MSN Messenger problem
- From: Toby Groves <toby.groves@xxxxxxxxxxxxxxxxxx>
- Date: Sat, 31 May 2008 12:16:28 +0100
Hi,
Got a problem here which I can't see a way around, hope someone can
help.
Running ISA 2004 with latest service pack on a 2003 Server.
I have a rule configured to allow general web access. This is
configured for "All Users" as we need to permit web access to
un-authenticated clients. This works fine.
I now need to permit access to MSN/Live Messenger but only to a few
specific users. By default the above rule will permit any user to
access MSN Messenger via the standard web proxy. This is undesirable.
Now I can add HTTP header filtering to this rule to block MSN without
any problems - works a treat. What I did, therefore was add a
duplicate web proxy rule, above the existing one, but rather than for
"All Users", I set this to a new user group containing the users who
need MSN access. This rule has no HTTP filtering and thus permits MSN
to get through.
The original web proxy rule, just below the new one, is still for "All
Users" yet has the HTTP filters in to block MSN.
Now this sort of works. Users in the "MSN Users" group I've created
are matched by the first rule and permitted unrestricted web access
including MSN. All other users should fail to match this rule and be
caught by the next (original) one which permits web access but blocks
MSN.
Great! - Not quite :(
Whilst this all works fine for authenticated users with IE,
unauthenticated users are now prompted for credentials by the proxy
server when the try to access the web. It looks to me like the first
of the web proxy rules is asking for authentication as it's set to
match only on specific users. What I want is for it to realise the
user isn't authenticated, let alone a member of the "MSN Users" group,
and fall through to the following rule.
First question is, can this be done?
Failing that, I had an alternative plan. The users who require MSN
Messenger access also have the Firewal Client installed for other
purposes. I figured I could just block all MSN Messenger access via
the standard web proxy for all users and then use a specific rule for
the "MSN Messenger" protocol for the "MSN Users" group and permit them
access via this on the 1863 port.
Alas this doesn't work - the rule matches ok but I get an error from
the ISA server saying the destination server "actively refused" the
connection. The client then tries its "backup plan" of using port 80,
which the standard web proxy then blocks on the HTTP header filters.
Can anyone help me here, I'm running out of ideas :(
Many thanks for any and all advice.
--
Toby
.
- Prev by Date: 5 static IPs
- Previous by thread: 5 static IPs
- Index(es):
Relevant Pages
|
