Microsoft ISA

[rhodrykorb]

Hi so I have a Microsoft ISA proxy server part of the domain mydomain.com (as an example). There are also many notebooks on the same domain. These notebooks via Group Policy are set so you cannot change the proxy. Now when the notebooks are taken offsite this present the problem that you cannot connect to the internet. So my question is can I make my ISA proxy a subdomain server of a real www domain e.g. mydomain.com (so it is proxy.mydomain.com) and use that as the IE proxy (proxy.mydomain.com:8080)? Will this work? Any one tried or done it? Could it work in theory?

[SYNACK]

This could work but unless you had it requireing authentication then you would be running an open proxy that anyone from the outside world could use. You could instead remove it as a proxy setting and add a rule to allow web traffic from inside the network to the internet. You could then just set the ISA server as the default gateway and the only way out to the internet would be via the proxied ISA server allowing only the protocols that you choose.

 

When the clients were connected outside the school they would simple use the default gateway of wherever they were so it would all work automaticly.

[rhodrykorb]

The proxy does require domain authentication. e.g. DOMAINNAME\USERNAME and PASSWORD.

So I could make the proxy server open to the external and then set proxy.mydomain.com:8080 as the proxy (for an example) and it would then filter as per the rules in my ISA proxy

 

correct? and this would not be an "open" proxy for anyone to use?

Edited September 26, 2010 by rhodrykorb

[SYNACK]

Yes that should work but you are limiting all laptops to the speed of your school network even if they are on a faster external link. Depending on your authentication type you may also be sending user credentials in cleartext or rather easily snoopable formats which could be a security concern. Using user certificates for authentication could mitigate this a bunch though. It depends on how important security is to you, Windows 7 and Server 2008 R2 can be used with a technology called DirectAccess which offers a persistant VPN link over HTTPS which can be reconfigured to pass all internet traffic through as well but this is best setup with Forefront User Access Gateway as it can be quite complex to setup.

[rhodrykorb]

Okay so new scenario, how can I get it so that a user cannot change the proxy but if it cant detect it (because it is internal only) it will just apply no proxy?

[Cools]

I use a pac file if the PC cant get the files off site it goes direct.. if on site and gets the pack file then it uses the proxy..

 

More info.. Proxy auto-config - Wikipedia, the free encyclopedia

 

is the only way to get round the problem your having..

 

or squid proxy..

[rhodrykorb]

Do you have a PAC file for IE that you could send me? And notes on where and how to install it

[EduTech]

This should help you

 

Use a PAC file to make proxy settings dynamic | Aaron Parker

 

James

[glennda]

I have a vb script which we put on the desktop of all laptops (normally sixth form personal ones) - they have to run it - it asks are you in school yes or no - depending on the answer it will either insert the proxy or not. if you would like me to send it to you i will tomorrow.

 

I find that using a Pac script once the user is not on the network its slow on first page load as its trying to find your servers

Edited September 26, 2010 by glennda

[rhodrykorb]

Okay yeah if you could provide it that would be great

[glennda]

I am in the office from 10 oclock tomorrow if you PM me tomorrow with an Email address i will forward you the script

[rhodrykorb]

just did, thanks again. Much appreciated

[jsnetman]

ISA has a setting to automatically advertise the proxy, all you need to do is either setup auto proxy configuration via either dhcp or dns.

 

Automatic Discovery for Firewall and Web Proxy Clients

 

We have set the auto proxy discovery up here and laptops/netbooks work flawlessy onsite and off.