You Are Denied Access to a Destination Set When You Use Site and Content Rules

When you use a Site and Content rule that allows you to gain access to a selected destination set, if that destination set contains both a domain name and an Internet Protocol (IP) address, you can gain access to either that domain name or that IP address.

However, when you create a Site and Content Allow rule, and then create a Site and Content Deny rule that denies access to all destinations except a selected set, if you specify the destination set that is used in the Site and Content Allow rule, you are denied access to either the domain or the IP address that you specified in the Site and Content Allow rule. In addition, you may receive the following error message in your Web browser: If you create a Site and Content Deny rule that contains a redirect action for Hypertext Transfer Protocol (HTTP) requests, you do not receive the preceding error message. Instead, you are redirected to the custom deny page.

This issue can occur because when you use the All destinations except selected set setting in a Site and Content rule, Internet Security and Acceleration (ISA) Server incorrectly processes only the IP addresses in the destination set. As a result, the Site and Content Deny rule matches the Site and Content Allow rule under certain conditions. When the Site and Content Deny rule matches the Site and Content Allow rule, your request to gain access to the destination set is denied.

To resolve this problem, obtain the latest service pack for ISA Server 2000. For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

This problem was corrected in Internet Security and Acceleration Server Service Pack 1.

This problem occurs only if you have a combination of domain names and IP addresses in the destination set, and if you use the All destinations except selected set setting in a Site and Content rule combination. If you use only domain names in your destination sets, this problem does not occur.