Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We have windows server 2003 with isa 2004. Our clients uses internet with proxy.

We have two isa rule:

 order  name      action     protocolls    from/listener                       to        condition 
  1.    trafic    ALLOW   all outbound      all networks                   all networks    all users
  2.     FTP      ALLOW    FTP Server      EXTERNAL/INTERNAL/Local host  

So we have to "bann" a few webpage (like facebook, youtube...etc...), so we make a new rule

  0.   banned     DENY      HTTP           internal                        denied pages     all users

In the denied pages we have the * domain set.

After we enable this rule, the entire internet slows down. The banning rule works well, redirect to an internal site, but the other sites.... If i open a normally takes 3-10 sec to load, but after this rule this time is: 2-4 minutes.

In the monitor / logging menu we got a few FAILED CONNECTION ATTEMPT like:

Log type: Web Proxy (Forward)

Status: 304 Not Modified

Rule: All local traffic

Source: Internal ( )

Destination: External ( )

Request: GET

Filter information: Req ID: 17270b72 

Protocol: http

User: anonymous

 Additional information

Client agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.3072...

Object source: Verified Cache Processing time: 9047

Cache info: 0x18801002 MIME type: -

Thank you folks.

share|improve this question

1 Answer 1

Sounds like it may be a DNS issue. Are you creating a Domain Name Set in ISA for the sites you are blocking? If so, use a URL Set instead, as you're blocking HTTP. Both Domain Name Sets and URL Sets depend on DNS resolution, but I've found URL Sets to work better.

share|improve this answer
ok. tomorrow i will try. thank you –  user57467 Jan 10 '11 at 20:36
i try to use URL Set but problem is still –  user57467 Jan 11 '11 at 10:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.