Firewall Client/Proxy Server Question

Discussion:

(too old to reply)

c***@gmail.com

2007-12-03 17:13:03 UTC

We are using SBS2000 --with ISA Server 2000. We only have XP Clients.
Is there any reason to have both the Firewall Client and the Proxy
Server setting in Internet Explorer set to point to the ISA Server at
port 8080? Or, is the the Firewall Client alone sufficient for
Internet browsing? We think that setting the proxy setting is ony
necessary if for some reason (such as the OS or browser in use) the
Firewall Client cannot be installed.

As it is now, we have both. However, periodically, but very
infrequently, at random websites, the user is prompted for a username/
password for the Proxy Server. If we remove the proxy settings, the
prompts do not occur, but we sometimes get "page cannot be displayed"
or similar error. We are not sure why we are prompted as the same
webpage may or may not prompt the user?

Thanks.

Cris Hanna [SBS-MVP]

2007-12-03 17:53:04 UTC

Permalink

There are many other programs you could possibly have installed that will look to IE's proxy settings

Probably best to have both
--
Cris Hanna [SBS - MVP]
-----------------------------------------------------------
MVPs Do Not Work for Microsoft
Please do not contact me directly regarding issues
<***@gmail.com> wrote in message news:0e13ef59-1d59-44b0-8770-***@j20g2000hsi.googlegroups.com...
We are using SBS2000 --with ISA Server 2000. We only have XP Clients.
Is there any reason to have both the Firewall Client and the Proxy
Server setting in Internet Explorer set to point to the ISA Server at
port 8080? Or, is the the Firewall Client alone sufficient for
Internet browsing? We think that setting the proxy setting is ony
necessary if for some reason (such as the OS or browser in use) the
Firewall Client cannot be installed.

As it is now, we have both. However, periodically, but very
infrequently, at random websites, the user is prompted for a username/
password for the Proxy Server. If we remove the proxy settings, the
prompts do not occur, but we sometimes get "page cannot be displayed"
or similar error. We are not sure why we are prompted as the same
webpage may or may not prompt the user?

Thanks.

c***@gmail.com

2007-12-03 18:10:57 UTC

Permalink

On Dec 3, 12:53 pm, "Cris Hanna [SBS-MVP]"

Post by Cris Hanna [SBS-MVP]
There are many other programs you could possibly have installed that will look to IE's proxy settings
Probably best to have both
--
Cris Hanna [SBS - MVP]
-----------------------------------------------------------
MVPs Do Not Work for Microsoft
We are using SBS2000 --with ISA Server 2000. We only have XP Clients.
Is there any reason to have both the Firewall Client and the Proxy
Server setting in Internet Explorer set to point to the ISA Server at
port 8080? Or, is the the Firewall Client alone sufficient for
Internet browsing? We think that setting the proxy setting is ony
necessary if for some reason (such as the OS or browser in use) the
Firewall Client cannot be installed.
As it is now, we have both. However, periodically, but very
infrequently, at random websites, the user is prompted for a username/
password for the Proxy Server. If we remove the proxy settings, the
prompts do not occur, but we sometimes get "page cannot be displayed"
or similar error. We are not sure why we are prompted as the same
webpage may or may not prompt the user?
Thanks.

Ok, but what is typically the reason that while Internet Browsing, a
user is prompted for their Username/Password, when they have had no
previous problem browsing to the same webpage?? Also, entering the
username/password generally does not help the matter...

Thanks in advance..

Cris Hanna [SBS-MVP]

2007-12-03 18:38:28 UTC

Permalink

Well Unfortunately a while since I've worked on an SBS 2000 box

Are you currently running the Firewall Client and Proxy or just Proxy?

Are the users logged on to the domain vs the workstation?
--
Cris Hanna [SBS - MVP]
-----------------------------------------------------------
MVPs Do Not Work for Microsoft
Please do not contact me directly regarding issues
<***@gmail.com> wrote in message news:75c48aee-6329-498b-982a-***@w40g2000hsb.googlegroups.com...
On Dec 3, 12:53 pm, "Cris Hanna [SBS-MVP]"

c***@gmail.com

2007-12-03 18:51:32 UTC

Permalink

On Dec 3, 1:38 pm, "Cris Hanna [SBS-MVP]"

Post by Cris Hanna [SBS-MVP]
Well Unfortunately a while since I've worked on an SBS 2000 box
Are you currently running the Firewall Client and Proxy or just Proxy?
Are the users logged on to the domain vs the workstation?
--
Cris Hanna [SBS - MVP]
-----------------------------------------------------------
MVPs Do Not Work for Microsoft

We are currently using both the Firewall Client and the Proxy Server
and the workstations are logged into the domain, though I am trying to
recall why we ever set the Proxy settings to begin with. Like I
stated, the prompt for Username/Password happens very infrequently.
However, when the user does get the prompt and we remove the proxy
settings, the webpage displays fine. The same page may sometimes
display fine with the proxy settings.Or, with proxy settings we
sometimes get an error at the Windows Update site--but if removed we
do not get an error.

