For problems with outbound Web access following installation, check the following steps:

1. Understand the ISA Server network model required to configure and allow outbound Web access.
   
2. Understand what access is allowed and denied by the default rules following installation.
   
3. Create a rule to allow outbound access.
   
4. Check the order of access rules to be sure that the rule allowing outbound access is applied correctly.
   
5. Check the ISA Server log to verify that traffic is being allowed.
   

The following sections discuss each of these steps.

Step 1: Understand the ISA Server network model

Step 2: Understand default rules following installation

Step 3: Create an outbound access rule

Step 4: Check access rule order

Step 5: Check the log

• Check the ISA Server log to see what rule is denying the traffic. For example, to check what rule is denying outbound Simple Mail Transfer Protocol (SMTP) traffic, do the following.
  

To run the log filter

1. In the console tree of ISA Server Management, click Monitoring.

2. In the details pane, click the Logging tab.

3. On the Tasks tab, click Edit Filter.

4. To log all SMTP traffic, do one of the following:

   • In Filter by, select Destination Port, and then in Condition, select Equals. Then in Value, type 25.
     
   • Alternatively, in Filter by, select Protocol, and then in Condition, select Equals. Then in Value, select SMTP.
     

5. Click Add to List, and then click Start Query.

6. Try to send SMTP mail, and then monitor the Logging tab to check the query results.

The logging query may show a number of results. For example, the query may show that ISA Server is letting traffic through.

The query can also show that traffic was denied.

If there is no rule available, this may be indicated in the log query.

If internal clients are unable to access specific Web sites, check the following steps:

1. Use PING to check access to the external Web site.
   
2. Check Domain Name System (DNS) settings for name resolution issues.
   
3. Check access rules.
   

Step 1: Verify that PING is allowed from the ISA Server computer to the external Web site

Step 2: Check DNS settings

Step 3: Check ISA Server access rules

If specific clients are having issues accessing Web sites, check whether the issue is server-based or client-based, as follows:

1. Understand how client requests are handled by ISA Server.
   
2. Check that ISA Server can handle name resolution on behalf of clients.
   
3. Ensure that clients are able to carry out name resolution if required.
   
4. Check that clients are able to access ISA Server to make the request.
   
5. If authentication is required on the listener, check that clients are able to authenticate.
   
6. If authentication is required by the rule, check that clients are able to authenticate.
   

Step 1: Understand client requests

Step 2: Verify ISA Server name resolution

Step 3: Verify client name resolution

Step 4: Check that clients can contact ISA Server

Step 5: Check listener authentication settings

Step 6: Check access rule authentication settings

When running ISA Server on a computer with a single network adapter, check the following:

• Understand what outbound scenarios are supported. These include:
  
  • Forwarding Web proxy requests from internal clients (HTTP, HTTPS, or FTP) for downloads. Firewall client requests are not supported with a single network adapter.
    
  • Caching Web content for use by clients on the corporate network.
    
  • For more information about supported scenarios, see "Configuring ISA Server 2004 on a Computer with a Single Network Adapter" at the Microsoft TechNet Web site. The information in this article also applies to ISA Server 2006.
    
• In a single network adapter environment, ensure that any edge firewall device is configured to forward relevant Internet requests from ISA Server to the Internet.
  
• We recommend that you apply the Single Network Adapter network template. To verify the network template you have applied, and to apply the single network template, do the following.
  

1. In ISA Server Management, expand the Configuration node, and then click the Networks node.

2. In the details pane, click the Network Rules tab. The graphic on the tab displays the name of the network template currently applied.

3. To apply the Single Network Adapter network template if required, click the Templates tab, and then select the Single Network Adapter option.

4. On the Welcome to the Network Template Wizard page, click Next.

5. On the Export the ISA Server Configuration page, click Export, and then follow the instructions in the Export Wizard. After completing the Export Wizard, click Next.

6. In the Internal Network IP Addresses page, the Internal network IP address range is predefined for the Single Network Adapter network template. By default, this includes all IP addresses except 0.0.0.0, 255.255.255.255, and the address ranges of the Local Host network (127.0.0.0–127.255.255.255).

• In a single network adapter scenario, ISA Server is only aware of two networks: the Local Host network that represents the ISA Server computer itself, and the Internal network. When an internal client browses the Internet, ISA Server sees the source and destination addresses of the Web request as belonging to the Internal network. After applying the Single Network Adapter network template, rules should be configured as follows:
  
  • A default deny rule is configured, and no Internet access is allowed.
    
  • When you create a rule to allow access, the source defined in an access rule should consist of actual Internet IP addresses. This is required because in a single network adapter configuration, every IP address is considered part of the Internal network, apart from the loopback address and the Local Host network range. For more information about defining ISA Server network elements for IP addresses, see the section "Predefined Network Objects" in "Network Concepts in ISA Server 2006" at the Microsoft TechNet Web site.
    
