Welcome to ISAserver.org

Discussion about article on How to Record URL and User Information

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2004 Firewall] >> Logging and Reporting >> Discussion about article on How to Record URL and User Information

Page: [1] 2 next > >>

Message

<< Older Topic Newer Topic >>

Discussion about article on How to Record URL and User ... - 5.Jul.2005 7:59:00 AM

tshinder

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline

This thread is for discussing the article on How to Record URL and User Information in ISA 2004 Web Proxy Filter and Firewall Logs and Reports at http://www.isaserver.org/tutorials/2004recorduserinfo.html

Thanks!
Tom

[ July 07, 2005, 10:45 AM: Message edited by: tshinder ]

Post #: 1

Featured Links*

RE: Discussion about article on How to Record URL and U... - 6.Jul.2005 2:53:00 AM

rok

Posts: 1
Joined: 6.Jul.2005
Status: offline

Great article.

Is it posible to record URL and User Information if ISA server is not a member of internal domain? We have only one ISA server and for security reasons it's not a member of internal domain (it's standalone server). So we use RADIUS authentication for Web proxy client.

Rok

(in reply to tshinder)

Post #: 2

RE: Discussion about article on How to Record URL and U... - 6.Jul.2005 8:12:00 AM

tshinder

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Rok,

I think you have it wrong. For security reasons, the ISA firewall SHOULD be a member of the domain.

There are a ton of limitations imposed by RADIUS, and the desultory logging is only one of them. Domain membership significantly enhances the ISA firewall's overall security posture, so in the vast majority of cases, it should be a domain member.

The only exception is when the ISA firewall doesn't need to be a domain member, such as a back to back ISA firewall deployment where the front-end ISA firewall doesn't need to be a domain member, since its protecting only DMZ hosts.

HTH,
Tom

(in reply to tshinder)

Post #: 3

RE: Discussion about article on How to Record URL and U... - 6.Jul.2005 11:32:00 AM

Guest

I know that for security reasons, the ISA server must be a Domain Member.

But, in my case, I have a slight different environment.

The users connect to my ISA server through a Cisco pix firewall into a DMZ (where the ISA server is).
We haven't enabled the domain membership on the ISA Server because I understand that is a security issue to have a domain member in a DMZ.

In this particular scenario, what solutions I have to begin logging users? I have to use another ISA server? perhaps making an Array?

Thanks for your time!

(in reply to tshinder)

Post #: 4

RE: Discussion about article on How to Record URL and U... - 6.Jul.2005 10:50:00 PM

jkisa3

Posts: 1
Joined: 6.Jul.2005
Status: offline

I have a parental controls network (seperate from my isa network) that I have my kids log into (it is a linksys parental control). How can I log what web sites they go to? Every thing goes through the ISA firewall however if I change the web proxy settings in IE they bypass the parental controls. Is there a way to have ISA log there web URLS also?

(in reply to tshinder)

Post #: 5

RE: Discussion about article on How to Record URL and U... - 6.Jul.2005 11:39:00 PM

tshinder

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline

quote:
Originally posted by <Wolfgang>:
I know that for security reasons, the ISA server must be a Domain Member.

But, in my case, I have a slight different environment.

The users connect to my ISA server through a Cisco pix firewall into a DMZ (where the ISA server is).
We haven't enabled the domain membership on the ISA Server because I understand that is a security issue to have a domain member in a DMZ.

In this particular scenario, what solutions I have to begin logging users? I have to use another ISA server? perhaps making an Array?

Thanks for your time!

Hi Wolfgang,
That's a very interesting deployment, a back to back firewall config with the ISA firewall in front. While its a valid config, you should bring the more secure firewall, the ISA firewall, closest to the core assets, and let the PIX packet filter just use its packet filter features to filter out the "junk" traffic.

Thanks!
Tom

(in reply to tshinder)

Post #: 6

RE: Discussion about article on How to Record URL and U... - 6.Jul.2005 11:41:00 PM

tshinder

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline

quote:
Originally posted by jk3:
I have a parental controls network (seperate from my isa network) that I have my kids log into (it is a linksys parental control). How can I log what web sites they go to? Every thing goes through the ISA firewall however if I change the web proxy settings in IE they bypass the parental controls. Is there a way to have ISA log there web URLS also?

Hi JK,
Why not use the ISA firewall to block the bad sites?

Thanks!
Tom

(in reply to tshinder)

Post #: 7

RE: Discussion about article on How to Record URL and U... - 10.Jul.2005 9:55:00 PM

j2004

Posts: 3
Joined: 24.Oct.2004
Status: offline

quote:
--------------------------------------------------------------------------------
Originally posted by <Wolfgang>:
I know that for security reasons, the ISA server must be a Domain Member.

But, in my case, I have a slight different environment.

The users connect to my ISA server through a Cisco pix firewall into a DMZ (where the ISA server is).
We haven't enabled the domain membership on the ISA Server because I understand that is a security issue to have a domain member in a DMZ.

In this particular scenario, what solutions I have to begin logging users? I have to use another ISA server? perhaps making an Array?

Thanks for your time!
--------------------------------------------------------------------------------

Hi Wolfgang,
That's a very interesting deployment, a back to back firewall config with the ISA firewall in front. While its a valid config, you should bring the more secure firewall, the ISA firewall, closest to the core assets, and let the PIX packet filter just use its packet filter features to filter out the "junk" traffic.

Thanks!
Tom

-

Tom, Have you considered that if this person is using isa in cache mode only etc. and doesn't need the other isa features (when used as firewall, publising box) hence doesn't care less for having it a domain memeber ? there is nothing wrong with having caching proxy server in a DMZ Tom, 1. In fact its excellent practice if it is to serve other networks aswell and doesn't need to be a member of the internal domain. 2. it can be well hardened aswell by disbling uneeded services, and hence also knows very little stuff about inside networks for any potential compromise to extract. I have deployed many Squid Box's in a DMZ in this scenario, now that ISA2004 can do radius auth for this type of proxy deployment many admins may migration from Squid to ISA2004. Its actually a very common scenario.

The guy just asked if the logging is still as good when setup this way, a good question. I suggest you just anwser the question instead of telling the poster how to design their network.

Sorry if this sounds like flaming, remember not everyone's environment is how MS or you want it to be. Example, many organisatiosn don't publish anything, and never will as they have no need, accept perhaps for smtp, in this case the PIX has a proven application smtp filter that can be attached to another external registered ip address/dns mx for publising to the inside box, and often a proxy server is placed in the dmz, so it can serve more than just a MS network behind the pix, with ISA2004 being able to authenticate using radius and perhaps better logging facility because of this feature, this is an attractive scenario for many organisations as this ins't t as easy to do on on standalone proxy servers.

regards

julian

[ July 10, 2005, 09:58 PM: Message edited by: j2004 ]

(in reply to tshinder)

Post #: 8

RE: Discussion about article on How to Record URL and U... - 11.Jul.2005 9:57:00 AM

tshinder

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Julian,

I just try to encourage best practices and the best type of deployments and security. I realize that there are misconceptions out there, and that there are political hacks that need to be dealt with, so that the ISA firewall isn't always deployed correctly or most securely. But I always assume that there is the goal, and try to help make it the most secure ISA firewall deployment possible.

Thanks!
Tom

(in reply to tshinder)

Post #: 9

RE: Discussion about article on How to Record URL and U... - 14.Jul.2005 10:13:00 PM

AGJFritz

Posts: 1
Joined: 14.Jul.2005
From: Illinois (Land of the silent 'S')
Status: offline

Hi Tom,

I'm in the same boat as Wolfgang. We are using ISA in a DMZ to securely publish OWA. We just put in Secure Computing SmartFilter, and are using that on the ISA server, which is now our WebProxy server. It's not a domain member, and all that we allow in from the DMZ is the traffic necessary for the OWA operations. Is there a good way just to get usernames in the ISA Logs? It's allowing All Users access right now, and not Authenticated Users. I really don't want to have to have the users enter a UN/Password everytime they go to the web. Thanks!

