Re: Create rule in ISA 2004
- From: "Steve Foster [SBS MVP]" <steve.foster@xxxxxxxxxxxxx>
- Date: Tue, 25 Sep 2007 06:44:39 -0700
Colin wrote:
Hi all,
One of my clients needs to allow a finance software package installed on 1
PC to retrieve updates from the vendor's website. They (the vendor) have
informed me that this is a common problem and I need to allow
un-authenticated access to their website through ISA (installed on my
client's SBS Prem box, 2 nic's). How do I create a rule to allow this ? Many
thanks.
Whether their comment is accurate or not depends on a number of factors:
a) is their application proxy-aware, and
b) if so, does it support passing credentials, and
c) do you have the Firewall Client installed on this workstation
CASE 1:
If the answer to (a) is no, then you need (c) to be yes in order for the application to be able to make authenticated requests through ISA (the FWC handles the authentication on behalf of the application).
CASE 2:
If the answer to (a) is yes, then (b) needs to be yes as well for the application to use ISA directly. Note that you may need to configure ISA to allow Basic Authentication in this scenario.
CASE 3:
If the answers to (a) and (b) are yes and no respectively, the application should be treated as non-proxy-aware, configured with *no* proxy information and handled as case 1.
If you can't fit any of the above cases, then yes, you may need to configure ISA to allow anonymous access:
(assuming ISA2004)
New Access Rule:
"Vendor X Updates" NEXT
Allow NEXT
Selected Protocols, Add HTTP, NEXT
Internal (or define a new Computer or Computer Set and include the relevant PC(s) ), NEXT
"Vendor X Update Site" (defining a new URL set, with <base URL>/* as per vendor guidance), NEXT
All Users, NEXT
FINISH
Make sure this new rule is (just) above the SBS Internet Access rule, and click the big APPLY.
This rule grants anonymous HTTP access to _just_ the vendor's website, thus minimising the risk potential.
--
Steve Foster [SBS MVP]
---------------------------------------
MVPs do not work for Microsoft. Please reply only to the newsgroups.
.
- Prev by Date: RE: ISA 2004 connection drop every time DAVEX shuts down
- Next by Date: Re: No ISA, No User logon, how to control user internet?
- Previous by thread: Re: Create rule in ISA 2004
- Next by thread: message pop-up
- Index(es):
Relevant Pages
|
