Jim, Would please take a look here http://www.bossaudio.com/ara/mizrahi.csv also http://www.bossaudio.com/ara/rules.PNG Thank you very much -----Original Message----- From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx] Sent: Sunday, April 24, 2005 3:37 PM To: [ISAserver.org Discussion List] Subject: [isalist] RE: Mizrahi Bank http://www.ISAserver.org Please don't use Excel format. That's more overhead than is necessary for a simple text log. ------------------------------------------------------- Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://isaserver.org/Jim_Harrison/ http://isatools.org Read the help / books / articles! ------------------------------------------------------- -----Original Message----- From: Ara [mailto:ara@xxxxxxxxxxxxx] Sent: Sunday, April 24, 2005 12:47 To: [ISAserver.org Discussion List] Subject: [isalist] RE: Mizrahi Bank http://www.ISAserver.org Jim, Thank you very much for reply. I did cut some of log files due to the fact that I got rejected mail (over 30k) but will send a link for files in excel format, There is a question raised in my mind following logs. Sorry if it sounds stupid, but as far as I know internal network is my 192.168.0.x subnet. So what is this 0.0.0.0 doing here? -----Original Message----- From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx] Sent: Friday, April 22, 2005 8:33 PM To: [ISAserver.org Discussion List] Subject: [isalist] RE: Mizrahi Bank http://www.ISAserver.org This is all you're logging? There is MUCH more information than that to be had, like error codes, HTTP status, etc. Those log entries are incomplete at best. ------------------------------------------------------- Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://isaserver.org/Jim_Harrison/ http://isatools.org Read the help / books / articles! ------------------------------------------------------- -----Original Message----- From: Ara [mailto:ara@xxxxxxxxxxxxx] Sent: Friday, April 22, 2005 18:43 To: [ISAserver.org Discussion List] Subject: [isalist] RE: Mizrahi Bank http://www.ISAserver.org Jim, Thank you for reply. As you see here, I get connoted and then when I click on some accounts, it pushes me back to logon page. I can send you a full excel file log if you don't mind. It is coming from ip 0.0.0.0 instead of my client. Is that the cause? Thank you 0.0.0.0 No Proxy onlinebanking.mizrahibank.com TCP Web Proxy Filter 4/22/2005 18:28 66.194.49.56 443 SSL-tunnel Failed Connection Attempt onlinebanking.mizrahibank.com:443 0.0.0.0 No Proxy onlinebanking.mizrahibank.com TCP Web Proxy Filter 4/22/2005 18:28 66.194.49.56 443 SSL-tunnel Failed Connection Attempt onlinebanking.mizrahibank.com:443 0.0.0.0 No Proxy onlinebanking.mizrahibank.com TCP Web Proxy Filter 4/22/2005 18:28 66.194.49.56 443 SSL-tunnel Failed Connection Attempt onlinebanking.mizrahibank.com:443 0.0.0.0 No Proxy onlinebanking.mizrahibank.com TCP Web Proxy Filter 4/22/2005 18:28 66.194.49.56 443 SSL-tunnel Failed Connection Attempt onlinebanking.mizrahibank.com:443 0.0.0.0 No Proxy onlinebanking.mizrahibank.com TCP Web Proxy Filter 4/22/2005 18:28 66.194.49.56 443 SSL-tunnel Failed Connection Attempt onlinebanking.mizrahibank.com:443 0.0.0.0 No Proxy onlinebanking.mizrahibank.com TCP Web Proxy Filter 4/22/2005 18:28 66.194.49.56 443 SSL-tunnel Failed Connection Attempt onlinebanking.mizrahibank.com:443 0.0.0.0 No Proxy onlinebanking.mizrahibank.com TCP Web Proxy Filter 4/22/2005 18:28 66.194.49.56 443 SSL-tunnel Failed Connection Attempt onlinebanking.mizrahibank.com:443 0.0.0.0 No Proxy onlinebanking.mizrahibank.com TCP Web Proxy Filter 4/22/2005 18:28 66.194.49.56 443 SSL-tunnel Allowed Connection onlinebanking.mizrahibank.com:443 0.0.0.0 No Proxy onlinebanking.mizrahibank.com TCP Web Proxy Filter 4/22/2005 18:28 66.194.49.56 443 SSL-tunnel Allowed Connection onlinebanking.mizrahibank.com:443 0.0.0.0 No Proxy onlinebanking.mizrahibank.com TCP Web Proxy Filter 4/22/2005 18:28 66.194.49.56 443 SSL-tunnel Failed Connection Attempt onlinebanking.mizrahibank.com:443 0.0.0.0 No Proxy onlinebanking.mizrahibank.com TCP Web Proxy Filter 4/22/2005 18:28 66.194.49.56 443 SSL-tunnel Failed Connection Attempt onlinebanking.mizrahibank.com:443 