Networks

Ask something
Question Locked

ISA 2004 user authentication problem

0 helpful
6 replies

by eliraad

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have an ISA server 2004 Standard Edition, all my policies were based on the IPs, but now I want to change the policy and make them by user access. I have an active directory 2003 on another server that contains a DHCP and DNS server as well and the isa server is on a seperate server. After choosing the Integrated authentication mode and creating a rule based on a user access, I get on the client web browser a windows to enter a user name and a password. I fill the corresponding user name and password of the domain account that i enabled its access to the internet but it keeps showing again and again and i cannot access the internet. (knowing that i am logged on in the computer also with the same account, so im nt supposed to be asked for any authentication...this is why it is called Integrated). On the Isa server I checked the session in the monitor tab i get my firewall client and proxy client having been recorded as secure nat as well!!!(user1 which is a web proxy user is recorded as he is a web proxy user and a secure nat user per ex) I dunno what is all the mess, so please if anyone had a similar problem or have useful information, im waiting your help...else ill format the server..

6 replies

by cg it

the Internet Users security group and you need to install the ISA server firewall client program.

Users previously were classified secure NAT clients which allows them internet access. Once you change ISA server to intergrate with Active Directory, they have to belong to the Internet Users Security group to gain access.

by eliraad

What i can understand from you is:
1 - Integrated authentication only works on firewall clients.
2 - ALL kind of client must be members of the Internet Users Security group

right?
but i have to remind you that:
1 - i do not have configured any of my clients as Secure Nat client. I just have proxy clients and firewall clients.
2 - if i configured access based on a user name, and this user logs on to the computer with his domain account, then when he opens the web browser he must directly be authenticated ==> he is not supposed to enter any username and password anymore!! but in my case he is asked for a username and password that also doesnt work!!
3 - is there any thing to do on the active directory to integrate ISA? and the Internet Users Security is created per default or i have to create such group?
4 - is there any software that can be used as a third party to solve this issue of internet access?

by cg it

any client that is not a firewall client is a secure NAT client.

If your ISA server is intergrated with Active Directory, then uses must belong to the Internet Users security group to gain access to the internet. All others not members of the internet security group are denied access.

When you install ISA server on a member server of a domain, it will create the Internet Users security group which you then place with other groups such as domain users or individual users.

3rd party software to resolve would be another proxy firewall service.

by eliraad

well i formated the isa server...i installed isa 2006 and the authentication worked just fine. the mystery of the problem is still unknown in isa 2004 bt im sure it is not a problem in the isa 2004 it was a problem in the windows configuration and the many add ons and firewall on the previous server.

by biju thomas

In ISA 2004 you creat a user group and add the members from your active Directory.

Instead of all user you can choose this usergroup to get the internet and it will not ask again for authentication. Anyone not member of that group is asked for a username.
Hope this will help you

This discussion is closed to new replies.