Security

Ask something
Discussion Locked

ISA SERVER 2000 (DOWNLOADING RESTRICT)

0 helpful
13 replies

by haideraly

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

WELL I AM FACING BIG PROBLEM NOW A DAYS, I NEED HELP PLEASE, PLEASE HELP ME ONE OF MY SENIOR SOVLED MY PROBLEM .

" I AM A NETWORK CABLE OPERATOR, I HAVE INSTALL WINDOWS 2000 SERVER FOR OPERATING SERVER SYSTEM, I HAVE INSTAL ISASERVER2000 FOR INTERNET CONNECTION SHARING, I WANNA RESTRICT DOWNLOADING FROM MY CLIENT, FTP, EXE, MPG, VDO, AUDIO ...

MAIN THING I WANT BLOCK ALL FTP FROM BROWSERS, I AM UNABLE TO DO ANYTHING, PLEASE HELP ME , AND TELL ME WHAT IS THE RIGHT WAY TO CREATE RULES AND POLICEIS, SOMETIME MY MSN AND YAHOO RESTRICT , RIGHT NOW I AM CREATING ONLY ONE RULE ALLOW ALL PROTOCOL, SERVER OPEN FOR EVERY ONE . EVERY ONE DOWNLOAD FTP SOFTWARES AND DOWNLOADING OPEN FOR EVERY ONE , PLEASE HELP ME , I ONLY RESTRICT DOWNLOADING, AND SET ONLY FOR SCHEDULE ..
I HOPE ANYONE REPLY ME
THANKS
HAIDER !

13 replies

by cg it

ISA default install is to block all traffic so how's it configured? Easiest way is to disable the FTP packet filter and install the firewall client program on all workstations. What kind of clients are you using? Secure NAT or Firewall Client?

by cg it

ah forgot, where is ISA server positions in the network topology? If it the perimeter firewall on it's own box? Are you running 2 NICs? ISA works best with 2 NICs.

by cg it

there is a couple of different ways to block on ISA server. You can create a Site & Content rule with a destination set that redirects the client to another site. You can create a destination set that blocks a specific site such as Napster.
You can create a protocol rule that also denies traffic. You can create a protocol rule that denies traffic over a specific TCP port and direction.

by cg it

Also note: there are a couple of different clients on ISA. Secure NAT and Firewall clients. you can use Active Directory [if you run AD] to create a security group named Internet Access. Users who are allow to access are placed in this group. Only those users who are members of this group have internet access. All other users are denied access. Then you also create the site and content rules, destinations sets, and protocol rules.

To limit days and times, In ISA Server management MMC Destination sets you'll see a tab for schedule. you set the schedule for when and at what times.

by cg it

as a reference for how to articles on ISA server visit isaserver.org. they have step by step instructions on how to configure ISA server.

by matrixmakis786

Dear Haider,

First thing first server has 2 network card and then routing a both network card In ISA Server.

Now u go server & array --> Policy Elements ---> Content Groups ---> Create a New Content Group --->type the name : Block Downloading ,then Available type : add a extension only u want to block such as ( exe,zip,mp3,avi ) & Click Ok.

Now u go server & array --> Access Policy ---> Site & Content Rule ---> Create a New Rule --->type Name : Block Downloding ---> nothing changes click next ---> then select a Custom --->
nothing changes click next ---> again nothing changes click next ---> select a user u want to block downling ---> then select a Only the following Content Type : Audio , Video & Block Downloading ---> Finish

Then stop Isa services & restart service.

now u block the downloading.

by matrixmakis786

Dear haider,

salam i am happy ur prob is solve. now i tell u about how can i schedule it.

Now u go server & array --> Policy Elements ---> Content Groups ---> Schedules---> Create a New Schedule ---> type the name "Limit Downloading" ---> then select highlighted 12pm to 6am --> then select 7am to 12pm then click Inactive--> click ok button.

Now u go server & array --> Access Policy ---> Site & Content Rule ---> Select a Block Downloding rule ---> then right click ---> then select propterties ---> then select a Schedule (in a tab strip)---> now u click a combo box then u see a new schedule in "Limit Download" then click it, apply it & ok.

