Users have been accessing to the INTERNET through IVE.

[Billy_]

My customer has a problem on restricting the user access though the IVE.
Based on IVE configuration, user might not be able to access to external portal sites
using rewrite session.
But I can find a lot of user access logs which indicates user have been accessing to
Internet through rewrite.

-------------------------------------------------------------------------------------------------------------

WebRequest ok : Host: www.naver.com, Request: GET / HTTP/1.1
WebRequest completed, GET to http://www.naver.com:80// from 202.131.29.71 result=200 sent=16 received=0 in 1 seconds
WebRequest ok : Host: www.naver.com, Request: GET /css/naver_20090803.css?0824 HTTP/1.1
WebRequest completed, GET to http://www.naver.com:80//css/naver_20090803.css?0824 from 202.131.29.71 result=200 sent=43 received=67848 in 0 seconds
WebRequest ok : Host: www.naver.com, Request: GET /js/error.js HTTP/1.1
WebRequest completed, GET to http://www.naver.com:80//js/error.js from 202.131.29.71 result=200 sent=27 received=220 in 1 seconds
WebRequest ok : Host: www.naver.com, Request: GET /js/reatcmp.html?0608 HTTP/1.1
WebRequest completed, GET to http://www.naver.com:80//js/reatcmp.html?0608 from 202.131.29.71 result=200 sent=36 received=3457 in 0 seconds
WebRequest ok : Host: nv1.ad.naver.com, Request: GET /adshow?unit=002P HTTP/1.1
WebRequest completed, GET to http://nv1.ad.naver.com:80//adshow?unit=002P from 222.122.16.244 result=200 sent=32 received=5704 in 1 seconds
......

-------------------------------------------------------------------------------------------------------------

These are detailed information of IVE for user session.
1. Authentication server : External AD server
2. Session option of role
1) Persistent Session : Disabled
2) Persistent Password caching : Disabled
3) Browser request follow through : Disabled
3. "Web" of user role is enabled to use of starting custom page after user sign-in.
4. All of User access to Internal resources via NC
5. Option of "Web"
1) User can type URLs in the IVE browse bar : Disabled
2) User can add bookmarks : Disabled
3) Mask hostnames while browsing : Disabled

4) Persistent cookies : enabled(default)
6. selective rewrite policy

1) *.* -> "All roles" -> allow (default)

What can be cause of this problem?

[Billy_]

Currently running 5.5R5 in production

[firewall72_]

Hi Billy,

So if I understand this correctly, these users are not permitted to add URL's and the Role has a few external links that are rewriting successfully? If so, how many machines are unable to hit the external links vs. machines that are working fine.

-John

[Mrkool_]

there is a initial allow any open ACL that is by default associated to all roles. if that is enabled the users will be able to use the re writer to access internet. you will have to lock down the role to the resources in that role only.

[kenlars_]

It has always been my understanding that the IVE is unable to initiate traffic out the external interface. Are you running with only the internal interface active?

If so, I would still think 2 conditions would need to be met for what is occurring - (1) the internal interface would need to be on a subnet with access to the Internet, and (2) the IVE would need to be using a DNS server which would resolve internet DNS names.

Ken

[Billy_]

Thanks for your answer.

Automatically, WEB Page(Custom start page) of internal Server can be openned on User's IE Browser right after user creats this session.
It means this role has custome start page(role->UI option->Custom page->Startpage URL).
But it must not be rewrited because this role has a rewrite policy that gets this session not be rewrited (Don't rewrite content: Redirect to target web server) on the top of "selective rewrite policy list".
In other word, any user can not created the rewrite session.

[Billy_]

Thanks for your answer.

From what I understand, user can only use the re writer on the following situation.
1) typing URLs on bookmarks page. => this function is not be used.
2) adding new bookmark page => this function is not be used.
3) typing URLs on browser's address bar (ex: "https://<SSLVPN_URL>/dana/home/launch.cgi?url=<custom_url>")
But in this case, it seems user session used re writer by typing only "custom URL" on the brower's address bar.

[Billy_]

Thanks for your answer. kenlars

Yes. This case met both of your 2 conditions.

But I mentioned previously, user can only use the re writer on the following situation.
1) typing URLs on bookmarks page. => this function is not be used.
2) adding new bookmark page => this function is not be used.
3) typing URLs on browser's address bar (ex: "https://<SSLVPN URL>/dana/home/launch.cgi?url=<custom url>")

You mean...if it met your 2 conditions, user can creat rewrite session by typing custom URL on their broswer's address bar?

[kenlars_]

Your understanding of the three ways the user can initiate rewrite is correct. The user cannot initiate rewrite in any other way. Entering a URL (e.g., http://www.google.com) in the browser Address field will not cause rewrite.

I'm really confused about your custom start page. It seems to me that you said the following -

• it is a page on a server internal to your network
• there is a selective rewrite rule which causes it not to be rewritten, but accessed directly.

If these two are correct, I am at a loss to understand how a user on the Internet can access a web site within your network directly, as that is what this would mean.

I am guessing your rewriting rules are not doing what you think they are doing. I'd recommend you do a policy trace to see how they are working.

Ken