skeep Posted March 3, 2010 Posted March 3, 2010 Hi All, Can squid pass on the original IP address to a parent ISA server? At the moment in the isa logs it shows all traffic originating from the squid server. The reason I ask is that websense is on the ISA server and I want to be able to monitor traffic from a particular IP on the guest network. Thanks
powdarrmonkey Posted March 3, 2010 Posted March 3, 2010 This is the purpose of the X-Fowarded-For header.
skeep Posted March 3, 2010 Author Posted March 3, 2010 Does squid pass this on by default? Can ISA see this as the Client IP instead of the server?
KK20 Posted March 3, 2010 Posted March 3, 2010 no, squid doesnt pass this on by default as sometimes you dont want your internal ips leaking onto the net. Follow X-Forwarded-For headers
skeep Posted March 3, 2010 Author Posted March 3, 2010 I have added these two lines: acl localnet src 10.140.0.0/16 follow_x_forwarded_for allow localnet But the original IP is still not shown on iSA?
KK20 Posted March 4, 2010 Posted March 4, 2010 I'd need to look up some more but it seems that ISA doesnt natively support X-Fowarded-For headers This I find odd but certainly the wiki seems to suggest you need X-Forwarded-For for ISA Server and IIS in order to do so.
skeep Posted March 4, 2010 Author Posted March 4, 2010 according to the wiki it is supported in isa 2004/2006 X-Forwarded-For - Wikipedia, the free encyclopedia
KK20 Posted March 5, 2010 Posted March 5, 2010 no, as I said: "Microsoft ISA Server 2004/2006 with Winfrasoft X-Forwarded-For for ISA Server" it is supported with the software I linked to i.e. not natively supported.
skeep Posted March 5, 2010 Author Posted March 5, 2010 (edited) bugger! That is £1650 to forward on an IP address. Ok plan b! Edited March 5, 2010 by skeep
tom_newton Posted March 5, 2010 Posted March 5, 2010 What is it you are actually trying to achieve? There may be more than one way around this
skeep Posted March 5, 2010 Author Posted March 5, 2010 The squid server is on a guest network and this will be used by pupils and staff using their own equipment. We have websense installed on the ISA box and therefore need to monitor what pupils are looking at. This monitoring could be achieved at the squid end but it would be nice to have it all in one place. any ideas would be greatly received!
Cools Posted March 5, 2010 Posted March 5, 2010 (edited) drop squid and use ISA only. or Drop ISA and use squid to do it all. i never did understand why you need 2 proxy/firewalls in place. or am i missing something.. have a look at : http://aplawrence.com/Unix/squidlog.html or http://sarg.sourceforge.net/ Edited March 5, 2010 by Cools
Iain Posted March 5, 2010 Posted March 5, 2010 If you grab a copy of the ISA sdk, and a copy of visual c++ express it should be possible to write an isapi filter to capture the x-forwarded-for header and to write this to the log files instead using the SF_NOTIFY_LOG notification structure. 1
skeep Posted March 5, 2010 Author Posted March 5, 2010 To explain why im using squid, I have created a capture page so that when someone access a web page they get redirected to a login page this page then after completing authentication adds the IP to a text file and then reconfigure squid. It works really well, not sure if i could do the same with iSA?
Cools Posted March 5, 2010 Posted March 5, 2010 what wifi do you have .. does your wifi smart switches not have this option built in .. My Netgear does. then i auth off ldap and redirect to squid or isa. i take it's for wifi? not hardwire. like ya thinking.. Wifi hotsopt hmm just need to add payment gateway for guests.. lol... that will bump up my Budget this year.. lol...
skeep Posted March 5, 2010 Author Posted March 5, 2010 Unfortunately, it is for wired and wifi as we have staff who live on site
Iain Posted March 5, 2010 Posted March 5, 2010 If you want I can write that isapi filter for you, shouldn't take too long. Not sure I can get to it until next week though. Iain. 1
skeep Posted March 5, 2010 Author Posted March 5, 2010 Iain, If you can do that that would be great! Im sure i would not be the only one who would find it useful!!!
Cools Posted March 5, 2010 Posted March 5, 2010 small donation of hobnobs and jaffa cakes to Iain i think is in order.. lol.
skeep Posted March 5, 2010 Author Posted March 5, 2010 i think more McVities Chocolate Caramel Digestives! lol
KK20 Posted March 5, 2010 Posted March 5, 2010 source forge the beast if you do. Im sure people will fix it up for you if you get the basics.
skeep Posted March 5, 2010 Author Posted March 5, 2010 I found this but it is for IIS7 can this be adapted? X-Forwarded-For Log Filter for Windows Servers | .NET Developer's Journal
Iain Posted March 5, 2010 Posted March 5, 2010 The way IIS and ISA filters work are very similar, so it may work. If not, I've almost finished coding one. Will just need to test it to make sure it works. Iain. 2
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now