me parece que en otro foro preguntaste lo mismo??
espero te sirva esto.
el web.config debe ir asi:
<system.web>
<authentication mode="Forms">
<forms
name=".ASPXAUTH"
loginUrl="Ingreso/wf_ingreso.aspx"
defaultUrl="default.aspx"
protection="All"
timeout="30"
path="/"
requireSSL="false"
slidingExpiration="true"
cookieless="UseDeviceProfile" domain=""
enableCrossAppRedirects="false">
<credentials passwordFormat="SHA1" />
</forms>
</authentication>
<authorization>
<allow users="*" />
</authorization>
.
.
.
</system.web>
<location path="Carpeta_privada">
<system.web>
<authorization>
<deny users="?" />
</authorization>
</system.web>
</location>
y listo....