Blocking MSN Messenger from ISA 2000 Server - Part II

Mohammed Athif Khaleel — Mon, 27 Mar 2006 05:44:00 GMT

Continuing from my previous post, I found another easy-cheeky way to block MSN Messenger from ISA 2000 Server in Cached Mode or Integrated Mode. All you have to do is create a Site and Content Rule to block the *.msgr.hotmail.com destination set.

Procedure

1. Create a new destination set for "*.msgr.hotmail.com". To create a destination set, follow the procedure;

To create a destination set -

Click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management
In the console tree of ISA Management, right-click Destination Sets, point to New, and then click Set.
- For array policy destination sets, where?
  Internet Security and Acceleration Server > Servers and Arrays > Name > Policy Elements > Destination Sets
- For enterprise policy destination sets, where?
  Internet Security and Acceleration Server > Enterprise > Policy Elements > Destination Sets.
In Name, type a name for the destination set such as "Block MSN".
(Optional) In Description, type a description for the destination set.
Click Add and Click Destination and type "*.msgr.hotmail.com".

2. Create a Site and content rule using the "Block MSN" destination set to deny "*.msgr.hotmail.com".

To create a site and content rule -

In the console tree of ISA Management, right-click Site and Content Rules, point to New, and then click Rule.
- For array policy, where?
  Internet Security and Acceleration Server > Servers and Arrays > Name > Access Policy > Site and Content Rules
- For enterprise policy, where?
  Internet Security and Acceleration Server > Enterprise > Policies > Enterprise Policy > Site and Content Rules
Type the name of the rule "Block MSN Messenger"
Click the deny radio button and then click next.
Click the Deny access based on destination radio button then click next.
Select Specified destination set.
Now select "Block MSN" destination set that is created earlier.
Click Next and Finish.

You have successfully created "Block MSN Messenger" site and content rule using "Block MSN" destination set that will deny access to "*.msgr.hotmail.com". Restart 'Microsoft ISA Server Control' service to test and let me know if that works or if that doesn't.

Blocking MSN Messenger from ISA 2000 Server - Part I

Mohammed Athif Khaleel — Mon, 27 Mar 2006 05:04:00 GMT

Yesterday I was trying to block MSN Messenger from ISA 2000 Server in Cached mode. I have done that before on ISA 2000 Server in Integrated mode using MSNIM.vbs script available from ISA Server Tools Repository - http://isatools.org/ (Thanks Jim for excellent tools site).

When I ran the script, it gives the following message;

Creating (or updating) the FW App Settings
Creating (or updating) the protocol definition
Creating (or updating) the protocol rule
Error 0x80040361; At least one protocol must be specified. - while trying to set ISA up for MSN Messenger

I quickly wrote to ISA Server guru Jim Harrison and he replied - "ISA 2000 can't block MSN Messenger using MSNIM.vbs script in cache mode".

In Part -II we will see a cheeky method to block MSN Messenger from ISA 2000 Server.

MORE INFORMATION

Instant Messaging with ISA Server
http://www.microsoft.com/technet/prodtechnol/isa/2000/maintain/isaimsec.mspx

Common Application Signatures
http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/commonapplicationsignatures.mspx

ISA Server Tools Repository
http://isatools.org/

Microsoft ISA Server Firewall and Cache resource site
http://www.isaserver.org/

Scripts for ISA Server
http://www.isascripts.org/

Dr. Tom Shinder's ISA Firewall Space
http://spaces.msn.com/drisa/

ISA Server Blogs
http://www.microsoft.com/isaserver/community/default.mspx

ISA Server Community (MVP's)

PatchAholic...The WSUS Blog! : ISA

Blocking MSN Messenger from ISA 2000 Server - Part II

Blocking MSN Messenger from ISA 2000 Server - Part I