Then stop Isa services & restart service it.

if u r in Karachi,Pakistan. Then u Call me my number is 0300-3605903. My Name is Kamran Ahmed.
I am running a company ( Matrix Communication ).
We can provide a compelete IT Solutions Such as Networking, Web Designing, Software Development , Hardware Solutions.

by acforgmail

Dear i completed all steps which u had written to stop download and i stop all services and restart all services but that is not working for me i am still able to download

and if possible plzzz tell me how to permit particular site and how to block sites

and ya how to block messengers all threw ISA 2000 so plzzzzzzz tell me that's Urgent for me

I Hope will u help out
Thanks In Advance

by haideraly

Dear Makis ..
Thanks for helping me .. I do this exersice and blocked downloading .. Thanks once again makis .. you are the one who solved my problem and guide me in a easy steps .. Appriciatable .. well Makis .. tell me one more thing .. "I wanna set a timming to unblock my download.. I mean .. 7am to 12pm Downloading automatic start frm ISA server and after 12pm to 6am download blocked .. I hope you reply me Thank you very much dude .. takecare

by swas786

ISA SERVER 2000 (DOWNLOADING RESTRICT)
WELL I AM FACING BIG PROBLEM NOW A DAYS, I NEED HELP PLEASE, PLEASE HELP ME ONE OF MY SENIOR SOVLED MY PROBLEM .

" I AM A NETWORK CABLE OPERATOR, I HAVE INSTALL WINDOWS 2000 SERVER FOR OPERATING SERVER SYSTEM, I HAVE INSTAL ISASERVER2000 FOR INTERNET CONNECTION SHARING, I WANNA RESTRICT DOWNLOADING FROM MY CLIENT, FTP, EXE, MPG, VDO, AUDIO ...

MAIN THING I WANT BLOCK ALL FTP FROM BROWSERS, I AM UNABLE TO DO ANYTHING, PLEASE HELP ME , AND TELL ME WHAT IS THE RIGHT WAY TO CREATE RULES AND POLICEIS, SOMETIME MY MSN AND YAHOO RESTRICT , RIGHT NOW I AM CREATING ONLY ONE RULE ALLOW ALL PROTOCOL, SERVER OPEN FOR EVERY ONE . EVERY ONE DOWNLOAD FTP SOFTWARES AND DOWNLOADING OPEN FOR EVERY ONE , PLEASE HELP ME , I ONLY RESTRICT DOWNLOADING, AND SET ONLY FOR SCHEDULE ..
I HOPE ANYONE REPLY ME
THANKS
Syed Waqas ALi Shah

by najeeb181

Here you go

#1.
In the ISA Manager, define a new Destination Set under
Internet Security and Acceleration Server --> Servers and Arrays -->
--> Policy Elements --> Destination Sets
Call it something like 'Blocked Websites' and click OK.
You can add sites to this set by editing. A good way to block
domains in ISA2000 with this rule is in the following format
(Forget the example on the Add/Edit Destination dialog):
Destination: *domain.com (Or *domain.* to eliminate all extensions)
Path: * (When clicking OK, this changes into /* which is good)

#2.
In the ISA Manager, define a new rule for Blocked Websites under
Internet Security and Acceleration Server --> Servers and Arrays -->
--> Access Policy --> Site and Content Rules
Create a new rule, and define it as follows:
Name: Blocked Websites (May be same as Destination Set, for conveniance)
Rule Action: Deny (You may also set a redirect rule with it)
Apply to: Specified Destination Set, select your Destination Set from #1
Use this Schedule: Always
Apply the rule to requests from: Any Request

Finish, and you're done. from that moment on, your ISA2000 server will
block attempts to load webpages you defined in your Blocked Websites
Destination Set (and redirect to wherever if you enabled that option).
Note: ISA2000 will ofcourse have a copy of some of your blocked websites
still in it's cache, but a few refreshes will soon take care of those
and they will no longer load.

Here's some Example URL's you could block to prevent logins:
For Hotmail:
http://www.hotmail.com, login.passport.net/uilogin.srf?id=2
hotmail.co.jp, hotmail.co.uk, hotmail.com, hotmail.de, hotmail.fr,
hotmail.it, etc.
For Yahoo:
mail.yahoo.com, login.yahoo.com, login.yahoo.com/config/login
For Gmail:
gmail.google.com
Etc.

This discussion is closed to new replies.