-Andy

P.S. Great Article btw.

(in reply to tshinder)

Post #: 10

RE: Discussion about article on How to Record URL and U... - 15.Jul.2005 11:34:00 AM

tshinder

Posts: 50013
Joined: 10.Jan.2001
From: Texas
Status: offline

Hi Andrew,

Everytime I hear about one of these kind of deployments it breaks my heart.

Its like having a champion racehorse, but because some dolt somewhere said "that racehorse must run with only two legs", we have to amputate two of the horses legs. That's how much security you remove from the ISA firewall with these kind of deployments.

The only way the ISA firewall can record user names for forward and reverse Web proxy filter connections is to have users authenticate with the ISA firewall. The obvious and best way is to make the ISA firewall a domain member; the second best way is to use RADIUS authentication. But there are a lot of downsides of RADIUS authentication and a ton of upsides for making the ISA firewall a domain member.

Believe me -- someone will crack the "hardware" firewall long before they even touch the ISA firewall!

HTH,
Tom

(in reply to tshinder)

Post #: 11

RE: Discussion about article on How to Record URL and U... - 26.Aug.2005 1:41:00 PM

Guest

Maybe I missed it somewhere.... but how do I get a report showing me which users went to what websites? Do I need a third party tool?

They are configured as proxy clients.

Thanks

(in reply to tshinder)

Post #: 12

RE: Discussion about article on How to Record URL and U... - 9.Sep.2005 2:01:00 PM

Rainman13

Posts: 19
Joined: 29.Apr.2005
Status: offline

quote:
Originally posted by <Rainman13>:
Maybe I missed it somewhere.... but how do I get a report showing me which users went to what websites? Do I need a third party tool?

They are configured as proxy clients.

Thanks

Here is an more information:

I have a Windows 2003 domain, ISA 2004 w/ 2 NICs. All clients are webproxy clients and I am requiring authentication.

Based on what I've been reading, I think I'm just missing it.... a little help.

(in reply to tshinder)

Post #: 13

RE: Discussion about article on How to Record URL and U... - 14.Sep.2005 5:21:00 PM

wishfly

Posts: 122
Joined: 6.Mar.2005
Status: offline

you can try netfee
http://www.netfeesoftware.com/NetFee/Index.htm

(in reply to tshinder)

Post #: 14

RE: Discussion about article on How to Record URL and U... - 8.Jun.2006 2:41:43 PM

befire

Posts: 2
Joined: 8.Jun.2006
Status: offline

Dear Sir,
can i prevent ISA server 2004 from recording and monitoring the activities (sessions,url,IP,etc..) for a specific IP address or PC.

thank u

(in reply to wishfly)

Post #: 15

RE: Discussion about article on How to Record URL and U... - 16.Jun.2006 9:01:30 PM

paleogryph

Posts: 9
Joined: 6.Feb.2006
Status: offline

I have a question and a comment.

Comment:
When I go to Monitoring > Logging > Start Query > it shows me in realtime what domain users are going to what url's. Thats great, and what we wanted to get out of ISA. I never had to enable the Firewall Client or Auto Discovery. I enabled Web Proxy Clients and set IE to use the proxy via GP and set FF to use the proxy via all.js. So I'm kind of confused about the article. Perhaps I'm mis-reading something, but doesn't it indicate that Firewall Client and Auto Discovery must be enabled for logging to show the url matched with the user?

Question:
I see others on this board asking what I would consider is one of the most important questions about ISA, yet I haven't seen a definitive answer. Perhaps the answer is here but I haven't found it yet. The question is, how can the reporting (not logging) be set to show users matched with urls? I have looked into the customizing of my daily reports, yet I haven't been able to get the daily reports to show such data. I have seen others suggest third party software tools for this, yet I thought perhaps ISA has it's own way of doing this that I haven't discovered yet. What I need is detailed user/url matching, with time/date/etc; Is this only available via third party software?

thanks

(in reply to befire)

Post #: 16

RE: Discussion about article on How to Record URL and U... - 10.Jul.2006 10:06:18 PM

seanofarrell

Posts: 6
Joined: 29.Jan.2006
Status: offline

Hi paleogryph ,

My question is exactly the same as yours. I have followed all steps as per the article but still dont get detailed username & urls in the ISA Reports. A managing director of a client company of mine wants to view the daily published reports and they dont make sense. It would be really really cool if I can get these reports working!

Thanks

Sean

(in reply to tshinder)

Post #: 17

RE: Discussion about article on How to Record URL and U... - 15.Mar.2007 11:19:08 AM

a58strod

Posts: 2
Joined: 22.Feb.2007
Status: offline

I have the same question as the above 2 questions. How do you get the information that is recorded into the log that shows what users have been to what sites on a REPORT without third party software???

(in reply to paleogryph)

Post #: 18

split network between web proxy and securenat clients a... - 5.Apr.2007 7:23:19 AM

mwilso09

Posts: 5
Joined: 16.May2005
Status: offline

Tom,
This is a great article about authentication and logging. I have a question I was hoping you could clarify for me. I have read the article and played around with many of the settings. I have also looked over the other articles about authentication and access policies that I can find...I hate being that guy who asks a question that is already clearly answered.

My scenario is this....
Simple domain setup. One 2K3 server is Domain Controller/DNS/DHCP among other things server based. The other 2K3 is the ISA Server that is domain member and serves as a content filter for our network. (I use bt-webfilter for content...but my question is related to ISA). (2 NICS...one to internal network subnet, other to DSL router).

We are a school and all staff computers are Domain based (with XP) and so are our internet cafe public computers. Student laptops (student owned) are non domain members (SecureNAT). I broadcast WPAD autodiscovery and Web Proxy info, so my manual configuration is at a minimum.

On ISA I have one rule to open up all protocols to External for All Users. This allows traffic to pass to the bt-webfilter for filtering. (I have other rules, but have disabled them all to work with this basic troubleshooting scenario.)

What I would like for ISA 2004 to do in a perfect world is to take authentication (integrated is turned on) from clients that can provide it and place it into the logs. Then users that are SecureNAT only and are anonymous can place anonymous user info. All securenat laptops have DHCP reservations, so if I am only getting IP info for them, then I can still resolve the IP to the student. I cannot resolve IP to 'logged on user' from public workstations though.

If I change the access policy to "all authenticated users" I get the user data I want in the logs, but then SecureNAT clients aren't allowed. So then I thought, first create a policy allowing access for authenticated users and it will log, and then under that create a lower policy for ALL USERS, but the anonymous users don't get past the 1st policy. As I understand from your and other articles, this is by design.

I hope this makes sense. I would love to get user info from authenticated users and then IP info for anonymous. It seems like there must be a way to do this. Any input is HIGHLY appreciated from the man who knows all (or anyone else who can cast some light).

Thanks again!!

ps...
we have quite a few visitors so I don't want or need to do basic authentication for laptops, i want everyone to have access with minimum user interference.

(in reply to a58strod)

Post #: 19

RE: split network between web proxy and securenat clien... - 7.May2007 1:27:24 PM

conna

Posts: 16
Joined: 23.Mar.2005
Status: offline

I have the same need that seanofarrell and paleogryph are asking for. Management wants the report to show what the users are browsing all day with their investment in ISA. I created a new post so that this does not get buried.

http://forums.isaserver.org/Better_reports_what_users_browsed_what_websites/m_2002043909/tm.htm

(in reply to mwilso09)

Post #: 20