.pac file problem

[FN-GM]

Hi,

 

Below is the copy of a .pac file in use on a network. It points to a proxy server hosted at the LEA All was working well until the LEA turned on AD integration and load balancing on at there proxy server. Sometimes it works and sometimes it doesn't. For the life of me i cant figure out if there is anything wrong with it. If i put the proxy setting in directly into IE it works 100% of the time. I am setting the .pac file by group policy.

 

Can anyone see if there are any problems with it please?

 

Thanks

 

 
function FindProxyForURL(url, host)

{

//Declare proxy strings as variables

var capitaproxy = "PROXY 10.112.5.193:80";

// IP not to use proxy

if (shExpMatch(url, "*172.*")) { return "DIRECT"; }
if (shExpMatch(url, "*10.*")) { return "DIRECT"; }
if (shExpMatch(url, "*192.*")) { return "DIRECT"; }
if (shExpMatch(url, "*127.0.0.1*")) { return "DIRECT"; }
if (isPlainHostName(host)) { return "DIRECT"; }

// URLS not to use proxy server


if (shExpMatch(url, "*proxy*")) { return "DIRECT"; }
if (shExpMatch(url, "*localhost*")) { return "DIRECT"; }
if (shExpMatch(url, "*sta-xendesktop.lea.edu.local*")) { return "DIRECT"; }
if (shExpMatch(url, "*dm-msw01.rochdale.edu.local*")) { return "DIRECT"; }
if (shExpMatch(url, "*127.0.0.1:49745*")) { return "DIRECT"; }
if (shExpMatch(url, "*172.16.128.139:60080*")) { return "DIRECT"; }
if (shExpMatch(url, "*fp-wsus:9675*")) { return "DIRECT"; }
if (shExpMatch(url, "*172.16.128.128:9675*")) { return "DIRECT"; }
if (shExpMatch(url, "*fp-av*")) { return "DIRECT"; }
if (shExpMatch(url, "*fp-av.falinge.int*")) { return "DIRECT"; }
if (shExpMatch(url, "*172.16.128.132*")) { return "DIRECT"; }


// Slect Proxy Server

if (isInNet(myIpAddress(), "172.16.4.0", "255.255.252.0")) { return capitaproxy; }
if (isInNet(myIpAddress(), "172.16.128.0", "255.255.252.0")) { return capitaproxy; }
if (isInNet(myIpAddress(), "172.16.140.0", "255.255.255.0")) { return capitaproxy; }
if (isInNet(myIpAddress(), "172.16.141.0", "255.255.255.0")) { return capitaproxy; }

else

return "DIRECT";

}

[Arthur]

Would it be possible to try this?

 

function FindProxyForURL(url, host)

{

// -----------------------------------------------------------------------------
// Declare proxy strings as variables
// -----------------------------------------------------------------------------
var capitaproxy = "PROXY 10.112.5.193:80";
var no_proxy    = "DIRECT";


// -----------------------------------------------------------------------------
// Some proxies may have issues with mixed-case URLs, so change host variable to
// all lower case, and resolve the host IP to reduce DNS lookups later
// -----------------------------------------------------------------------------
   host = host.toLowerCase();
   var resolved_ip = dnsResolve(host);


// -----------------------------------------------------------------------------
// If URL has no dots in host name, send traffic direct
// -----------------------------------------------------------------------------

   if (isPlainHostName(host))
   {
       return no_proxy;
   }


// -----------------------------------------------------------------------------
// IPs not to proxy
// -----------------------------------------------------------------------------
// If destination is to an RFC 1918 IP, return direct:

   if (isInNet(resolved_ip, "10.0.0.0", "255.0.0.0") ||
       isInNet(resolved_ip, "172.16.0.0",  "255.240.0.0") ||
       isInNet(resolved_ip, "192.168.0.0", "255.255.0.0") ||
       isInNet(resolved_ip, "127.0.0.0", "255.255.255.0"))
   {
       return no_proxy;
   }


// -----------------------------------------------------------------------------
// IPs to proxy
// -----------------------------------------------------------------------------
// If request matches certain hosts in our IP range, return capitaproxy:

   if (isInNet(resolved_ip, "172.16.4.0", "255.255.252.0") ||
       isInNet(resolved_ip, "172.16.128.0", "255.255.252.0") ||
       isInNet(resolved_ip, "172.16.140.0", "255.255.252.0") ||
       isInNet(resolved_ip, "172.16.141.0", "255.255.252.0"))
   {
       return capitaproxy;
   }


// -----------------------------------------------------------------------------
// Hosts not to proxy
// -----------------------------------------------------------------------------
// If request matches, return direct:

   if (shExpMatch(host, "proxy") ||
       shExpMatch(host, "localhost") ||
       shExpMatch(host, "*fp-av*") ||
       shExpMatch(host, "*fp-av.falinge.int") ||
       shExpMatch(host, "*fp-wsus:9675") ||
       shExpMatch(host, "dm-msw01.rochdale.edu.local") ||
       shExpMatch(host, "sta-xendesktop.lea.edu.local"))
   {
       return no_proxy;
   }


// -----------------------------------------------------------------------------
// Default return direct rule
// -----------------------------------------------------------------------------
// If the request matches no other parsing rules, return direct:

else
       // javascript:alert ("PAC finished parsing for: " + host + "\nFrom IP: " + myIpAddress() + "\nReturning: " + no_proxy);
       return no_proxy;
}

[FN-GM]

Nope doesnt work i am afraid. Thanks anyway

[Arthur]

Does your proxy.pac file work fine in other browsers such as Firefox?

