Why doesn't Firewall Client configure IE proxy settings?

[Edward Lee]

I have a laptop that connects to the Internet from both home and work. When
I move from one place to the other, it is a two step process to get IE
working. First, I have to enable/disable the Firewall Client. Then, I have
to check/uncheck the proxy settings in IE.

Is there an easier way? I thought, in SBS 2000, simply enabling/disabling
the Firewall Client took care of everything.

Thanks for any help,
Ed Lee

[Luke Digby]

I know i have the exact same problem. Somebody recommended using scripts to
automate this process, so only when looging onto the network it
automatically sets the the proxy settings for you and when logging of always
removes them. this is not the greatest because laptop users are more and
more often using features like hibernate and not logging in and out
properly.

i also thought that the firewall client would sort this issue out and it
doesn't. What the heck does it DO then????

Luke

"Edward Lee" <el...@ulgm.org> wrote in message
news:unuhGYc...@tk2msftngp13.phx.gbl...

[MCTrainer]

Have you tried running your computer on the SBS network without the proxy
settings configured ?

With ISA Firewall enabled on the client and with the default ISA "Listening
Configuration" you don't need to have any proxy settings configured.

It means you are a ISA Firewall Client instead of an ISA Proxy Client.

"Edward Lee" <el...@ulgm.org> wrote in message
news:unuhGYc...@tk2msftngp13.phx.gbl...

[Luke Digby]

Thanks for the advice. This is the way i though it worked. I have firewall
client installed and it is on the system tray with a little green and white
up arrow to show it is connected to the ISA server. Proxy settings disabled
in explorer, and i get the following message when trying to connect to a web
page:
403 Forbidden - The ISA Server denies the specified Uniform Resource Locator
(URL). (12202)
Internet Security and Acceleration Server
What do you think is the problem or is firewall client just really flaky?

Cheers,
Luke

"MCTrainer" <swb...@msn.com> wrote in message
news:OCjXbncD...@tk2msftngp13.phx.gbl...

[Trevor Clark]

For what it's worth, mine won't work without proxy info either. My users
hate this hassle. If you get this figured out, please post!

-Trevor

"Luke Digby" <lwd...@easy.com> wrote in message
news:elMcGucD...@TK2MSFTNGP11.phx.gbl...

[MCTrainer]

I have set up many ISA servers with the firewall client and no proxy
settings and they worked great, but they were not part of the SBS2003
setup.

When I installed SBS2003 I configured ISA manually rather then having SBS
server wizards do it. There has to be some ISA configuration that is
causing the problem, but I would have to see it to find it.

Since the real SBS experts don't read this deep into a thread, I would
suggest reposting your question.

"Luke Digby" <lwd...@easy.com> wrote in message
news:elMcGucD...@TK2MSFTNGP11.phx.gbl...

[Edward Lee]

I experience the exact same behavior as Luke just described below. Firewall
client enabled, IE Proxy disabled, 403 Forbidden error.

My boss will be leaving town Monday. I'd love to get this simplified before
he leaves.

Thanks,
Ed Lee

"Luke Digby" <lwd...@easy.com> wrote in message
news:elMcGucD...@TK2MSFTNGP11.phx.gbl...

[MCTrainer]

I think I will have an answer to this by Saturday Morning. I am a certified
ISA specialist, but I have never seen what the SBS setup does to the ISA
Configuration to create this issue . I am doing a new "by the book" test
install of SBS with ISA today to examine the problem.

"Edward Lee" <el...@ulgm.org> wrote in message
news:unuhGYc...@tk2msftngp13.phx.gbl...

[Wesley Kendall [MSFT]]

We DO read into the threads as far as they go. We usually post close to the
top so that the people that don't read to the bottom of the thread will see
the answer. :)

The SBS installation creates rules that only allow authenticated users out.
If you are not configured to be a web proxy client, it is true that the
firewall client passes credentials to the ISA server. However, the default
SBS installation also redirects all HTTP traffic to the web proxy service,
and the redirector does NOT pass credentials. This causes the server to
deny access because it cannot authenticate the user.

You have several options:

1) Configure the client web browsers to be web proxy clients.

2) Remove the user/group restriction on the protocol and site and content
rules in ISA by applying them to "all requests" and setting the outbound
web requests listener to not ask unauthenticated users for authentication.
The outbound listener is on the properties of the ISA server.

3) Stop redirecting HTTP requests from the firewall service to the web
proxy service. The downside to this is that you lose the performance
benefits of caching on the server. You can find the redirector in
Extensions\Application Filters.

If you open ISA Management, navigate to Servers and
Arrays\{servername}\Client Configuration and choose the web browser
component, you will see that you have the option to configure web browser
during firewall client setup.

Thanks!

--

Wesley Kendall
Small Business Server Product Support

This posting is provided "AS IS" with no warranties, and confers no rights.

Get Secure! http://www.microsoft.com/security

=====================================================

When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.

=====================================================

[Edward Lee]

Thanks for the information Wesley. I hope you don't mind a few follow
questions.

The first option you provide is to "Configure the client web browsers to be
web proxy clients." Is this what I have been doing (i.e. going into IE
connection properties and specifiying the proxy server)? Or, are you talking
about something different?

I understand the disadvanatge of option 3 that you presented. Are there
other advantages and disadvantages of the other options that you provided?

Which option is best for me if I don't want to change the IE proxy settings
everytime I leave the SBS network?

Thanks,
Ed Lee

"Wesley Kendall [MSFT]" <a-w...@online.microsoft.com> wrote in message
news:M8ntHPfD...@cpmsftngxa06.phx.gbl...

[Wesley Kendall [MSFT]]

>Thanks for the information Wesley. I hope you don't mind a few follow
>questions.
>
>The first option you provide is to "Configure the client web browsers to be
>web proxy clients." Is this what I have been doing (i.e. going into IE
>connection properties and specifiying the proxy server)? Or, are you
talking
>about something different?
>
>I understand the disadvanatge of option 3 that you presented. Are there
>other advantages and disadvantages of the other options that you provided?
>
>Which option is best for me if I don't want to change the IE proxy settings
>everytime I leave the SBS network?
>
>Thanks,
>Ed Lee

I forgot one other option: you can publish the outgoing web listener via a
WPAD DNS entry and change the outgoing web listener to port 80, and then
set the client machines to "automatically detect settings" in IE. There
should be more detailed info in the ISA server help file (look in the index
for WPAD).

To answer your question, yes, you have been configuring the clients to be
web proxy clients.

Removing the user/group restrictions and authentication on the proxy server
will not allow you to filter web content on users and groups. This means
that either everyone can access something, or no one can access it. With
authentication enabled, you can allow Tom to access web site A all of the
time, for example, while Sally can only access web site A during 8-5
Mon-Fri, and Andy cannot access the site at all.