Is Our ISA2004 Compromised?

[W]

We have an ISA2004 firewall that has been fully debugged and working for
many years. I needed to block all traffic going to a subnet
64.156.192.0/22. I created both a subnet with that parameter and
separately created an address range 64.156.192.0 to 64.156.192.255. I
then made rule #1 on the ISA firewall:

DENY
ALL Traffic Types
From ALL Networks
To the subnet and address range as specified above
ALL Users

After Applying the rule change, the rule is simply being ignored. A
sniffer clearly shows the traffic continues right past the firewall as if
nothing has happened. The ISA Monitor shows the traffic going through, and
it references a rule way down in the ruleset that approves the traffic.
Rule #1 simply gets ignored.

What would cause this?

--
W

[W]

"W" <persis...@spamarrest.com> wrote in message
news:KradnQQq0fO9sgnR...@giganews.com...

If the client's browser is configured to use Web Proxy, does that completely
bypass Firewall rules that are based on target IP addresses?

It appears yes. It looks like in the case of Web Proxy that all of the
requests are handled based on the target FQDN and any Firewall Rules based
on target IP address are ignored?

That's kind of horrific isn't it? How can that be a desirable feature?

--
W