ISA 2000: Block Barry's Access Except For One Site
Q: I need to block Internet access for Barry, except for one site.
A: As long as all users are required to authenticate when surfing, this is doable. You can specify exclusions using the Site and Content rules.
However, if any combination of (S&C and Protocol) rules is allowing anonymous access (anywhere), Barry may be able to get through; web browsers typically try to use anonymous connections before authenticating.
You Will Need:
A Destination Set ("Barry's White List"): contains only
www.thealloweddomain.dom (and any other domains you do want Barry to access).
Protocol Rule(s) allowing access to HTTP/S.
Site and Content Rules something like this:
Allow (Domain Users) Anywhere Anytime
Deny (Barry) (All Sites Except Selected Destination Set: Barry's White List)
or, if you've already got a "full privilege" user group segregated:
Allow (Internet Access Group) Anywhere Anytime
Allow (Barry) (Selected Destination Set: Barry's White List) Anytime