I guess we are just trying to determine which apps we use may need a
proxy setting--do you have an example??

Duncan McC

2007-12-03 22:40:13 UTC

Permalink

In article <5879588e-68f6-4621-b18d-a62291b7ac32
@l1g2000hsa.googlegroups.com>, ***@gmail.com says...

Post by c***@gmail.com
On Dec 3, 1:38 pm, "Cris Hanna [SBS-MVP]"

We are currently using both the Firewall Client and the Proxy Server
and the workstations are logged into the domain, though I am trying to
recall why we ever set the Proxy settings to begin with. Like I
stated, the prompt for Username/Password happens very infrequently.
However, when the user does get the prompt and we remove the proxy
settings, the webpage displays fine. The same page may sometimes
display fine with the proxy settings.Or, with proxy settings we
sometimes get an error at the Windows Update site--but if removed we
do not get an error.
I guess we are just trying to determine which apps we use may need a
proxy setting--do you have an example??

There are many apps that will use IE's proxy settings - can't think of
one off the top of my head though :)

I maintain one SBS 2000 network (changing this week to 2003), and I've
always used the (SBS) firewall client and proxy settings for ISA.

Of note, in SBS 2003 Premium (w' ISA Server) the SBS firewall client
actually has a new button that configures IE (sets the proxy settings
and installs a dll to run on start (of IE)). I think it's the later
that checks the proxy settings are set.

So yeah, it's meant to be that way.

Are the users members of the Internet group?

--
Duncan

c***@gmail.com

2007-12-03 23:00:03 UTC

Permalink

Post by Duncan McC
In article <5879588e-68f6-4621-b18d-a62291b7ac32
@l1g2000hsa.googlegroups.com>, ***@gmail.com says...

Post by c***@gmail.com
On Dec 3, 1:38 pm, "Cris Hanna [SBS-MVP]"

We are currently using both the Firewall Client and the Proxy Server
and the workstations are logged into the domain, though I am trying to
recall why we ever set the Proxy settings to begin with. Like I
stated, the prompt for Username/Password happens very infrequently.
However, when the user does get the prompt and we remove the proxy
settings, the webpage displays fine. The same page may sometimes
display fine with the proxy settings.Or, with proxy settings we
sometimes get an error at the Windows Update site--but if removed we
do not get an error.
I guess we are just trying to determine which apps we use may need a
proxy setting--do you have an example??

There are many apps that will use IE's proxy settings - can't think of
one off the top of my head though :)
I maintain one SBS 2000 network (changing this week to 2003), and I've
always used the (SBS) firewall client and proxy settings for ISA.
Of note, in SBS 2003 Premium (w' ISA Server) the SBS firewall client
actually has a new button that configures IE (sets the proxy settings
and installs a dll to run on start (of IE)). I think it's the later
that checks the proxy settings are set.
So yeah, it's meant to be that way.
Are the users members of the Internet group?
--
Duncan- Hide quoted text -
- Show quoted text -

Thank you for the help. Yes, the Users are members of: "BackOffice
Internet Users". Using both Firewall client & Proxy settings.

In ISA Management, there was already an "Allow" Protocol Rule for "All
IP Traffic" but I created a separate rule for just the FTP-related
Protocol Definitions --did not work. I did restart the ISA Service to
be sure & I had disabled any FTP IP Packet Filters.

Note, if I enable the FTP Packet Filters, and attempt to go to the FTP
site I am testing, from the Server itself I can get the FTP USername/
Password prompt. At the users I get the HTTP Proxy 502 error
concerning Logon failure (12015).

So, if I add the login credentials to the FTP URL I can get to the FTP
site from the client. Such as ftp://username:***@ftp.website.com.
Why is this? So if I remove the Proxy settings from the clients, I do
get the username/password prompt at the FTP site.

Thanks again!

Thanks again.
Thanks

c***@gmail.com

2007-12-04 00:06:37 UTC

Permalink

Post by c***@gmail.com

Post by Duncan McC
In article <5879588e-68f6-4621-b18d-a62291b7ac32
@l1g2000hsa.googlegroups.com>, ***@gmail.com says...

Post by c***@gmail.com
On Dec 3, 1:38 pm, "Cris Hanna [SBS-MVP]"

We are currently using both the Firewall Client and the Proxy Server
and the workstations are logged into the domain, though I am trying to
recall why we ever set the Proxy settings to begin with. Like I
stated, the prompt for Username/Password happens very infrequently.
However, when the user does get the prompt and we remove the proxy
settings, the webpage displays fine. The same page may sometimes
display fine with the proxy settings.Or, with proxy settings we
sometimes get an error at the Windows Update site--but if removed we
do not get an error.
I guess we are just trying to determine which apps we use may need a
proxy setting--do you have an example??

