Wierd Issue

http://www.ISAserver.org


Using ISA between Web Servers and the world - no internal users behind it just 
the Web servers.  Did set up integrated, but not using proxy.  Somehow, it 
appears one particular individual comes in as a Firewall Service user and 
browses dating/singles websites. I noticed the problem because I started 
getting Web Proxy errors in the Event log -- "says ISA couldnt create packet 
filter for XXX. XXX.XXX.XXX where the Xs were external IPs" -- acting like they 
should have been in the LAT.  I looked in regular logs - which got real big 
starting last weekend... with entries for www.yahoo.com and other external 
websites.  



Have had 41 unique users in the last week.  I've tried forcing authentication 
for all outbound traffic.  The one big user, I kick out and he's back in five 
minutes for more???  I don't think it is spamming -- they aren't smtp-ing, I 
don't have SMTP on the ISA, they show up as a firewall client in the logs and 
in the sessions (when I catch them on).  



Any ideas?  



Thanks



Janet Pickel






______________________________________________________
Get Paid... With Your Free Email at
http://www.zwallet.com/index.html?user=picalily

------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Exchange Server Resource Site: http://www.msexchange.org/
Windows Security Resource Site: http://www.windowsecurity.com/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as: 
paul@xxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')

Other related posts: