This may be a silly question, since it seems to be telling me where to look, but when i look there there is no reason (I can see) that HTTP traffic from the server is being blocked.
I setup a new ISA 2006 server and new enterprise, I have added an array rule to allow HTTP and HTTPS traffic from internal to external, I have matched averything I can see from my old server aside from the server name, and still I get the following:
Denied Traffic - destination URL host name could not be resolved Rule Name: [Enterprise] Default rule Rule Order:
Additional information From: Internal To: External Network Rule Name: Internet Access Network Relationship: NAT Protocol: HTTP Rule Application Filter:
An ISA Server in enterprise setup would observe Enterprise rule overriding Array Rules. This is the rule of tumb. This is showed by ISA management snap-in. When creating Array level rules...the rsults pane divides the screen showing "Enterprise rules applied before Array level access rules".
So for example, you just have Default Enterprise Rule which will deny all traffic...
1. Remove all rules from Array. 2. Create and Enterprise Allow All Access Rule. 3. Right click on server name, click Properties.... Go to Enterprise rule Tab. and see what Enterprise level policy is applied. Set it to the one you created at Enterprise level, Allow All Access Rule.
"When ISA Server processes an outgoing request, it checks network rules and firewall policy rules to determine if access is allowed. For Web Proxy client requests or Hypertext Transfer Protocol (HTTP), the network rule is ignored. Note that if the Web proxy is disabled, the network rule would be required."
What does it mean by "the network rule is ignored?"
Does this mean network rules outside of ISA? Because if this is the case, then why doesn't my ISA server go anywhere on the internet other than Microsoft.com (not even the microrosft updates site works without turing off the firewall)? It seems strange, like a setting I cant seem to find. Even with opening up HTTP/HTTPS, nothing seems to let traffic out. I can ping out, so I know it can communicate out fine, it is ISA that is blocking traffic for sure!
< Message edited by jtheboywonder -- 10.Nov.2009 6:11:35 PM >
Well, it turns out the problem was in the Web access rule. Rather than allowing the localhost to communicate to the Internet, I created a policy that was supposed to allow all array servers to talk to the Internet. I am not sure why ISA did not like "array servers" to "External" but for some reason when I allowed "Localhost" to "External" it worked fine.
Does this signify a problem with the Array servers group? Or is it that you would have to add an array servers group with the external interfaces to allow traffic to go out? And I am not sure why Microsoft worked, but other sites did not.
I am connected now, but I could not find any documentation on why one would be different that the other.
Thanks for all the ideas and help. I am posting a new problem with CSS replication now.