Intermittent proxy

[MrJDH]

We're currently experiencing a strange issue with regard to our proxy server.

 

Clients are using Windows 7 with IE 10, and our proxy address is set within the 'Automatic Configuration Script' of IE by means of GPP, governed from Server 2012 R2 DCs.

 

Although the GPP applies without issue, several users have reported that occasionally when attempting to browse web pages, that they are presented with the SmoothWall authentication page.

 

Now. When this occurs for staff, we have noticed that by going into the proxy settings, clearing the 'Automatic Configuration Script' checkbox, and then re-asserting the tick and OK'ing, that this resolves the issue, and users are once again able to browse/query web pages without the SmoothWall authentication re-appearing. The issue may then reoccur at random.

 

I should add that the proxy address is still present within the path, when going to clear/reassert the tick.

 

Has anyone experienced anything similar before? It's almost like IE forgets that the proxy address path is there, and so presents a page which would normally only be visible if no address has been dialled in.

 

Any ideas?

[jinnantonnixx]

IE settings are a disaster. Is this any help?

 

F5 F6 F7 F8 Red Green. Where are my IE Settings?

[free780]

Seems to be a authentication issue. Ie is using the proxy. Probably worrh raising with Smoothwall. Or checking event viewer. If you can replicate it run wireshark to see whats happening.

[MrJDH]

Seems to be a authentication issue. Ie is using the proxy. Probably worrh raising with Smoothwall. Or checking event viewer. If you can replicate it run wireshark to see whats happening.

 

Thanks for the advice on Wireshark. I can see why it looks to be an authentication error, but the page displayed is the same that would be visible if there were no proxy address entered into IE.

 

As for Wireshark, is it possible to monitor traffic between 2 particular hosts, if Wireshark isn't installed on either of those specific hosts? I would imagine that Wireshark has to be positioned correctly..

 

Just as a query, what could I expect to see within Wireshark, if authentication issues are present?

Edited March 7, 2014 by MrJDH

[JPElectron]

As for Wireshark, is it possible to monitor traffic between 2 particular hosts, if Wireshark isn't installed on either of those specific hosts? I would imagine that Wireshark has to be positioned correctly..

 

Easiest if you can set a switch port to mirror the port of either host in question - then you plug your laptop running Wireshark into the mirrored port and capture all that traffic. Other option is to run Wireshark on the host, then filter the output by the IP of yourself, or the other host, for example Filter: ip.addr == 192.168.3.8 Ghetto option is to get an old hub (not a switch) and plug your laptop running Wireshark and one of the hosts into that, a hub lets you sniff out all traffic passing anything plugged in. Perhaps your proxy is somehow overwhelmed/congested - I have seen a few times where if the proxy is not available IE likes to try other (proxy-less) methods.

Edited March 7, 2014 by JPElectron

[free780]

Yiu can also get the login box if users save credentials. Check credential manager. Or %appdata%\microsoft\window\credentials for files . Check the local part of appdata as well.