ISA 2004

[Gatt]

Looking at setting up ISA 2004 as a dowstream Proxy/web filter from our LEA (who have agreed to let us do it) since they are.. quite frankly - crap!..

 

Our question is .. has anyone configured ISA 2004 to do this thing before?

If they have can they let us know how they did it so that the pupils hit our ISA box and then go onto the LEA's poxy server?

 

I've only had a brief look at the server before getting caught up in more pressing problems (GPO not applying to SP2 PCs & servers not accepting Win2k3 SP1 patch) but did see an option of setting it up an "upstream" connection

 

We're using Standard Ed. of ISA 2004 btw

[Ric_]

You simply set all your clients to point at your ISA box as the gateway and proxy.

 

You then simply need to set up an ISA routing rule telling it to fetch data from an upstream server.

[Gatt]

:!:

You mean it really is THAT easy? :x

 

Thnks ric - will look at it tomorrow once i get my DC's sorted

 

Once the ISA's set up we're gonna be pulling the top 20 sites visited by the kids and blocking them

 

Which Salford LEA are meant to be doing but it takes at least 24hrs for our requests to get blocked :x

 

Looking at the practicallity of breaking away from them...

[Ric_]

That's the top 20, no matter what they are? People quite like Google!

[Norphy]

The really nice thing about ISA is that you can set it to use different filters for different AD users and groups. For example, we have a website ban list about a mile and a half long for students but a very limited one for staff. You can also do the same for different protocols. Another example, you might not want the kids to be able to stream Real videos from the web but you want teachers to be able to. With ISA you can. Bloody marvellous

 

/edit

 

The most accessed site at our school is Google Images. That generally gets at least five times as much traffic as any other website and its never off the top of our most browsed list.

 

One thing to take into account is that although ISA makes very through logs, its ability to analyze them leaves a lot to be desired or at least it does in ISA 2000. We bought Webspy Webanaylser, its brilliant

[Ric_]

@Norphy: A very good point about the RealMedia protocol! Kids take the piss and listen to Internet radio but staff still need to be able to show them clips off the BBC website (which are invariably in Real format!)

[Gatt]

That's the top 20, no matter what they are? People quite like Google!

 

Already asked for video.google.com to be banned, much to the LEA's reluctance! would like to ban images but its needed for coursework

 

he really nice thing about ISA is that you can set it to use different filters for different AD users and groups. For example, we have a website ban list about a mile and a half long for students but a very limited one for staff. You can also do the same for different protocols. Another example, you might not want the kids to be able to stream Real videos from the web but you want teachers to be able to. With ISA you can. Bloody marvellous

 

Ah was hoping that was going to be possible in 2004, was the one problem with 2000 - everything was global!

 

@Norphy: A very good point about the RealMedia protocol! Kids take the piss and listen to Internet radio but staff still need to be able to show them clips off the BBC website (which are invariably in Real format!)

 

Not on my network they wont be :twisted:

[ZeroHour]

Gatt we block google images. http://www.picsearch.com is moderated and controlled, so no porn there

We had alot of staff resistance to blocking google images but now they love picsearch as its safe. Recommend that to your SMT.

If you have the money get Smart Filter for ISA 2004. Then you have your own filtering system. Its really good.

[Gatt]

ill check that site out - thank

I think we are able toget a copy of SurfControl from the LEA, however, if we do split from them we'll need to cost things like this..

[john]

Slightly OT, but how do you get the BBC stuff to work via ISA 2004? For the kids and staff (and anybody without the Firewall client) they cannot get it to work, I can as an admin with the FC, but we are not rolling that out to all users.

[Norphy]

Ah was hoping that was going to be possible in 2004, was the one problem with 2000 - everything was global!

 

We're running 2000 atm and tbh have no intention of upgrading. Its certainly possible to apply one filter to one group and another to another.

[Ric_]

@Gatt: You can always re-direct them to the safesearch version of the image search - so that all the thumbnail porn is filtered out. Just make a content rule that re-directs to the safe search URL rather than your access denied page.

[Gatt]

// scribbles all the notes down

thanks guys - gonna start setting this up today, and hope toget it online by end of net week

[Ceebs]

Slightly OT, but how do you get the BBC stuff to work via ISA 2004? For the kids and staff (and anybody without the Firewall client) they cannot get it to work, I can as an admin with the FC, but we are not rolling that out to all users.

