ISA Server 2004 Advice with Websense

[FN-GM]

I have now setup wensense, and it all seems to be running fine Just one question how do I force all the clients including computers that do not belong to the school through the proxy server.

I have been googling it and someone suggested changing the default gateway IP address in DHCP to the IP address of the proxy server (in this case 172.24.32.3). The current default gateway we have is 172.24.35.254. I have tested this on a machine with a static IP I don’t appear to have any connection to the internet. My thoughts are that our ISA uses port 8080 and the port for the world wide web is 80. So if I configured ISA to listen on port 80 would that work?

 

Or would you suggest something else?

 

I would appreciate your help & advice.

 

Many Thanks

[Geoff]

I'm going to miss out some of the more advanced settings of my configuration as there's no need to confuse the issue further. But basically, the way I do it he is a combination of firewall rules and GPO settings.

 

On the network border firewall, I allow the internal proxy server access to the LEAs proxy IP/Port. I disallow anything else from accessing it. I also disallow direct access out via the usual ports (HTTP,HTTPS,FTP, etc).

 

I then configure IE's branding policy to set the proxy to be the internal one.

 

So in theory, IE is set to use the internal proxy by default. If some clever kid manages to override this, the firewall stops them from bypassing it.

 

In reality, there are more complex settings involved, but for a basic overview, that's how it works.

[plock]

I prefer to use WPAD to automatically specify the proxy. Googling WPAD I'm sure will return some help with setting this up.

[FN-GM]

Ok so if the firewall is configured to only let the proxy server through the default gateway that should work? or am i wrong? (i think i am)

 

What if a user logs on from another part of the forest and there proxy server is not defined becuase they use the LEA proxy?

 

Cheers

Edited January 23, 2008 by FN-Greatermanchester

[luketheduck]

I have now setup wensense, and it all seems to be running fine Just one question how do I force all the clients including computers that do not belong to the school through the proxy server.

I have been googling it and someone suggested changing the default gateway IP address in DHCP to the IP address of the proxy server (in this case 172.24.32.3). The current default gateway we have is 172.24.35.254. I have tested this on a machine with a static IP I don’t appear to have any connection to the internet. My thoughts are that our ISA uses port 8080 and the port for the world wide web is 80. So if I configured ISA to listen on port 80 would that work?

 

Or would you suggest something else?

 

I would appreciate your help & advice.

 

Many Thanks

 

Did you ever find a solution to this?

 

I'm in the same boat... All internet traffic goes through the ISA server, but I need to make sure non-domain laptops are filtered through Websense, because at the moment they're not.

[ahuxham]

DHCP

 

SCOPE [iP]

> SCOPE OPTIONS

> OPTION 003 (ROUTER)

[FN-GM]

Yep that is correct