RE: ISA - Exchange traffic not captured in report jobs
- From: "Paul Aitchison" <pdaitch@xxxxxxxxxxxxxxxx>
- To: "'[ISAserver.org Discussion List]'" <isalist@xxxxxxxxxxxxx>
- Date: Tue, 24 Jun 2003 10:28:40 +1000
Thanks Tom!
Just so I understand correctly, if we remove the publishing packet filters
and create a protocol rule then the traffic will be picked up in the report
jobs?
Unfortunately we cant do anything about the Exchange running on the SBS box
unless we can get the client to pony up the dough for another server :-)
Cheers
Paul
_____
From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxxxxxxxxx]
Sent: Tuesday, 24 June 2003 9:42 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: ISA - Exchange traffic not captured in report jobs
http://www.ISAserver.org
Hi Paul,
Are you using packet filters or publishing rules to publish the Exchange
Server? Keep in mind that if the SMTP service is on the ISA firewall itself,
it uses a packet filter to send outbound messages instead of Protocol Rules,
so that traffic will not be included in the reports or the packet filter
logs. You could enable logging for allow filters, but you haven't seen
nothin' yet in terms of log file sizes if you do that ;-)
BTW -- just another reason not to run enterprise groupware servers on a
Firewall.
HTH,
Tom,
Thomas W Shinder
<http://www.isaserver.org/shinder> www.isaserver.org/shinder
ISA Server and Beyond: http://tinyurl.com/1jq1
Configuring ISA Server: <http://tinyurl.com/1llp> http://tinyurl.com/1llp
-----Original Message-----
From: Paul Aitchison [mailto:pdaitch@xxxxxxxxxxxxxxxx]
Sent: Monday, June 23, 2003 6:01 PM
To: [ISAserver.org Discussion List]
Subject: [isalist] ISA - Exchange traffic not captured in report jobs
http://www.ISAserver.org
Hi all,
One of our clients recently received a hefty internet usage bill for using
7.5gb over their 3 gb limit.
Looking thru the logs we've accounted for approximately 5gb of traffic and
we think that the Exchange server is where the rest of it has come from.
Is there a trick to allow ISA to capture SMTP traffic? It does show up in
the report jobs as SMTP but with 0 next to it.
Due to disk space limitations we cant enable maximum logging on the ISA
server.
The client is running SBS2000 with Exchange and ISA on the same machine and
the Exchange server was published under ISA.
Any help would be appreciated !
Cheers
Paul Aitchison
Senior Technician
Rampant Technology
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
tshinder@xxxxxxxxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
pdaitch@xxxxxxxxxxxxxxxx
To unsubscribe send a blank email to $subst('Email.Unsub')
Other related posts:
