Welcome to ISAserver.org

Upstream Proxy Headaches

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA 2006 Firewall] >> General >> Upstream Proxy Headaches

Page: [1]

Message

<< Older Topic Newer Topic >>

Upstream Proxy Headaches - 31.Mar.2008 6:55:26 PM

stevenljjohnson

Posts: 11
Joined: 30.Apr.2004
From: Telford UK
Status: offline

Hi All,
Many thanks for taking the time and all that. Hopefully someone can perhaps help and advise on the following. It appears to be a regular thing that I come up against in the environments I have to work in.

The scenario runs thus.
I work for an IT provider that does alot of educational work in the UK, so consequently much of our work is in schools. Very often these schools have their internet connectivity provided by a Local Authority who also provide proxying services to the school. Very often this proxying service will provide one HTTP port for teachers and another one for students which is more restricitive than the teaching one for obvious reasons. We suddenly hit the issue of only being able to direct traffic on an all or nothing basis to the upstream proxy for all users. As all internal users are being directed to the ISA server as their web proxy, we are now unable to distinguish between teachers and students and push them separately to their individually specified ports as the web chaining feature of ISA 2006 does not allow for use of Windows Based groups.

The only solution I can see is to provide a second array so we have one pointed at the teaching port and another one pointing at the student port. Which is a bit expensive to say the least.

Has anyone got any clever ideas of work arounds to this problem or needs further info them please by all means ask away.

Thanks again for any suggestions

Post #: 1

Featured Links*

RE: Upstream Proxy Headaches - 1.Apr.2008 8:37:00 AM

ferrix

Posts: 375
Joined: 16.Mar.2005
Status: offline

I'm not sure whether this counts as a solution, but it should be possible to make a filter that changed the routing behavior based on some criteria such as what firewall rule it's flowing through. But this isn't a freebie; filter development costs too.

(in reply to stevenljjohnson)

Post #: 2