Non Domain Workstations

Question

We recently migrated from Websense to Ironport and are experiencing an issue where outside vendors who are part of a domain other than ours cannot access the Internet through Internet Explorer; they are able to access the Internet through other browsers (for example Chrome).  We are sure it is an authentication issue but do not have a domain other than our primary one to test with.  When the vendor opens Internet Explorer, they are brought to a blank white page with the ironport URL in the address bar.  I have tried changing the authentication methods within IE on the affected workstations, but it did not resolve the issue.  I also tried adding our ironport URL as a trusted Intranet site and even Internet site.  I then tried adding our ironport IP as an explicity proxy, but it did not work.  Has anyone else experienced this issue?  If so, what was the resolution if any?  We currently are having them use other browsers, if they have one, or we add their IP addresses on the appliance.

Answer 1

Hi All,
This problem can be solved very quickly...
Yes, problem IS authentication, and IE security settings.
For your guest users, please make Guest users policy that will be used for user that fail authentication (guests outside your domain).
If you do not know how to do this, I'll help you.
Here is what is happening to your external clients (guest users):
They access the internet, and their request ends up on WSA.
WSA is configured to authenticate users, so it sends Redirect message to users browser (HTTP 302) and redirects our user to WSA-s P1 address in order to authenticate the user.
The problem is that IE will NOT allow browser to be redirected to "some location" unless this location is set to be in IE "Trusted sites list".
So, in oreder to make your IE to respond properly to redirect message, your client must set WSA's authentication redirection FQDN in their IE browsers to be in Trusted istes list...
This was the solution if you use FQDN name of WSA for authentication.
Additionally problem can be caused if guest users can not resolve short host name of your WSA.
If you use only short hostname instead of WSA P1 FQDN, then your guest users must know what domain your organisation is using (this can be pushed via DHCP for example).
Hope this helped.
Cheers,
Ana