How do your users access the Internet?

[Bruce123]

Evening all,

 

Do your users access the Internet via a NAT routed connection or application layer proxy?

 

I ask because we have always provided Internet access to learners and staff using the HTTP proxy (on ISA 2006), rather than a NAT routed (layer 3) connection. We configure Internet Explorer with the address of the proxy server through group policy. I think it helps with security as it makes it that bit harder for malware to connect out.

 

However, this evening I was providing support for an online assessment (AAT Accounting which uses something called secure assess). Secure Assess basically wraps up IE and removes all the buttons to make it secure from users tampering; the actual assessment uses Flash, and connects to AAT's server via our proxy.

 

It all started off ok, but 45 minutes into the exam I got a call from the Invigilator to say that there was a problem and the problem was that the online assessments had ground to a halt, they all stopped at the end of section 3 and wouldn't progress to section 4. But the candidates did comment that it was gradually getting slower (e.g. typing into a box). In the end we had to abdandon it altogether.

 

We had just installed the lastest Flash (10.1) via group policy last week, so it could be related to this. It could also be a problem with AAT's server (I will ring them tomorrow). I tested connecting various websites and it was fast (it would be being the evening) and Flash sites worked fine.

 

Anyway, It did get me wondering if having having online exams run via a proxy might be adding an extra layer of complexity; although for web browsing it has been fine.

 

One concern I have about routed access to the Internet is whether the webfiltering would work (this is a product called BitStream webfilter which integrates with ISA2006).

 

Another one is in order for our routers to be aware of the NAT routing (route out to the Internet), would I would need to add a static route to a router, and would this automatically get propagated to the others? We use automatic routing discovery on our 4 routers, but I can't recall off the top of my head which protocol we use.

 

And is ISA able to authentic users with ADS if they are using a NAT routed connection?

 

An issue we've been having (which I probably should not just tag to this email) is students when accessing the Internet are sometimes prompted to enter their credentials from our proxy server, like it sometimes has issues with authenticating users via ADS.

 

Thanks for any advice / suggestions.

 

Bruce.

 

PS Forwared from Networks, when I realised that this was a more appropriate forum!

[Bruce123]

Just to update everyone, the problem was caused by a problem with AAT's Secure assess server (and affected tests across the country), rather what way we have our network configured. Thanks, Bruce.

[john]

Glad to read it was an external problem Bruce. We do ALAN Testing using the ASDAN Online Assessment software which works in teh same way to the software you describe, it doesn't support a proxyserver, in fact it errors on opening which confuses candidates but they are told to click OK to ignore the warning. We've run about 400 tests with it now with no issues or errors at all so I think they are just saying it to reduce issues that could be a problem.

[3s-gtech]

We have Secure Assess tests coming up tomorrow. However, we have a dedicated VM running the Server app, so the clients don't connect externally (the server syncs with the exam board afterwards). I haven't used this in anger yet so we'll see - we've found it saves network headaches, but it does need a pretty beasty server spec to work (ground the last setup to a halt on 100% CPU).

[Bruce123]

I was going to day "good luck", but then noticed you posted this yesterday, so i hope that it went ok.

 

In the half-baked email apology that we recived from AAT, they referred to an reconfiguration of their server scheduled for the evening of the Friday 16th of December. But in the end our Exams dept. had to reschedule all of our remaining AAT exams to January, hopefully they'll go smoothly this time (one group of 14 who paid £100s each for the course is having to re-sit for a third time, some having taken time of work to take the exam)

 

We had considered that not hosting our own server was the best option for this exam, as there is less for us to look after/maintain. However, this does depend on their AAT/Secure Assess server being high availability and reliable (and our Internet connection as well).

 

We have 4 other online testing systems going at the moment; for 2 of them we have internal servers for, and the other 2 (including AAT) just connect externally. I think that online exams (whether hosted internally or externally) are the way forward, the providers just need to make sure their systems are tested and work reliably at all times.

 

Thanks,

 

Bruce.

 

Leeds, UK.

[Bruce123]

John - We also have this problem with Secure Assess, but I think it might be the auto updater part of the software that crashes when assumes it has admin rights to apply any updates, when it doesn't. I doesn't look very good though if/when the candidates see it!

 

Bruce.

[3s-gtech]

We had our mock exams with SecureAssess yesterday. Went well with the internal server, but the students needed to be logged on as local admins for the program to run. Not a big problem in this case as it locks the machine down and they were supervised. Going to look into bypassing this today.

[joe90bass]

We had our mock exams with SecureAssess yesterday. Went well with the internal server, but the students needed to be logged on as local admins for the program to run. Not a big problem in this case as it locks the machine down and they were supervised. Going to look into bypassing this today.

 

Is that a requirement, or just one of those things you come across as a way to get it working? BTL haven't mentioned this to me, I know the c:\users\public\secureassess folder needs at least modify access for everyone.

 

I've had a nightmare getting the latest version working here - both server and clients! In the end I had to copy the secureassess folder from the one working PC to all the others...... We've now successfully run two familiarisaton tests today, but am concerned as to how the real thing will go next week!

[3s-gtech]

Is that a requirement, or just one of those things you come across as a way to get it working? BTL haven't mentioned this to me, I know the c:\users\public\secureassess folder needs at least modify access for everyone.

 

I came across it. I installed SecureAssess to C:\Program Files\SecureAssess (with modify perms), which is where anyone competent will program an application to install - our student users do not have access to either All Users or Users\Public.

[joe90bass]

I came across it. I installed SecureAssess to C:\Program Files\SecureAssess (with modify perms), which is where anyone competent will program an application to install - our student users do not have access to either All Users or Users\Public.

 

Yes, c:\users\public is not the first place I looked when asked to check a file......... I've got it working now so left it as it is, I live in hope that future updates are less painful

[Gatt]

How do your users access the Internet?

 

Usually through a web browser..