Re: ISA 2000 Firewall Log

I am looking at the correct logs. The firewall log I'm looking at is
FWSDyyyymmdd.log. I don't see the computers in the Sessions because I'm not
monitoring it 24/7. I do have other things to do. So when I review the
Firewall logs I see that some computers are being logged in the firewall log,
when I think they shouldn't because they don't even have the ISA Firewall
client installed.

So does anyone know why some of my computers randomly show up in the ISA
Firewall log if they don't even have the ISA Firewall client installed that
their workstations and the only programs that they are using is MS Office
products and IE?

Thanks in adavance.
Mike

"Phillip Windell" wrote:

> You need to make sure the log you are looking at is the one you think it is.
> Examine the Sessions in the MMC to see what Service those machines come in
> under. you may just be getting the logs mixed up. Users cannot use the
> Firewall Service without the Firewall Client installed or the old Proxy
> Client installed (from the old Proxy2).
>
> --
>
> Phillip Windell [MCP, MVP, CCNA]
> www.wandtv.com
>
> "banker2640" <banker2640@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
> news:561AC38E-15EF-4088-876A-246DB32CE75E@xxxxxxxxxxxxxxxx
> > Hi there,
> >
> > I understand that ISA is a Firewall, but why would a computer show up in
> the
> > Firewall log file if it doesn't even have the firewall client installed on
> > that computer?
> >
> > Thanks,
> > Mike
> >
> >
> >
> > "Sergio Fonseca [MVP]" wrote:
> >
> > > Hi,
> > >
> > > The ISA2000 is also a Firewall so it "reacts" to requests. It does not
> mean
> > > that there is a problem, just means that a request reached the ISA.
> > >
> > > Qualquer sugestão deve ser testada antes de aplicada - www.gupade.org
> > >
> > > "banker2640" <banker2640@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
> > > news:04C3A357-6A99-4071-ACFD-D64FF4252F67@xxxxxxxxxxxxxxxx
> > > > Hello,
> > > >
> > > > Can someone tell me what makes an entry appear in the ISA Firewall
> Client
> > > > Log? The reason why I'm asking is because some of our computers which
> do
> > > > not
> > > > have the firewall client installed, are appearing in the firewall log.
> > > > What
> > > > could the users of these computers be doing to trigger an entry in the
> > > > firewall log? Should we have the firewall client loaded? As far as I
> know,
> > > > the users are not experiencing any problems. Are we causing an
> exposure
> > > > because we are on the log (ISA thinks we have a firewall) and thus
> thinks
> > > > we
> > > > are protected, but we are not?
> > > >
> > > > Thanks in advance for you suggestions.
> > > >
> > > > Mike
> > >
> > >
> > >
>
>
>
.

Relevant Pages

  • Re: Hardware Firewall or not?
    ... low-cost hardware router with basic firewalling capabilities. ... and I'll be the first to say that I am not an ISA ... I've also used a SonicWall Pro 200 firewall and it ... >> have put me incharge of all things to do with computers. ...
    (microsoft.public.windows.server.sbs)
  • Re: ISA 2000 Firewall Log
    ... The gateway in our network is not the ISA server. ... > LAN host might appear in firewall log not only when it has firewall client ... > its default gateway address (so-called SecureNAT client). ...
    (microsoft.public.isa)
  • Re: ISA 2000 Firewall Log
    ... I am using ISA 2000 and the Http Redirector is enabled and set to Reject HTTP ... requests from Firewall and SecureNat Clients. ... >> LAN host might appear in firewall log not only when it has firewall client ... >> its default gateway address (so-called SecureNAT client). ...
    (microsoft.public.isa)
  • Re: Access by Non-Domain computers and users
    ... ISA cannot control what the users do at their local machine. ... not a firewall problem. ... I need to deny non domain computers access to ISA server browsing.. ... ISA will be able to authenticate them in the proper context. ...
    (microsoft.public.isa.clients)
  • Re: ISA 2000 Firewall Log
    ... LAN host might appear in firewall log not only when it has firewall client ... I don't see the computers in the Sessions because I'm ... > when I think they shouldn't because they don't even have the ISA Firewall ...
    (microsoft.public.isa)
Loading