Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have an ISA in a school that has to pass all traffic to the local authority's proxy to get to the internet. We do that in the web chaining rule. The local authority have created a website on their LAN that the school needs to get to - i.e. between the ISA and the proxy. What we need is a bypass to the web chaining rule for one site only. The exception part in the chain doesn't seem to help us.

How would we go about doing that?

Additional info: If we put a laptop on the WAN side of the ISA and configure the proxy in IE to use the proxy but with an exclusion for the Local Authority URL then we can visit the site.


share|improve this question
up vote 2 down vote accepted

if you put an extra 'direct access' web chaining rule for a specific destination in front of the default rule, it will apply that rule first and access the local size directly.

alterantively, you can create a firewall exception for that specific destination + port and deploy modified proxy configurations to selected client browsers to bypass the proxy selectively - but that is usually much more of a configuration hassle ...

share|improve this answer
Thanks Heiko, we tried the new direct access policy above the usual chain, but it made no difference. I don't know how you would implement your second suggestion on the client side. Do you have a link for an example or something? Thanks for your help – Kieran Walsh May 4 '11 at 9:52
The first part of this suggestion should work, suggesting that there's something not quite right about the URL or Domain Name set you're using to identify the destination. should work in a URL set, or in a Domain Name Set. Alternatively, if you're using SkipNameResolutionForAccessAndRoutingRules (possible mental typo), you might need to specify the IP as well. – TristanK May 4 '11 at 12:45
Also: Two Minute Rule: Rule of thumb, you can't be sure a change has actually taken effect until two minutes after you've made it. – TristanK May 4 '11 at 12:46
Hi, just to clear this up, it turns out that we needed to set the direct access chaining rule AND set an IE bypass policy for the site on the clients. This makes no sense to me, but that is the solution that worked. We even built a second fresh ISA server to test the setup. Thanks for all the help. – Kieran Walsh May 18 '11 at 15:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.