Configuring for ISA/TMG using non-Web-Proxy clients

Applies to

Web Filter v7.6

Web Security v7.6

In this topic

Overview

Firewall/Forefront TMG Client

SecureNAT clients

Configuring the ISAPI Filter plug-in

Overview

Note  Ensure that TCP/IP stacks are installed on all the client computers if protocols have been disabled on the SOCKS or WinSOCK proxy server, and sent through the normal proxy server for filtering by Websense software.

If you are using non-Web-Proxy clients with ISA Server 2004/2006 or Forefront TMG, additional configuration is required so that Websense software can filter Internet requests correctly. The term non-Web-Proxy clients refers to:

Firewall/Forefront TMG Client with the proxy server disabled

SecureNAT clients

Firewall/Forefront TMG Client

If you are using Firewall/Forefront TMG Client with ISA Server 2004/2006 or Forefront TMG, and the proxy server is enabled (default setting), Websense software filters Internet requests normally.

However, if the proxy server is disabled, Websense software cannot filter Internet requests without additional configuration.

Check the Firewall/Forefront TMG Client machine to see if the proxy server is disabled.

1.	Open the Firewall/Forefront TMG Client configuration screen, and select the Web Browser tab.

2.	View the Enable Web browser automatic configuration check box.

If it is marked, the proxy server is enabled. Websense software requires no additional configuration.

If it is cleared, the proxy server is disabled. See Configuring the ISAPI Filter plug-in for additional configuration steps.

 

Note  If the proxy server is disabled, then Websense software filters HTTP only; it will not be able to filter HTTPS.

SecureNAT clients

SecureNAT clients require that you configure the default gateway so that all traffic to the Internet is sent through ISA/TMG. If you need information about configuring and using SecureNAT clients, see your ISA/TMG documentation.

See Configuring the ISAPI Filter plug-in for additional configuration steps.

Configuring the ISAPI Filter plug-in

If you are using the ISA/TMG Firewall Client with the proxy server disabled, or SecureNAT clients, the ISAPI Filter plug-in must be configured to ignore requests going directly to the ISA/TMG and to filter only those requests going out to the Internet.

 

Note  If you are using the ISA/TMG Server Firewall Client with the proxy server disabled, then Websense software filters HTTP only; it will not be able to filter HTTPS.

1.	On the ISA/TMG machine, create a file called ignore.txt in the Windows system32 directory.

2.	Enter the host name or IP address of the ISA/TMG machine in the text file.

Host names must be entered in ALL CAPS. Entries that are not in all capital letters are not used.

3.	If the ISA/TMG machine hosts multiple Web sites, add the names of all the Web sites being hosted. For example: webmail.rcd.com.

If only one Web site is hosted, do not add it to this file.

4.	Restart the ISA/TMG machine.