ISA 2006 Web Chaining

[yeoman]

Does anybody know if there is a way I can point a specific set of users to a specific upstream proxy server. I think web chaining might be the answer but I cant see how to do it. For example point user group A to proxy.anywhere.com on port 8081 and user group B to proxy.anywhere.com on port 8082. Or is there another way to do it?

[Geoff]

Surely you could do this via GPOs?

[mrforgetful]

I think yeoman means that he wants all users to go through his ISA Server but then that direct different groups to different places.

 

I'm not sure it's Web Chaining you want as from what I've ever seen that's a global thing.

 

Sorry I don't have a way forward though!

[yeoman]

Yes that's what I am trying to do, we currently use a local proxy server running squidnt to provide us with local filtering etc. Our ISP E2BN provides levels of filtering on different ports, middle, upper school etc. and we have squidnt configured to route user groups to the appropriate ports. Like you I have come to the conclusion it can't be done with ISA Server. Guess I will stick with SquidNT and give my brain a rest

[djm968]

Web proxy chaining should be able to do what you require. These two links provide info on web proxy chaining.

 

http://www.isaserver.org/tutorials/Web-Proxy-Chaining-Form-Network-Routing.html

 

http://www.microsoft.com/technet/isa/2006/chaining.mspx

[yeoman]

Thanks for the info but there still does not appear to be a way to point a specific group of users to a specific web chain rule.

[thom]

@Yeoman

did you ever find out if this is possible.

We have just set up ISA and use the e2bn proxies.

Before ISA staff used proxy

10.15.xx.x7:80

and students used

10.15.xx.x6:80

Now I am using ISA all requests go to the upstream proxy which is set as the students proxy. This means staff access uses the student filters.

Is there a way to sort this out without setting up a seperate ISA for staff?

[thom]

@Yeoman

did you ever find out if this is possible.

We have just set up ISA and use the e2bn proxies.

Before ISA staff used proxy

10.15.xx.x7:80

and students used

10.15.xx.x6:80

Now I am using ISA all requests go to the upstream proxy which is set as the students proxy. This means staff access uses the student filters.

Is there a way to sort this out without setting up a seperate ISA for staff?

[thom]

@Yeoman

did you ever find out if this is possible.

We have just set up ISA and use the e2bn proxies.

Before ISA staff used proxy

10.15.xx.x7:80

and students used

10.15.xx.x6:80

Now I am using ISA all requests go to the upstream proxy which is set as the students proxy. This means staff access uses the student filters.

Is there a way to sort this out without setting up a seperate ISA for staff?

[yeoman]

No I never did. I may just have the pupils go through ISA and leave staff to go direct to E2BN.

[ScottStevinson]

Sorry to bring back such an old thread, but I've been searching for an answer to this very problem without much success so far.

 

I would like all users to go through one ISA proxy, and then be forwarded to the appropriate upstream LEA proxy for their user group. For example, the "learners" group should be web chained to example.lea.gov.uk:1234 and the "staff" group to example.lea.gov.uk:4321

 

I can create multiple chaining rules, but I've not spotted a way to restrict this by user groups. If this isn't possible in ISA 2006, does anyone know whether it can be done in the new Forefront Threat Management Gateway 2010?

 

Thanks

 

Scott