I have a rule to deny all access from internal and local host to external. I do no apply a user group and the rule is added to the configuration but obvious does not come into play.

As soon as I add a user group to the rule - even an empty one with no local or active domain users - the rule comes into force and no one has internet access.

This cannot be correct, any suggestions?

1 Answer 1


Sounds like your talking about an access rule, correct?

TechNet explains the problems of requiring user auth. You must use ISA proxy or ISA client for user pre-auth to work. http://technet.microsoft.com/en-us/library/cc302664.aspx

The problem is once you tell a rule to only allow for certain accounts (anything other then the default "All Users" which is same as anonymous) you are asking ISA to (in effect) deny anything that isn't authenticated.

TechNet says:

If a rule that matches a request requires authentication, client credentials are validated. If credentials are valid, access policy is implemented in accordance with the rule. If a client cannot present credentials, or credentials cannot be validated, the rule denies access (even if it is an allow rule), and no further rules are evaluated. This may happen for a number of reasons. For example, a request from a SecureNAT client who cannot authenticate, or Web Proxy listener settings that are incorrectly configured, such as not enabling an authentication method on the listener.

Maybe ask your question in the form of what you want a rule to do (protocols, ports, etc.) and we can help you create a working rule.

  • Hi Bret, thanks for your response. A bit of overnight thinking had led me to the same conclusion but thank you for the confirmation. Okay, I will take a look at the issue again bearing in mind the above information and update this thread if required.
    – Klaptrap
    Feb 28, 2011 at 5:33
  • Any good online articles on how to configure an Edge Firewall as a Web Proxy?
    – Klaptrap
    Feb 28, 2011 at 7:39
  • Try a new question. Feb 28, 2011 at 13:16
  • No need. All done.
    – Klaptrap
    Mar 1, 2011 at 5:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.