0.0.0.0 No Proxy onlinebanking.mizrahibank.com TCP Web Proxy Filter 4/22/2005 18:28 66.194.49.56 443 SSL-tunnel Failed Connection Attempt onlinebanking.mizrahibank.com:443 0.0.0.0 No Proxy onlinebanking.mizrahibank.com TCP Web Proxy Filter 4/22/2005 18:28 66.194.49.56 443 SSL-tunnel Failed Connection Attempt onlinebanking.mizrahibank.com:443 0.0.0.0 No Proxy onlinebanking.mizrahibank.com TCP Web Proxy Filter 4/22/2005 18:28 66.194.49.56 443 SSL-tunnel Failed Connection Attempt onlinebanking.mizrahibank.com:443 0.0.0.0 No Proxy onlinebanking.mizrahibank.com TCP Web Proxy Filter 4/22/2005 18:29 66.194.49.56 443 SSL-tunnel Failed Connection Attempt onlinebanking.mizrahibank.com:443 192.168.0.118 TCP Firewall 4/22/2005 18:29 192.168.0.254 8080 Unidentified IP Traffic Closed Connection - ________________________________________ From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx] Sent: Friday, April 22, 2005 6:08 PM To: [ISAserver.org Discussion List] Subject: [isalist] RE: Mizrahi Bank http://www.ISAserver.org Please copy & paste the exact log entry. Crazy s* doesn't get much help around here... ------------------------------------------------------- Jim Harrison MCP(NT4, W2K), A+, Network+, PCG http://isaserver.org/Jim_Harrison/ http://isatools.org Read the help / books / articles! ------------------------------------------------------- ________________________________________ From: Ara [mailto:ara@xxxxxxxxxxxxx] Sent: Friday, April 22, 2005 15:29 To: [ISAserver.org Discussion List] Subject: [isalist] Mizrahi Bank http://www.ISAserver.org Hello I would appreciate for any answer or comment. I have such a hard time logging to bank account on https://onlinebanking.mizrahibank.com/ it basically either doesn't login or logs and kicks me out in 2 seconds. I have tracked the logs, there is no denied connection. All I can see is failed connection to 66.194.49.56. I even created a separate rule for it, no http filter, but that still gets me no where. I get all kind of crazy s*, asp error, 500 error. People in bank keep saying that it is our ISA server, but I want to be surer before I do something serious about this So if someone has experience with online banking through this bank, please let me know Much appreciated ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: ara@xxxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx Attention: This message, including any attachment(s), is intended only for the use of the individual(s) to which it is addressed and may contain information that is privileged or confidential. Any other distribution, copying or disclosure is strictly prohibited. If you are not the intended recipient or have received this message in error, please notify us immediately by reply e-mail and permanently delete this message including any attachment(s), without reading it or making a copy. Any outgoing message has been scanned for possible harmful file(s) or script(s), but it is your sole responsibility to run detection tools as we won't guarantee the safety of message(s). ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx All mail to and from this domain is GFI-scanned. ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: ara@xxxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: jim@xxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx All mail to and from this domain is GFI-scanned. ------------------------------------------------------ List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ ------------------------------------------------------ Other Internet Software Marketing Sites: World of Windows Networking: http://www.windowsnetworking.com Leading Network Software Directory: http://www.serverfiles.com No.1 Exchange Server Resource Site: http://www.msexchange.org Windows Security Resource Site: http://www.windowsecurity.com/ Network Security Library: http://www.secinf.net/ Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com ------------------------------------------------------ You are currently subscribed to this ISAserver.org Discussion List as: ara@xxxxxxxxxxxxx To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist Report abuse to listadmin@xxxxxxxxxxxxx