[isapros] Re: Fw: Re: Web Filter with HTTPS
- From: "Jim Harrison" <Jim@xxxxxxxxxxxx>
- To: <isapros@xxxxxxxxxxxxx>
- Date: Wed, 20 Jun 2007 15:03:55 -0700
You're overcomplicating it.
Web Publishing requires a web listener, and these are handled by the Web
Proxy filter.
You never "choose" the protocol for web publishing except that you
define the listening ports as "SSL" and "HTTP" (non-SSL). In this way,
you merely advise the Web proxy filter which "side" of the listener
should handle SSL exchanges.
Regardless of which "side" of the listener accepts the traffic, only
HTTP is valid (SMTPS would fail).
Since the HTTP Filter is bound to the Web Proxy filter (as are all Web
Filters), HTTP Filter properties are built-in to any web publishing
rule. You r-click the rule and select "configure HTTP".
-----Original Message-----
From: isapros-bounce@xxxxxxxxxxxxx [mailto:isapros-bounce@xxxxxxxxxxxxx]
On Behalf Of Thor (Hammer of God)
Sent: Wednesday, June 20, 2007 2:52 PM
To: isapros@xxxxxxxxxxxxx
Subject: [isapros] Re: Fw: Re: Web Filter with HTTPS
We're all pendants here ;)
Here is my specific question then:
I want to publish HTTPS ie OWA for RPC and HTTPS. I obviously need to
configure the HTTP Filter properties. If I have the Web Filter bound to
HTTPS (iow, selected in the available filters under the protocl config)
then
ALL outbound HTTPS traffic breaks. Therefore, one has to un-bind the
Web
Filter from HTTPS for outbound to work (on this install).
Ergo, since the Web Filter is not bound to the HTTPS protocol (in order
for
outbound to work), there is no way to select "Configure HTTP" from the
properties of the web publishing rule.
FromwhenthouNowThinketh, WTF is the deal on what properties of the
filter
are applied? See what I mean??
t
----- Original Message -----
From: "Jim Harrison" <Jim@xxxxxxxxxxxx>
To: <isapros@xxxxxxxxxxxxx>
Sent: Wednesday, June 20, 2007 2:31 PM
Subject: [isapros] Re: Fw: Re: Web Filter with HTTPS
> Not to be pedantic, but the published traffic being handled by the web
> proxy isn't "HTTPS", it's "HTTP inside SSL" and ISA handles each layer
> separately. By the time the web proxy is evaluating the HTTP traffic,
> SSL is no longer a factor and it gets treated just like "plain old"
HTTP
> traffic.
>
> -----Original Message-----
> From: isapros-bounce@xxxxxxxxxxxxx
[mailto:isapros-bounce@xxxxxxxxxxxxx]
> On Behalf Of Thor (Hammer of God)
> Sent: Wednesday, June 20, 2007 2:26 PM
> To: isapros@xxxxxxxxxxxxx
> Subject: [isapros] Re: Fw: Re: Web Filter with HTTPS
>
> Then how do you configure the HTTP filtering on web pub rules if the
Web
>
> Filter is not bound to HTTPS?
>
> t
> ----- Original Message -----
> From: "Jim Harrison" <Jim@xxxxxxxxxxxx>
> To: <isapros@xxxxxxxxxxxxx>
> Sent: Wednesday, June 20, 2007 2:24 PM
> Subject: [isapros] Re: Fw: Re: Web Filter with HTTPS
>
>
>> Sorta..
>> if it's a web pub rule, then the web proxy is already involved and no
>> "protocol binding" is required.
>> If it's a server pub rule, then ISA is effectively blind to the
> traffic
>> anyway.
>>
>> -----Original Message-----
>> From: isapros-bounce@xxxxxxxxxxxxx
> [mailto:isapros-bounce@xxxxxxxxxxxxx]
>> On Behalf Of Thor (Hammer of God)
>> Sent: Wednesday, June 20, 2007 2:05 PM
>> To: isapros@xxxxxxxxxxxxx
>> Subject: [isapros] Fw: Re: Web Filter with HTTPS
>>
>> OK, so you are saying that if I unbind the Web Filter from HTTPS, and
>> create
>> a pub rule for HTTPS, then the filter will still be used for the Pub
>> rule?
>>
>> t
>>
>>
>> -----Original Message-----
>> From: isapros-bounce@xxxxxxxxxxxxx
> [mailto:isapros-bounce@xxxxxxxxxxxxx]
>> On Behalf Of Jim Harrison
>> Sent: Wednesday, June 20, 2007 5:43 PM
>> To: isapros@xxxxxxxxxxxxx
>> Subject: [isapros] Re: Web Filter with HTTPS
>>
>> The web filter is the part that expects to watch the HTTP traffic as
> it
>> flows through ISA.
>> With the exception of web publishing, HTTPS traffic is effectively
>> invisible to ISA and therefore any policies enacted via the web
filter
>> (think HTTP Filter, too) cannot be applied and ISA will default to
> "when
>> in doubt, trash it" mode.
>>
>> -----Original Message-----
>> From: isapros-bounce@xxxxxxxxxxxxx
> [mailto:isapros-bounce@xxxxxxxxxxxxx]
>> On Behalf Of Thor (Hammer of God)
>> Sent: Wednesday, June 20, 2007 1:15 PM
>> To: isapros@xxxxxxxxxxxxx
>> Subject: [isapros] Web Filter with HTTPS
>>
>> Just a sanity check here... why would all HTTPS traffic fail if the
> Web
>> Filter was bound to the HTTPS protocol?
>>
>> t
>>
>> All mail to and from this domain is GFI-scanned.
>>
>>
>>
>>
>> All mail to and from this domain is GFI-scanned.
>>
>>
>
>
>
> All mail to and from this domain is GFI-scanned.
>
>
All mail to and from this domain is GFI-scanned.
Other related posts: