How to get ISA 2006 Web Proxy to work with the Single Network Adapter template

Question

I need to test an issue with running our application behind a proxy server with different type of configurations, so I installed ISA 2006 Enterprise on a desktop computer. Since this computer only has a single network card and I want to start out easy, I chose the "Single Network Adapter" template. We have a internal NAT'ed network which is in the 10 range.

I have defined the internal network on the ISA server to be

10.XXX.YY.1 - 10.XXX.YY.255

I also have the Default rule which denies all traffic, but I've added the following Rule:

Policy - Protocols     - From             - To
Accept   HTTP            Internal           External
         HTTPS           Local Host         Internal
         HTTS Server                        Localhost

Then I configured Internet Explorer on a virutal machine running XP within virtualbox with Brigded network (gets same network address range as regular computers on our network) similar to this

_{(source: linglom.com)}

Instead of the server name I used the IP address. When I try to access a web page, this doesn't go through and I get the following log messages on the proxy server:

Original Client IP  Client Agent    Authenticated Client    Service Referring Server Destination Host Name  Transport   HTTP Method MIME Type   Object Source   Source Proxy    Destination Proxy   Bidirectional   Client Host Name    Filter Information  Network Interface   Raw IP Header   Raw Payload GMT Log Time    Source Port Processing Time Bytes Sent  Bytes Received  Cache Information   Error Information   Authentication Server   Log Time    Client IP   Destination IP  Destination Port    Protocol    Action  Rule    Result Code HTTP Status Code    Client Username Source Network  Destination Network URL Server Name Log Record Type
10.XXX.YY.174               -       TCP -   -                       -               24.08.2010 13:25:24 1080    0   0   0   0x0 0x0 -   24.08.2010 06:25:24 10.XXX.YY.174   10.XXX.YY.175   80  HTTP    Initiated Connection    MyHTTPAccess    0x0 ERROR_SUCCESS           Internal    Local Host  -   PROXYTEST   Firewall
10.XXX.YY.175               -       TCP -   -                       -               24.08.2010 13:25:24 2275    0   0   0   0x0 0x0 -   24.08.2010 06:25:24 10.XXX.YY.175   10.XXX.YY.175   80  HTTP    Initiated Connection        0x0 ERROR_SUCCESS           Local Host  Local Host  -   PROXYTEST   Firewall
10.XXX.YY.175               -       TCP -   -                       -               24.08.2010 13:25:25 2275    0   0   0   0x0 0x0 -   24.08.2010 06:25:25 10.XXX.YY.175   10.XXX.YY.175   80  HTTP    Closed Connection       0x80074e20 FWX_E_GRACEFUL_SHUTDOWN          Local Host  Local Host  -   PROXYTEST   Firewall
10.XXX.YY.175               -       TCP -   -                       -               24.08.2010 13:25:25 2276    0   0   0   0x0 0x0 -   24.08.2010 06:25:25 10.XXX.YY.175   10.XXX.YY.175   80  HTTP    Initiated Connection        0x0 ERROR_SUCCESS           Local Host  Local Host  -   PROXYTEST   Firewall
10.XXX.YY.175               -       TCP -   -                       -               24.08.2010 13:25:26 2276    0   0   0   0x0 0x0 -   24.08.2010 06:25:26 10.XXX.YY.175   10.XXX.YY.175   80  HTTP    Closed Connection       0x80074e20 FWX_E_GRACEFUL_SHUTDOWN          Local Host  Local Host  -   PROXYTEST   Firewall
10.XXX.YY.175               -       TCP -   -                       -               24.08.2010 13:25:26 2277    0   0   0   0x0 0x0 -   24.08.2010 06:25:26 10.XXX.YY.175   10.XXX.YY.175   80  HTTP    Initiated Connection        0x0 ERROR_SUCCESS           Local Host  Local Host  -   PROXYTEST   Firewall
10.XXX.YY.159               -       UDP -   -                       -               24.08.2010 13:25:26 68  0   0   0   0x0 0x0 -   24.08.2010 06:25:26 10.XXX.YY.159   255.255.255.255 67  DHCP (request)  Denied Connection   [Enterprise] Default rule   0xc004000d FWX_E_POLICY_RULES_DENIED            Internal    Local Host  -   PROXYTEST   Firewall
10.XXX.YY.166               -       UDP -   -                       -               24.08.2010 13:25:26 68  0   0   0   0x0 0x0 -   24.08.2010 06:25:26 10.XXX.YY.166   255.255.255.255 67  DHCP (request)  Denied Connection   [Enterprise] Default rule   0xc004000d FWX_E_POLICY_RULES_DENIED            Internal    Local Host  -   PROXYTEST   Firewall
0.0.0.0 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Yes Proxy       10.XXX.YY.175   TCP GET     Internet    -   -       -   Req ID: 096c76ae; Compression: client=No, server=No, compress rate=0% decompress rate=0%    -   -   -   24.08.2010 13:25:27 0   2945    2581    446 0x0 0x40        24.08.2010 06:25:27 10.XXX.YY.174   10.XXX.YY.175   80  http    Failed Connection Attempt   MyHTTPAccess        10061   anonymous   Internal    Local Host  http://www.vg.no/   PROXYTEST   Web Proxy Filter
10.XXX.YY.175               -       TCP -   -                       -               24.08.2010 13:25:27 2277    0   0   0   0x0 0x0 -   24.08.2010 06:25:27 10.XXX.YY.175   10.XXX.YY.175   80  HTTP    Closed Connection       0x80074e20 FWX_E_GRACEFUL_SHUTDOWN          Local Host  Local Host  -   PROXYTEST   Firewall

Answer 1

Using the Single Network Adapter template means that the Internal network is defined as 0-126.255.255.255, and 128-255.255.255.255.

Yep, that means that any non-localhost address is considered internal.

This semi-nerfs the ISA Firewall features in favour of getting it to do Web Proxy stuff.

Once you've got a Single Network Adapter configuration established, the next step is typically:

• Create a set of default Web Access rules using the Firewall Policy part of the Template wizard, or
• Just create an Allow/All Protocols/Internal/Internal/All Users (i.e. from Internal to Internal), which will set ISA up to do pretty much anything, without authentication.
  • of course, I'd suggest you not just allow all anywhere/anywhere, but some rulesets are that simple.
  • note it's not anywhere-anywhere - the ISA Server is still protected from the Internal network.
• Create a Web Chaining rule to forward requests to an upstream proxy
  • and potentially set SkipNameResolutionForAccessAndRoutingRules if you want to rely on that proxy's name resolution, especially if your internal proxy doesn't do Internet DNS or r-lookups quickly.

ISA has some documented limitations in its Single Network Adapter setup, but it does work.