I configured a lab with TMG 2010 evaluation very, everything goes well, now i have a strange problem, i configured a rule to block some web sites, and this rule added as number 1 rule, number 2 rule is two allow access to http and https, when i restart firewall service, users get the blocked pages blocked normally as expected, after few minutes users can open the blocked pages normally!!!! both rules schedule are set to always
when i tried to monitor a machine i found them bypass allow rule, without being stopped by the deny rule (no.1)

any help please ?

Hi,

If you re-create the deny rule, are the websites blocked after restart firewall service? Then these websites are allowed after a few minutes?

Please run TMG BPA tool to check if there is any configuration error.

Microsoft Forefront TMG Best Practice Analyzer

Note: Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

Joyce

What sites are you blocking?

Some sites are working through redirects and actually getting the content from elsewhere (that is, not matching your deny rule).

Use live logging to see what the client actually requests. If needed use a sniffing tool on the client to see what it does.