  • The destination defined in an access rule should either be the Internal network or the specific destination IP address.
    
  • Even with the Single Network Adapter network template applied, ISA Server still protects itself (the Local Host network) from the Internal network. There are a number of predefined system policy rules that allow traffic to and from the Local Host network. To allow other traffic, you must create explicit access rules.
    
  • To accept outbound Web requests from internal clients, Web Proxy Filter for the Internal network must be enabled to listen for Web Proxy client requests. For more information, see the section "Configuring Network Properties" in "Network Concepts in ISA Server 2006" at the Microsoft TechNet Web site.
    
  • If Web pages include items that require use of protocols other than HTTP and FTP (download), Web Proxy clients accessing the site in a single network adapter scenario will not be able to access these items. One workaround is to configure direct access to these sites. For more information, see "Internal Client Concepts in ISA Server 2006" at the Microsoft TechNet Web site.
    

If ISA Server network settings are incorrectly configured, internal users may not be able to access the Internet. Common issues to check include:

• Configuring ISA Server networks correctly is pivotal for successful deployment. For more information about understanding ISA Server network architecture, see the following resources at the Microsoft TechNet Web site:
  
  • Network Concepts in ISA Server 2006
    
  • Best Practices for Configuring Networks in ISA Server 2004
    
  • Troubleshooting Network Configuration in ISA Server 2004
    
• If client requests are not being handled as expected, check that networks are configured correctly. In particular, note the following:
  
  • Each ISA Server network must have a network adapter associated with it. Each adapter should only be associated with one ISA Server network. If you add a custom ISA Server network, you must have a unique network adapter to associate with it.
    
  • A network definition should include all IP addresses that can be reached directly from the associated network adapter, including remote subnets. Do not create separate networks for remote subnets physically connected to local subnets.
    
  • The IP address range of the ISA Server network should match the routing table. Persistent static routes should be defined in the routing table for each remote subnet.
    
  • Each IP address can only belong to one ISA Server network. Do not define ISA Server networks with overlapping IP address ranges.
    
  • ISA Server 2006 and ISA Server 2004 do not support multiple external network interfaces.
    
  • Dynamic IP addresses should only be used on the adapter associated with the external network.
    
  • Any IP address that is not contained in ISA Server-protected networks is considered part of the External network.
    

Incorrectly configured rules may cause issues with Internet access. Check the following:

• Verify that you have an access rule allowing traffic to required Web sites.
  
• When you apply an ISA Server network template, access rules may be created automatically. Ensure that you have the correct template applied for your scenario, and that the rules are configured as required. For more information, see "Network Concepts in ISA Server 2006" at the Microsoft TechNet Web site.
  
• Check the properties of access rules allowing the traffic. Questions to consider:
  
  • Is the protocol configured correctly?
    
  • Are the destination and source correctly configured in the rule?
    
• Check that there is no deny rule being applied before an allow rule. Rules are matched in the order in which they appear in the rules list.
  
• Check that your rules follow this order, from the top of the rule list:
  
  1. Global deny rules, which are rules that deny access to all users.
     
  2. Global allow rules, which are rules that allow specific access to all users.
     
  3. Rules that allow or deny access to specific computers.
     
  4. Rules that allow or deny specific users, URLs, and MIME types.
     
  5. Other allow rules.
     
  6. Default deny rule, which is at the bottom of the list. Requests that are not matched by any other rule in the list are blocked by this rule.
     

Issues with infrastructure can affect IP address assignment and name resolution. Check the following:

1. Following installation, ISA Server enables a set of default access rules, known as system policy rules. These system policy rules allow access to and from the ISA Server computer (the Local Host network), to infrastructure servers such as DNS and Dynamic Host Configuration Protocol (DHCP) servers. The system policy rules assume that these servers are located in the default Internal network. If they are not, system policy rules may not allow access as expected. For example, if you installed ISA Server on a domain controller, network access will not be configured to infrastructure services running on the ISA Server computer. (This does not refer to the Microsoft Windows® Small Business Server 2003 (Windows SBS) server software with ISA Server 2004 installation that uses the Configure E-mail and Internet Connection Wizard (sometimes known as CEICW).) For more information about default system policy rule settings, see "ISA Server System Policy" at the Microsoft TechNet Web site.
   
2. Check that the ISA Server computer can connect to infrastructure servers.
   
3. Check that DNS servers are configured as required. ISA Server requires name resolution for itself, and handles name resolution for Firewall clients and Web Proxy clients. A DNS server should be configured in the TCP/IP properties of the network adapter associated with the Internal network. You can use an internal DNS server to resolve internal and external names. You can also configure the internal DNS to forward requests to an external Internet service provider (ISP) DNS server. This requires an access rule to allow DNS traffic from the internal DNS server to the External network using the DNS protocol. For more information, see "Configuring DNS Servers for ISA Server 2004" at the Microsoft TechNet Web site.
   

