15/2003, 13:05:01, 204.248.50.35, 204.248.50.78, ICMP, 8, 0, -, Spoof, 204.248.50.78, -, -
5/15/2003, 13:05:03, 204.248.50.78, 224.0.0.2, 2, -, -, -, IpOptions, 204.248.50.78, -, -

...

5/15/2003, 13:07:41, 205.243.140.21, 204.248.50.78, Tcp, 1456, 80, -, Spoof, 204.248.50.78, -, -
5/15/2003, 13:07:43, 205.243.140.21, 204.248.50.78, Tcp, 1457, 80, -, Spoof, 204.248.50.78, -, -
5/15/2003, 13:08:11, 205.243.140.21, 204.248.50.78, Tcp, 1458, 80, -, Spoof, 204.248.50.78, -, -
5/15/2003, 13:08:14, 205.243.140.21, 204.248.50.78, Tcp, 1458, 80, -, Spoof, 204.248.50.78, -, -

(in reply to BlineInfoSys)

Post #: 2