|
Chadwick24 -> RE: Website Restrictions (24.Jun.2008 1:29:55 PM)
|
Thanks for the advice. However, I think I may have a larger problem. And it may be due to my lack to experience with ISA. But, the problem is I only have one rule active right now and it's the default "Unrestricted Internet Access” rule with "All Users” as the condition. If I change that rule from "All Users” to the User set I created that includes only Domain Users from Active Directory, then all HTTP traffic is suddenly block for everyone. Including everyone in the Domain Users group in active directory. I've tried creating a user set using other security groups from AD and when I apply the "Unrestricted Internet Access” policy to them it again blocks ALL users. It only works if "All Users” is the condition.
This is the default rule I have:
Access Rule
Name: Unrestricted Internet access
Action: Allow
Protocols: All Outbound Traffic
From: Internal, VPN Clients
To: External
Condition: All Users
Now, I have a security group in active directory called "RestrictedInternetUsers”. I placed that group into a user set with the same name. in ISA. Then created a rule called "RestrictedInternetPolicy” I then created a URL Set called "testint” using all microsoft websites as a test. Then created the following:
Access Rule
Name: RestrictedInternetPolicy
Action: Allow
Protocols: HTTP
From: Internal
To: testint
Condition: RestrictedInternet
When that rule is enabled, all Internet access for everyone is blocked. (except for the Microsoft websites) Even if I removed "All Users” from the default "Unrestricted Internet Access” policy and just use "DomainUsers” in its place.
Could the problem be that in AD, all useres are in the Domain Users group including the restricted group? I would like to think the AD groups wouldent mean that much to the ISA. wouldn't that be the job of the user sets?
|
|
|
|