Problem   Some users cannot access the Internet.

Cause    Require all users to authenticate is enabled on the network listening for Web requests from users, so all user requests must be authenticated. Requests from users unable to authenticate (for example, users who are not members of a domain, or client computers configured as SecureNAT clients) are denied.

Solution   Disable Require all users to authenticate. Instead, require authentication on access rules to sites to which you want to limit access. On sites for which you want to allow anonymous access, specify that rules should apply to all users.

Problem   Web Proxy clients in the Internal network have to present credentials more than once when making a Web request.

Cause   This behavior can occur when Require all users to authenticate is enabled on the Internal network, and ISA Server connects to an upstream proxy for Web Proxy client requests. With these two conditions, a connection is always closed for a client connection request that requires authentication.

Solution   If you disable Require all users to authenticate, the initial Web Proxy client request is kept alive. For more information, see the Microsoft Knowledge Base article 842686, "ISA Server 2004 does not maintain client credentials between requests."

Problem   A public Web site has a link to resources that require Microsoft Windows Media® Player. The resources are not opening properly.

Cause   Windows Media Player may be attempting to connect anonymously, and access is denied because authentication is required for the request.

Solution   Use either of the following workarounds:

• The preferred method, to authenticate traffic and log user names, is to install Firewall Client on client computers. Firewall Client then authenticates on behalf of the application.
  
• Allow outgoing access without authentication by creating a rule to allow a set of computers anonymous outgoing access so that they can access the content. Such traffic will not be logged with a user name.
  

Problem   ISA Server is requesting credentials from browsers other than Microsoft Internet Explorer®.

Cause    Require all users to authenticate is enabled on the network from which requests are received from these browsers.

Solution   Disable Require all users to authenticate, and instead enable client authentication on specific access rules as appropriate.

Problem   Users may be prompted for authentication credentials when accessing forbidden pages from allowed sites.

Cause   Users are not allowed to access the sites referenced by links that they click.

Solution   One workaround may be to add a generic no access allowed page. To do this, add a new rule before the last default rule in the ordered rule list. This rule should redirect users to an internal page explaining that there is no access allowed to restricted sites. With this workaround in place, users will no longer be prompted for authentication credentials every time an allowed site refers to a forbidden site. Users will receive the placeholder page instead.

Problem   Java applications on Web sites accessed through ISA Server are not displaying properly.

Cause   This may be a problem for Web proxies (including ISA Server) connecting to Java sites that do not support authentication.

Solution   Add a rule to allow anonymous access to the site, or configure the site for direct access.

Problem   When authenticated users are not members of a group allowed access by a specific rule, they receive an error message. Users should receive a logon prompt instead.

Cause   In ISA Server 2004, if a user has already been authenticated and denied access by the rule, ISA Server returns an HTTP 502 Bad Gateway error, and Internet Explorer does not prompt again for credentials.

Solution   To change this default behavior, you must set the ReturnAuthRequiredIfAuthUserDenied COM property to True. When set to True, users are presented with a dialog box to input credentials. This was the default setting in ISA Server 2000. For more information, see the Microsoft Knowledge Base article 905767, "The ReturnAuthRequiredIfAuthUserDenied property setting does not work if the access rules include a Content Type rule in ISA Server 2004."

Problem   Web Proxy clients that only have access to intranet sites in the perimeter network are prompted for credentials.

Cause   With Basic authentication, Web Proxy clients send an anonymous packet first, and are then prompted for credentials.

Solution   Configure clients as Firewall clients that automatically send credentials.

Problem   Clients configured as SecureNAT clients only (no Web proxy settings pointing to ISA Server) cannot access Internet sites.

Cause   There may be access rules that require authentication, or Require all users to authenticate may be enabled on the network from which client requests are received. SecureNAT clients cannot present authentication credentials.

Solution   Any of the following workarounds may solve the problem:

• Configure Internet Explorer to point to ISA Server in the Web proxy settings.
  
• Install Firewall Client on computers (with or without Web proxy settings specified in Internet Explorer).
  
• Remove authentication requirements from rules.
  

For SecureNAT client applications running on the ISA Server computer (Local Host) the last two workarounds may not work for the following reasons:

• Firewall Client cannot be installed on the ISA Server computer.
  
• Removing authentication requirements from rules may not be effective in some circumstances. If system policy rules requiring authentication are enabled on the Local Host network (for example, the Scheduled Download Jobs rule), requests from SecureNAT client applications, such as the prefetcher, may be blocked. This is due to the behavior of the rules engine. If a client request matches rule criteria, and the rule requires authentication that the client cannot provide, the request is denied by the rule (even if it is an allow rule), and rules lower in the ordered rule list are not evaluated. In this case, system policy rules requiring authentication are evaluated before other rules, and may block SecureNAT client requests that cannot authenticate.
  

