Microsoft KB Archive/295089

= You Are Denied Access to a Destination Set When You Use Site and Content Rules =

Article ID: 295089

Article Last Modified on 10/30/2006

-

APPLIES TO


 * Microsoft Internet Security and Acceleration Server 2000 Standard Edition

-



This article was previously published under Q295089



SYMPTOMS
When you use a Site and Content rule that allows you to gain access to a selected destination set, if that destination set contains both a domain name and an Internet Protocol (IP) address, you can gain access to either that domain name or that IP address.

However, when you create a Site and Content Allow rule, and then create a Site and Content Deny rule that denies access to all destinations except a selected set, if you specify the destination set that is used in the Site and Content Allow rule, you are denied access to either the domain or the IP address that you specified in the Site and Content Allow rule. In addition, you may receive the following error message in your Web browser:

HTTP 502 Proxy Error - The ISA Server denies the specified Uniform Resource Locator (URL).

(12202) Internet Security and Acceleration Server

If you create a Site and Content Deny rule that contains a redirect action for Hypertext Transfer Protocol (HTTP) requests, you do not receive the preceding error message. Instead, you are redirected to the custom deny page.



CAUSE
This issue can occur because when you use the All destinations except selected set setting in a Site and Content rule, Internet Security and Acceleration (ISA) Server incorrectly processes only the IP addresses in the destination set. As a result, the Site and Content Deny rule matches the Site and Content Allow rule under certain conditions. When the Site and Content Deny rule matches the Site and Content Allow rule, your request to gain access to the destination set is denied.



RESOLUTION
To resolve this problem, obtain the latest service pack for ISA Server 2000. For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

313139 How to Obtain the Latest Internet Security and Acceleration Server 2000 Service Pack



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

This problem was corrected in Internet Security and Acceleration Server Service Pack 1.



MORE INFORMATION
This problem occurs only if you have a combination of domain names and IP addresses in the destination set, and if you use the All destinations except selected set setting in a Site and Content rule combination. If you use only domain names in your destination sets, this problem does not occur.

Keywords: kbbug kbfix KB295089

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.