There are many apps that will use IE's proxy settings - can't think of
one off the top of my head though :)
I maintain one SBS 2000 network (changing this week to 2003), and I've
always used the (SBS) firewall client and proxy settings for ISA.
Of note, in SBS 2003 Premium (w' ISA Server) the SBS firewall client
actually has a new button that configures IE (sets the proxy settings
and installs a dll to run on start (of IE)). I think it's the later
that checks the proxy settings are set.
So yeah, it's meant to be that way.
Are the users members of the Internet group?
--
Duncan- Hide quoted text -
- Show quoted text -

Thank you for the help. Yes, the Users are members of: "BackOffice
Internet Users". Using both Firewall client & Proxy settings.
In ISA Management, there was already an "Allow" Protocol Rule for "All
IP Traffic" but I created a separate rule for just the FTP-related
Protocol Definitions --did not work. I did restart the ISA Service to
be sure & I had disabled any FTP IP Packet Filters.
Note, if I enable the FTP Packet Filters, and attempt to go to the FTP
site I am testing, from the Server itself I can get the FTP USername/
Password prompt. At the users I get the HTTP Proxy 502 error
concerning Logon failure (12015).
So, if I add the login credentials to the FTP URL I can get to the FTP
Why is this? So if I remove the Proxy settings from the clients, I do
get the username/password prompt at the FTP site.
Thanks again!
Thanks again.
Thanks- Hide quoted text -
- Show quoted text -

Note: With Proxy settings and Firewall client installed, if I use
Windows Explorer, instead of IE7, I get the username/password prompt
as I would expect.

I have recently read that this is a problem with IE7, but not IE6???
In IE7 advanced properties, I have checked "enable FTP folder view"
and unchecked use "passive ftp". I have played with these settings in
differnet configurations but still does not work.

So I am now thinking that this is a problem with IE7. I have IE6 on my
server so maybe that is why IT is working??? I have no cliet with IE6.

Duncan McC

2007-12-05 21:05:59 UTC

Permalink

In article <45601790-4ff0-4a05-8dbd-

Post by c***@gmail.com

Post by Duncan McC
In article <5879588e-68f6-4621-b18d-a62291b7ac32
@l1g2000hsa.googlegroups.com>, ***@gmail.com says...

Post by c***@gmail.com
On Dec 3, 1:38 pm, "Cris Hanna [SBS-MVP]"

We are currently using both the Firewall Client and the Proxy Server
and the workstations are logged into the domain, though I am trying to
recall why we ever set the Proxy settings to begin with. Like I
stated, the prompt for Username/Password happens very infrequently.
However, when the user does get the prompt and we remove the proxy
settings, the webpage displays fine. The same page may sometimes
display fine with the proxy settings.Or, with proxy settings we
sometimes get an error at the Windows Update site--but if removed we
do not get an error.
I guess we are just trying to determine which apps we use may need a
proxy setting--do you have an example??

There are many apps that will use IE's proxy settings - can't think of
one off the top of my head though :)
I maintain one SBS 2000 network (changing this week to 2003), and I've
always used the (SBS) firewall client and proxy settings for ISA.
Of note, in SBS 2003 Premium (w' ISA Server) the SBS firewall client
actually has a new button that configures IE (sets the proxy settings
and installs a dll to run on start (of IE)). I think it's the later
that checks the proxy settings are set.
So yeah, it's meant to be that way.
Are the users members of the Internet group?
--
Duncan- Hide quoted text -
- Show quoted text -

Thank you for the help. Yes, the Users are members of: "BackOffice
Internet Users". Using both Firewall client & Proxy settings.
In ISA Management, there was already an "Allow" Protocol Rule for "All
IP Traffic" but I created a separate rule for just the FTP-related
Protocol Definitions --did not work. I did restart the ISA Service to
be sure & I had disabled any FTP IP Packet Filters.
Note, if I enable the FTP Packet Filters, and attempt to go to the FTP
site I am testing, from the Server itself I can get the FTP USername/
Password prompt. At the users I get the HTTP Proxy 502 error
concerning Logon failure (12015).
So, if I add the login credentials to the FTP URL I can get to the FTP
Why is this? So if I remove the Proxy settings from the clients, I do
get the username/password prompt at the FTP site.
Thanks again!
Thanks again.
Thanks- Hide quoted text -
- Show quoted text -

Note: With Proxy settings and Firewall client installed, if I use
Windows Explorer, instead of IE7, I get the username/password prompt
as I would expect.
I have recently read that this is a problem with IE7, but not IE6???
In IE7 advanced properties, I have checked "enable FTP folder view"
and unchecked use "passive ftp". I have played with these settings in
differnet configurations but still does not work.
So I am now thinking that this is a problem with IE7. I have IE6 on my
server so maybe that is why IT is working??? I have no cliet with IE6.

Haven't had any probs using FTP from IE6 or & myself.

An easy way to config ISA for FTP is use the ICW (Internet Connection
Wizard) - and don't change anything but the ISA filters, tick the FTP
options (amoung your other options), and you should have access.

NB: you'll need to config any othe custom ISA filter via ISA management
itself - as the wizard will leave them there, but turn them off (ie
you'll need to turn back on any custom filters).

--
Duncan