 

Do you have the issue described here?

[FN-GM]

I tried in Chrome and i still get the issue. But chrome does pick its settings up from IE.

 

The LEA is using NetSweeper.

 

I will try to disable proxy caching

 

Thanks

[FN-GM]

Interesting, when i use Server 2008 R2 as the OS the problem doesnt seem to happen. If i use a Windows 7 machine in the same VLAN it doesnt work....

[Arthur]

That's strange! Do both OSs have the same version of Internet Explorer installed e.g. IE9?

 

Are there any policies set in NetSweeper which would only affect the Windows 7 PCs?

Edited January 1, 2012 by Arthur

[FN-GM]

No idea about NetSweeper, its not looked after by the school.

 

They both run IE 9. I logged on an RDS server (running 2008 R2) and it doesnt seem to work on there.

[tom_newton]

Describe "doesn't work" more clearly if you would...

[FN-GM]

We just get connection to the internet asif there wasnt a proxy set at all.

 

Thanks

[Jollity]

Have you tested with the pac file boiled right down to the minimum? Say:

function FindProxyForURL(url, host)
{
return "PROXY 10.112.5.193:80";
}

That might help diagnose whether the problem had anything to do with your particular pac code.

[tom_newton]

What are the IPs of the machines that do and don't work. I'm not sure I like those if statements at the end.

[FN-GM]

Have you tested with the pac file boiled right down to the minimum? Say:

function FindProxyForURL(url, host)
{
return "PROXY 10.112.5.193:80";
}

That might help diagnose whether the problem had anything to do with your particular pac code.

 

Will give it a try

 

What are the IPs of the machines that do and don't work. I'm not sure I like those if statements at the end.

 

Anything in these ranges

 

172.16.128.1 - 172.16.131.254

172.16.4.1 - 172.16.7.254

172.16.140.1 - 172.16.140.254

172.16.141.1 - 172.16.141.254

[DT2]

Is the GPO failing? try a gpresult and see what gives.

Might be that you're better off pushing the pac file by dhcp or dns and setting GPO to automatically detect settings..

 

DT

[FN-GM]

No its not failing. GPO is working perfectly. Its being set but IE is just not connecting to the net.

[featured_spectre]

Is IE detecting the PAC file on the W7 machines?

 

Sounds daft I realise but from what you describe it sounds like its not even detecting the PAC file

[DT2]

the-practical-proxy-pac-file-guide.pdf^^ exactly that.

If you can push it by DNS/DHCP then it may yield some progress, or at the very least an answer.

 

DT

[FN-GM]

Is IE detecting the PAC file on the W7 machines?

 

Sounds daft I realise but from what you describe it sounds like its not even detecting the PAC file

 

[ATTACH=CONFIG]12586[/ATTACH]^^ exactly that.

If you can push it by DNS/DHCP then it may yield some progress, or at the very least an answer.

 

DT

 

As i said before GPO working fine, IE is picking it up and setting it. If i get a standalone machine and set it manually i get the issue. I only got problems when the LEA started tinkering.

[FN-GM]

Have you tested with the pac file boiled right down to the minimum? Say:

function FindProxyForURL(url, host)
{
return "PROXY 10.112.5.193:80";
}

That might help diagnose whether the problem had anything to do with your particular pac code.

 

Just tried this and no chage. Thanks anyway.

[DT2]

Then I imagine all that is left is routing?

can the system ping/route to the IP to which the pac file is associated?

 

Sat here scratching my newly cultivated beardyness.... thinking this is probably already on your list.

 

Daz.

[Willott]

You say they added in load balancing - they haven't as part of that restructured the IP range (ie there's a new load balanced IP)? Simple thing I know... but netsweeper and LEAs do the strangest things!

[featured_spectre]

actually routing is the sensible thing to check. well picked up @DT2. I would check that to be sure.

[Jollity]

Just tried this and no chage. Thanks anyway.

 

Sorry I never noticed this thread got updated.

 

At this point I would try using a packet sniffer like Wireshark or Microsoft Network Monitor. I would try to catch one of the HTTP GET messages going out for which no web page was returned. I would then compare that to a successful GET message, for example sent out with the proxy entered manually (which you said always worked).