Blocked Requests...
- From: "Ball, Dan" <DBall@xxxxxxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Fri, 4 Mar 2005 11:51:24 -0500
Another intriguing issue, not really a problem, just curious as to the
cause.
I did a log search over the last 24 hours to see if the anomaly I had
reported earlier was still there. I.e., the part where I setup a
secondary external Network, put all of the valid IP address ranges on
it, and use that in my policies. The Default External Network is blank,
no IP ranges are assigned to it in ISA. This is because, theoretically,
there should be no traffic routed to it because all the ranges are
entered into a different external Network.
I still found over a thousand entries of requests, mostly web, that got
routed to that network. I thought this was a bit curious, so I dumped
the entire log to Excel, and looked it over a bit closer. As far as I
could tell, all of the domain names(okay, I didn't check EVERY domain
name) in the URLs that were logged were mis-typed (i.e.
www.goooogle.com), and would have generated a host-not-found error even
if they had went through.
Are they routed to that network because they didn't have an IP assigned
to them, and thus didn't fit the criteria of the others? I good reason
to keep the Default External Network in use I guess.
Other related posts:
