ISA 2004, IE and Proxy settings (Full Version)

All Forums >> [ISA Server 2004 Cache] >> Web Proxy client



Message

thecoffeeguy -> ISA 2004, IE and Proxy settings (17.Dec.2005 1:55:20 AM)

Ok, I thought i had this figured out, but guess not.

The problem:

When I configure my clients Internet Explorer browser to autodetect the proxy settings, it takes 10-20 seconds for it to autodetect and keep going. This is driving me and my users nuts.

What is going and how can I fix this?

This is absolutely critical that I fix this because we need this to work in order for Surfcontrol (which we are currently evaluating) will work properly.

I am completely at a loss here and frustrated.

I've tried putting the settings in, undoing them, putting them back in.
I've tried rebotting the computer.

I created a WPAD file for DHCP.

I don't know.

I need some help if anyone can help me out here.

Thanks,

thecoffeeguy



ClintD -> RE: ISA 2004, IE and Proxy settings (17.Dec.2005 3:21:25 AM)

Stefaan (spouseele) troubleshot the heck out of this and eventually opened a case with MS' PSS. See his article - http://www.isaserver.org/articles/ISA2004_ClientAutoConfig.html under Section 6 (last sentence). 

There is a hotfix for this issue. It's mentioned in Tom's blog. Look under 'Update to WPAD issue' and also the next one under it 'DHCP versus DNS WPAD' all the way at the bottom of the page. 

The fix is under MS KB article 906055 but that one doesn't appear to be public yet. You might consider calling MS' PSS at (800) 936-4900 to get the fix - it will be free since it's only for a hotfix. Just tell them you need a grace case in order to obtain a hotifx. I worked in MS' PSS and this is how it's done.



spouseele -> RE: ISA 2004, IE and Proxy settings (17.Dec.2005 2:28:38 PM)

Hey guys,

yep, I spend a lot of time in diagnosing that problem and trying to convince MS PSS to do something about it. I even created a business case. The latest status can be found at http://forums.isaserver.org/m_350016600/mpage_2/tm.htm . I have the KB906055 fix operational and it is working great. However it is only applicable to Windows XP SP2.

If you can't get the fix or don't use Windows XP SP2, the best workaround I have is to let the Firewall client 2004 automatically detect the ISA server *and* automatically configure Internet Explorer to use a configuration script. The beauty of this solution is that this is only done if the Firewall client can detect the ISA server. In other words, if no ISA server can be detected than the default Internet Explorer settings apply.

HTH,
Stefaan



thecoffeeguy -> RE: ISA 2004, IE and Proxy settings (17.Dec.2005 9:00:47 PM)

Thanks for the input guys. I'll see what I can come up with.

Just a few things:

1.) I currently do not have the firewall client rolled out to everyone. We were not sure if that is what we were going to do. BUT, if it solves the problem of long auto detection everytime a browser opens, we just might go that route. Being that we are going to use Surfcontrol, we also did not think we would need the firewall client for everyone either, since Surfcontrol can do name resolution.

2.) You metnion this hotfix and it only applies to Windows XP SP2. Does that mean if im using Windows 2000 Pro, im out of luck?

Looks like i have a few things I need to take into consideration.

I'll be back and post my results.

Cheers,

thecoffeeguy



thecoffeeguy -> RE: ISA 2004, IE and Proxy settings (17.Dec.2005 9:04:41 PM)

quote:

ORIGINAL: ClintD
There is a hotfix for this issue. It's mentioned in Tom's blog. Look under 'Update to WPAD issue' and also the next one under it 'DHCP versus DNS WPAD' all the way at the bottom of the page. 


Interesting, especially DHCP versus DNS.

Since I currently setup WPAD in DHCP, would moving to DNS help the delay issue?

Is there a walkthrough on the proper way to set this up in DNS?

Thanks,

thecoffeeguy



LLigetfa -> RE: ISA 2004, IE and Proxy settings (17.Dec.2005 11:07:20 PM)

Create a CNAME alias called WPAD for your ISA server.

On my network we share the same DNS suffix across a large organization and cannot use the DNS WPAD because there are many ISA servers at different divisions.  While it is possible to host WPAD externally and to script it to be subnet aware, our CorpIT does not have the will to do so.  I rely on DHCP only and use the FWC to push the routing script to IE.  FWC is nice to have on the clients as it solves a lot of shortcomings with apps that do not do WP well.



thecoffeeguy -> RE: ISA 2004, IE and Proxy settings (18.Dec.2005 5:43:29 PM)

quote:

ORIGINAL: LLigetfa

Create a CNAME alias called WPAD for your ISA server.

On my network we share the same DNS suffix across a large organization and cannot use the DNS WPAD because there are many ISA servers at different divisions.  While it is possible to host WPAD externally and to script it to be subnet aware, our CorpIT does not have the will to do so.  I rely on DHCP only and use the FWC to push the routing script to IE.  FWC is nice to have on the clients as it solves a lot of shortcomings with apps that do not do WP well.


Just a simple CNAME for my ISA server called WPAD? That's pretty straightforward and easy.

Anything else?

Also, I still might roll out the FWC. However, since im fairly new to ISA the the client piece, I have been doing a lot of testing to make sure everything works properly.

Thanks,

thecoffeeguy



thecoffeeguy -> RE: ISA 2004, IE and Proxy settings (22.Dec.2005 6:42:20 PM)

Thought I would post my results.

Like ClintD suggested, I put the ISA Server into the trusted zones in IE for all my clients via GPO.

Now it works great. Everyone is NOT getting a logon box and now I can get name resolution to work in SurfControl.

Working well so far.



keastland -> RE: ISA 2004, IE and Proxy settings (23.Dec.2005 5:33:27 PM)

This is exactly what I'm trying to resolve. My problem is that we still have several NT machines on our network and therefore can't use GPO's. Is there any way to rectify this issue with with a network running NT, W2K, and XP machines ...other than upgrading all of the NT macines. That, or course, is the ultimate goal. But, unfortunately, I don't control the finances of our company.



LLigetfa -> RE: ISA 2004, IE and Proxy settings (23.Dec.2005 5:48:04 PM)

quote:

This is exactly what I'm trying to resolve

What exactly?  This thread covers several issues and most of them have solutions posted. You probably should start your own thread and clearly state what you have tried.



keastland -> RE: ISA 2004, IE and Proxy settings (23.Dec.2005 6:29:12 PM)

Sorry, I'm an admitted newbie that's been thrown in over my head.

My issue is that in SurfControl I was unable to monitor by username, it would only recognize IP's. I found an article on SurfControls site that said to check the "require all users to authenticate" box on the Web Proxy tab of the Internal properties in ISA 2004. So I did that and I was then able to use usernames in the setup and monitoring, however, SurfControl would still not use groups from AD and it also started to prompt users for logon info when they open IE

So I've had to uncheck the "require all users to authenticate" and right now ISA is set up for Integrated Authentication only. I've been reading alot about setting up a RADIUS server, WPAD's, and now in this thread using GPO's. The problem with GPO's is that we still have a lot of NT machines on our network and it is not feasible at this time to upgrade them all. I was wondering if there is another way to take care of this issue without using GPO's.

I'm certain that I will need to supply more info. Sorry, I'm just a rookie and thank you to anyone who provides me with any ideas or solutions.

Thanks!



LLigetfa -> RE: ISA 2004, IE and Proxy settings (23.Dec.2005 8:03:06 PM)

Unless I missed something, the only thing mentioned in this thread on the subject of GPO, is adding ISA to the trusted sites zone.  That was just an alternative to the fix mentioned in KB885683.  IMHO, the SkipAuthenticationForRoutingInformation is a simple and viable fix.

It sounds to me that you have an entirely different problem, that of not being able to communcate properly with your DC.  Rather than entertain IAS, why not join the ISA to the domain?  You will most likely need to adjust the system policy.

I also hold to the principle of NOT forcing authentication at the network rule but rather access per rule only as needed.  It sounds to me your issues are totally different from this threads topic so you really should start your own.



Page: [1]