 

are you using the built-in real client? or have you got real installed on the machines already. if you are using the bbc's real client direct through their web pages we've found there is a problem with authenticated proxy access. what you have to do is to get people to open the bbc webpage in the real client, then when you get to the correct radio stream, then it will give you the authenticated access prompts so you can get out

[Disease]

We run ISA 2004 with the LEa proxy, the thing to remember is as Ric syas and thats to set the upstream proxy to your LEA proxy, this is just a tick box for use upstream and type in the LEA proxy IP, then point all clients to your ISA. You need 2 Nic's in the machine 1 to contact the upstream proxy set with a static IP and another set with a static IP to take the requests from your client.

 

We operate a whitelist so there is no issue of kids looking at anything we dont sanction.

[john]

Slightly OT, but how do you get the BBC stuff to work via ISA 2004? For the kids and staff (and anybody without the Firewall client) they cannot get it to work, I can as an admin with the FC, but we are not rolling that out to all users.

 

are you using the built-in real client? or have you got real installed on the machines already. if you are using the bbc's real client direct through their web pages we've found there is a problem with authenticated proxy access. what you have to do is to get people to open the bbc webpage in the real client, then when you get to the correct radio stream, then it will give you the authenticated access prompts so you can get out

 

Using the built in real client as well as the real thing. Both make no difference and seems to ignore the authentication bits. The only way we have got it to work is using the firewall client, but that is ruled out completely for us. I have put it on the machines at a local primary to solve the problem and they are very happy with that solution, but they are not that big at some of the things teenagers want to do which dont seem to work without the client.

 

I will give it another whurl tomorrow and see what happens as I have not tried it out for a few weeks though and you never know ISA 2004 SP2 may fix it, or the latest update to Websense

[john]

White lists are great aint they Disease, but keeping them up to date is annoying, for example the MSFT office site was on ours so all users can get clipart 24X7, the MSFT moved the image thumbnails to a different subsite that was a complete different address, so I had to read the source code to get the address, same with Reuters, BBC..... the list goes on.

[Disease]

Yea they are a bit, I have the same problem with Chalkface, they are forever moving links to external resources.

[spc-rocket]

@Gatt: You can always re-direct them to the safesearch version of the image search - so that all the thumbnail porn is filtered out. Just make a content rule that re-directs to the safe search URL rather than your access denied page.

 

Ric,

 

Can you provide some instruction on how to go about doing this. We got ISA Server 2004 and would like to enforce the safesearch but not completely ban google images.

 

TIA,

 

Ashok.

[eejit]

Can I echo that request to Ric_ please?

I'm sure that I a KB article about it a while ago, but can't find it now

[Ric_]

Off the top of my head, you simply need to set up a rule for Google (as you would for banned sites). Any time a Google site is requested, you need to append &safe=active onto the end or the URL.

 

Cannot remember how to do this but I believe this is possible.

[eejit]

Cheers for that Ric_, I'll give it a shot today.

[eejit]

Right, "&strict=active" is certainly what we want as I've added it myself manually to the URL and it works. However I've no idea how to append some text to a URL request in ISA. I did a quick search in the microsoft.public.isa newsgroup and someone else asked the same question and got this reply:

 

"Ty R. Mote"  wrote in message
news:[email protected]...
> We want to append the string "&safe=strict" to all requests sent to
> "images.google.com".
> Is there a method for doing this in ISA?

No.

Do we need to script against the SDK?

No.

The "&safe=strict" has to:
   1. Be put there Client-side
       A. via entering it manually in the address bar
       B. the Link or "post Form" on the client-side has to include it.
   2. It has to actually mean something to the google.com servers since
they are
   the only ones processing it. It doesn't mean anything nor is processed
by
   anything else.

-- 
Phillip Windell [MCP, MVP, CCNA]
[url]www.wandtv.com[/url]

 

 

But, I'm sure I saw a full explaination about how to do this recently. Very puzzled :?

[petectid]

Can you not simply redirect Google images, you can deny access to Google images, redirect requests to Google images safe? Does your local authority not block Google Images and just give you google safe searches?

[eejit]

Local authority uses Synetrix (formerly Equinox) and all the schools around here agree that it's filtering is rubbish.

 

I'm not sure how I could redirect an image query to the safe site? Both queries are done through images.google.com (or .co.uk) they just have different strings appended to the end of them. If you can tell me how to do this then that would be great.

Cheers.