Before I file for a feature request I just wanted to make sure I understand this correctly.

There is no way to limit by Allowed Target Services by IP/Subnet/Username/Group,etc.

Its sort of an all or nothing list.

I ask because I have students using the proxy who I'd like to only allow 80 and 443 and nothing else, but then our staff can access whatever is necessary. Sometimes we get an odd request for some library database using a reverse proxy on the other end so its setup to use some crazy port such as:

https://sslvpn.pitt.edu:11018/

Thanks for any input!

__________________
ASG v7.502 Software -- HP360G5, Quad Xeon E5410, 4GB RAM -- 500 User

Well, not a great answer, but maybe a work-around.

The 'Allowed target services' apply only when the proxy is addressed directly - when the browser is pointed at the Astaro on port 8080.

If you create a Proxy Profile for the student network in transparent mode (with or without authentication), the other 'Allowed target services' will be unavailable to them. If the students are tricky enough to try to point their browsers at the to use it in 'Standard' mode, I think you can block those attempts by using a "blackhole" NAT rule: 'Student (Network) -> HTTP Proxy -> Student (Address) : DNAT to {non-existant}' - but I haven't tried that myself.

For the staff network, set their profile in Standard or AD-SSO mode, and they will have access to all of the 'Allowed target services'.

Does that accomplish what you want?

Cheers - Bob

__________________
ACE V7 - Astaro Preferred Partner since V3
Addicted to my iPhone!