Squid to ISA pass original IP

[skeep]

Hi All,

 

Can squid pass on the original IP address to a parent ISA server? At the moment in the isa logs it shows all traffic originating from the squid server.

 

The reason I ask is that websense is on the ISA server and I want to be able to monitor traffic from a particular IP on the guest network.

 

Thanks

[powdarrmonkey]

This is the purpose of the X-Fowarded-For header.

[skeep]

Does squid pass this on by default?

 

Can ISA see this as the Client IP instead of the server?

[KK20]

no, squid doesnt pass this on by default as sometimes you dont want your internal ips leaking onto the net.

 

Follow X-Forwarded-For headers

[skeep]

I have added these two lines:

 

acl localnet src 10.140.0.0/16

follow_x_forwarded_for allow localnet

 

But the original IP is still not shown on iSA?

[skeep]

are the two lines mentioned above correct?

[KK20]

I'd need to look up some more but it seems that ISA doesnt natively support X-Fowarded-For headers

 

This I find odd but certainly the wiki seems to suggest you need X-Forwarded-For for ISA Server and IIS in order to do so.

[skeep]

according to the wiki it is supported in isa 2004/2006

 

X-Forwarded-For - Wikipedia, the free encyclopedia

[KK20]

no, as I said:

 

"Microsoft ISA Server 2004/2006 with Winfrasoft X-Forwarded-For for ISA Server"

 

it is supported with the software I linked to i.e. not natively supported.

[skeep]

bugger! That is £1650 to forward on an IP address.

 

Ok plan b!

Edited March 5, 2010 by skeep

[tom_newton]

What is it you are actually trying to achieve? There may be more than one way around this

[skeep]

The squid server is on a guest network and this will be used by pupils and staff using their own equipment. We have websense installed on the ISA box and therefore need to monitor what pupils are looking at.

 

This monitoring could be achieved at the squid end but it would be nice to have it all in one place.

 

any ideas would be greatly received!

[Cools]

drop squid and use ISA only. or Drop ISA and use squid to do it all.

i never did understand why you need 2 proxy/firewalls in place.

 

or am i missing something..

 

 

have a look at : http://aplawrence.com/Unix/squidlog.html or http://sarg.sourceforge.net/

Edited March 5, 2010 by Cools

[Iain]

If you grab a copy of the ISA sdk, and a copy of visual c++ express it should be possible to write an isapi filter to capture the x-forwarded-for header and to write this to the log files instead using the SF_NOTIFY_LOG notification structure.

[skeep]

To explain why im using squid, I have created a capture page so that when someone access a web page they get redirected to a login page this page then after completing authentication adds the IP to a text file and then reconfigure squid. It works really well, not sure if i could do the same with iSA?

[Cools]

what wifi do you have .. does your wifi smart switches not have this option built in .. My Netgear does. then i auth off ldap and redirect to squid or isa.

 

i take it's for wifi? not hardwire.

 

like ya thinking.. Wifi hotsopt hmm just need to add payment gateway for guests.. lol... that will bump up my Budget this year..

lol...

[skeep]

Unfortunately, it is for wired and wifi as we have staff who live on site

[Iain]

If you want I can write that isapi filter for you, shouldn't take too long. Not sure I can get to it until next week though.

 

Iain.

[skeep]

Iain, If you can do that that would be great! Im sure i would not be the only one who would find it useful!!!

[Cools]

small donation of hobnobs and jaffa cakes to Iain i think is in order..

lol.

[skeep]

i think more McVities Chocolate Caramel Digestives! lol

[KK20]

source forge the beast if you do. Im sure people will fix it up for you if you get the basics.

[skeep]

I found this but it is for IIS7 can this be adapted?

 

X-Forwarded-For Log Filter for Windows Servers | .NET Developer's Journal

[Iain]

The way IIS and ISA filters work are very similar, so it may work. If not, I've almost finished coding one. Will just need to test it to make sure it works.

 

Iain.

[skeep]

rapid iain!

 

I'll wait and test yours