Problem   After supplying credentials for a Web site, credentials are again requested.

Cause   This problem may occur if you use Integrated Windows authentication (and the NTLM protocol) on more than one proxy server in a chained proxy configuration. Internet Explorer does not support NTLM authentication with more than one proxy server. Where NTLM authentication is required on each proxy server, authentication will succeed on the first proxy server in the chain. But when the proxy server sends a 407: Proxy Authentication Required response, the user is prompted for credentials. The problem does not exist if Require all users to authenticate is disabled, or NTLM authentication is set only on the first proxy in the chain.

Solution   Configure NTLM authentication on the downstream proxy server in the chain, and configure it to pass credentials to the upstream proxy server. For more information, see the Microsoft Knowledge Base article 822458, "You are repeatedly prompted to enter your credentials to use a proxy server in Internet Explorer Service Pack 1."

It is not possible to have a client authenticate against more than one level of ISA Server. Clients can authenticate against either a downstream server or an upstream server, but not both:

• To authenticate with NTLM against the upstream server, configure the downstream server as anonymous.
  
• To authenticate with NTLM against the downstream server, either configure the upstream server as anonymous, or provide credentials in the downstream routing rule to provide to the upstream server.
  
• Note that if you pass client authentication requests to the upstream server, the downstream server must allow anonymous access, unless you use the same set of client credentials for both servers in the chain. If you use an anonymous setting on the downstream server, for information about the effect on caching, see the Microsoft Knowledge Base article 821098, "Content cache issues on downstream ISA Server computer."
  

Problem   Users visiting a Web site published through ISA Server that requires authentication are repeatedly prompted for credentials, even after supplying valid credentials.

Cause   This may occur if Integrated Windows authentication is enabled on both the ISA Server computer and on Internet Information Services (IIS) of the published Web server. This occurs in a publishing scenario when ISA Server uses the same HTTP headers for authentication as those used by the Web server. The client is prompted for credentials by ISA Server, and ISA Server forwards the request without the credentials to the published Web site. This causes the Web site to prompt for authentication. Multiple authentication requests cause the Web browser to interpret the credentials as incorrect, and users may be prompted multiple times for credentials if the Web browser opens multiple connections.

Solution   As a workaround, use alternative authentication methods for publishing. For more information, see "Secure Web Publishing" at the Microsoft TechNet Web site.

Problem   SecureNAT client access to specific sites is needed, while authentication on other sites is still required.

Cause   SecureNAT clients cannot provide authentication credentials.

Solution   Create a rule denying access to specific sites, and then create exceptions to the rule for all users.

Problem   Web Proxy Automatic Discovery (WPAD) is configured, and authentication is required on the network. Automatic discovery is not working as expected.

Cause   WPAD cannot authenticate and does not provide credentials. Internet Explorer sends credentials and ISA Server sends back an HTTP 407 message. Firewall clients cannot respond to HTTP 407. Note that it should work as expected for Web Proxy clients configured for automatic discovery.

Solution   This issue does not exist in ISA Server 2004 Enterprise Edition. For ISA Server 2004 Standard Edition, install ISA Server 2004 Standard Edition Service Pack 1 to resolve this issue.

For more information about troubleshooting automatic discovery, see "ISA Server: Troubleshooting Automatic Detection" at the Microsoft TechNet Web site.

Problem   Anonymous entries, instead of user names, appear in the ISA Server logs.

Cause   This may be caused by rules allowing anonymous access. In addition, Web Proxy clients always make the first connection anonymously.

Solution   Ensure you do not have any rules allowing anonymous access. Then user names for Firewall clients and Web Proxy clients will always be recorded.

Problem   Users cannot authenticate in a domain configuration.

Cause   Failure to authenticate to a domain may have a number of causes.

Solution   Check the following:

• Make sure you have system policy rules enabled for traffic you want to allow into and out of the Local Host network. To allow only certain traffic types, limit the protocols allowed.
  
• Review the log to determine which traffic ISA Server is denying during the authentication attempt.
  
• Ensure that ISA Server networks are correctly defined. Specifically, ensure that the Internal network is correctly defined.
  
• In the Monitoring node, on the Alerts tab, check for configuration warnings.
  

Problem   Users are prompted for credentials every time they open an instance of Internet Explorer.

Cause   This is the default behavior when Web proxy settings on the network on which user requests are received are configured for Basic authentication. Basic authentication is per-request (for each instance of opening a browser), not per-session. This is in accordance with Request for Comments (RFC) 2617.

Solution   None. This is standard behavior for Basic authentication.