Welcome to ISAserver.org

Preventing browser from sending anonymous requests

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA 2006 Web Proxy] >> Web Proxy Client >> Preventing browser from sending anonymous requests

Page: [1]

Message

<< Older Topic Newer Topic >>

Preventing browser from sending anonymous requests - 14.Jul.2008 12:27:14 PM

Posts: 13
Joined: 21.Nov.2006
Status: offline

I'd like to force authentication for our web proxy. When I enable this on my rules, it works, but there are still requests coming in as anonymous, and of course they get dropped. Is there something that can be done in the client's browser to prevent anonymous requests?

Post #: 1

Featured Links*

RE: Preventing browser from sending anonymous requests - 14.Jul.2008 12:45:55 PM

Jason Jones

Posts: 2119
Joined: 30.Jul.2002
From: United Kingdom
Status: online

No, this is normal behaviour.

http://technet.microsoft.com/en-gb/library/cc302664.aspx

"In addition, Web Proxy clients always make the first connection anonymously"

Cheers

JJ

_____________________________

Jason Jones (MVP)

Silversands Limited http://www.silversands.co.uk
My Blog: http://blog.msfirewall.org.uk/

Get our NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to JW)

Post #: 2

RE: Preventing browser from sending anonymous requests - 14.Jul.2008 12:48:20 PM

Posts: 13
Joined: 21.Nov.2006
Status: offline

Thanks, Jason. But is it normal for there to be A LOT of them from the same client, accessing the same site? And, because of this design, will having authentication as a requirement break users' ability to get to any site, or will the initial connection be retried with authentication?

< Message edited by JW -- 14.Jul.2008 12:50:39 PM >

(in reply to Jason Jones)

Post #: 3

RE: Preventing browser from sending anonymous requests - 14.Jul.2008 4:49:45 PM

ferrix

Posts: 363
Joined: 16.Mar.2005
Status: offline

JW,
for clients using the web proxy configuration, they will retry with authentication.

For clients that don't support proxy settings, are not set up to use them, or are too dumb to support authentication, those requests may fail. Some apps for example call out to their home companies to check for updates, and some of these could fail.

Just be aware of trouble tickets of connection errors, and see if you can correlate any of them to anonymous "connection denied" logs.

(in reply to JW)

Post #: 4

RE: Preventing browser from sending anonymous requests - 16.Jul.2008 7:37:26 AM

paulo.oliveira

Posts: 792
Joined: 3.Jan.2008
From: Amazonas, Brazil
Status: offline

Hi,

if you are using IE6, then the authentication method is NTLM. By using NTLM you send more requests to ISA machine and consequently to your DC. If you use Kerberos to authenticate, then you just have to authenticate once on bothe servers. Check this greate article for a better understanding:
Improving Web Proxy Client Authentication Performance on ISA Server 2006

Regards,
Paulo Oliveira.

(in reply to ferrix)

Post #: 5