0

We have an ISA in a school that has to pass all traffic to the local authority's proxy to get to the internet. We do that in the web chaining rule. The local authority have created a website on their LAN that the school needs to get to - i.e. between the ISA and the proxy. What we need is a bypass to the web chaining rule for one site only. The exception part in the chain doesn't seem to help us.

How would we go about doing that?

Additional info: If we put a laptop on the WAN side of the ISA and configure the proxy in IE to use the proxy but with an exclusion for the Local Authority URL then we can visit the site.

Thanks.

Improve this question

1 Answer 1

Reset to default
2

if you put an extra 'direct access' web chaining rule for a specific destination in front of the default rule, it will apply that rule first and access the local size directly.

alterantively, you can create a firewall exception for that specific destination + port and deploy modified proxy configurations to selected client browsers to bypass the proxy selectively - but that is usually much more of a configuration hassle ...

Improve this answer
4
  • Thanks Heiko, we tried the new direct access policy above the usual chain, but it made no difference. I don't know how you would implement your second suggestion on the client side. Do you have a link for an example or something? Thanks for your help
    – Kieran Walsh
    May 4, 2011 at 9:52
  • The first part of this suggestion should work, suggesting that there's something not quite right about the URL or Domain Name set you're using to identify the destination. site.domain.com should work in a URL set, or site.domain.com in a Domain Name Set. Alternatively, if you're using SkipNameResolutionForAccessAndRoutingRules (possible mental typo), you might need to specify the IP as well.
    – TristanK
    May 4, 2011 at 12:45
  • 1
    Also: Two Minute Rule: Rule of thumb, you can't be sure a change has actually taken effect until two minutes after you've made it.
    – TristanK
    May 4, 2011 at 12:46
  • Hi, just to clear this up, it turns out that we needed to set the direct access chaining rule AND set an IE bypass policy for the site on the clients. This makes no sense to me, but that is the solution that worked. We even built a second fresh ISA server to test the setup. Thanks for all the help.
    – Kieran Walsh
    May 18, 2011 at 15:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .