Avatar of jakobmarkussen
Flag for Afghanistan asked on

TMG web proxy

Hi all

When I'm putting TMG proxy settings like http://proxy:8080/wpad.dat in client IE no internet is available...

TMG log show that clients try to connect to http://"RRAS_IP":8080 ...

I have check NIC binding order and Internal is on top.. RRAS in bottom.

Any ideas on how to get the clients not to connect to TMG RRAS IP's ??

Microsoft Forefront ISA ServerWindows NetworkingNetworking

Avatar of undefined
Last Comment

8/22/2022 - Mon

I found this in wpad:

DirectNames=new MakeNames();
function MakeProxies(){
this[0]=new Node("",1443312282,1.000000); should be ..

So I found this:

After doing a little digging, I've found that this is actually a known issue with TMG.  If changing the binding order of the Network Interfaces doesn't help...either of the following can help with this issue.

1. Change to a static range of addresses for the VPN client.


2. Run the script found at the following link.  The blog references ISA 2006, but the script does work on TMG as well.  This script will force TMG to use it's fully qualified domain name in the autoconfig script (instead of IP).  


Some things to note before trying this script.
-It will restart the Firewall service, so you may want to try it afterhours.
-It may take a few minutes for the change to apply.
-Verify TMG's FQDN and make sure that internal clients will resolve this name to before running the script.

Richard Barker (MSFT)

Will it be "safe" to run this script on TMG?
Keith Alabaster

View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.

Ok i will give it a go. Thanks. Could i ask why you don't use wpad?
Keith Alabaster

Sure - we use a .pac file which we use through GPO. Like a wpdat entry, it only operates when on the LAN and ignored when laptop users etc go off-site. The plus is that it is applied when VPN users connect.
Your help has saved me hundreds of hours of internet surfing.

When I'm putting TMG proxy settings like http://proxy:8080/wpad.dat in client IE no internet is available...

Get rid of the "8080".
Change it to http://proxy/wpad.dat,...
In fact you should create a CNAME entry in DNS called "wpad" and point it at the A Record of the ISA Server.  So the url becomes:
Then create the Option 252 "WPAD" in DHCP using that same URL.
This way Autodetection will work with both DNS and DHCP instead of DHCP only.
The Browser will not require any settings at all except enabling the first Checkbox for Autodetection.

WPAD is not published on 8080,...it is published on 80.   Yes, there are Technet articlaes that say "8080",...yes, they are wrong,...yes, I have told MS about it multiple times,...no they haven't done anything about it,...it falls on deaf ears.

"8080" is used for Web Request from Web Proxy Clients,....not WPAD.

Keith Alabaster

Just for reference, I used to use 8080 for mine but no users were happy with the unfortunate delay that using the Auto detect option can introduce.
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.

Thanks. I'll look at port 80 instead.

Just for reference, I used to use 8080 for mine but no users were happy with the unfortunate delay that using the Auto detect option can introduce.

That left you with two things at once trying to listen on 8080.  Normal browser web requests are sent to ISA/TMG on 8080.  Maybe that was the cause of the delay.  My WPAD process happens in the "blink of an eye", keeping everything on the defaults.

Oh, wait...you were using a PAC file?  So it was stored on a different "web server" instead of the ISA/TMG,...that should have been ok.

There was an IE patch out that was supposed to fix the unreasonable autodetect delay.  I had to apply it on a few machines in the past,..but haven't seen the problem now in over a year.
This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.


No it was keith_alabaster that used PAC file...
I use (or try to use) wpad.

I tried running the script by Richard Barker on a test TMG server, and it seems to work.
I will change to port 80 as you mention.

By the way - publishing by DNS wouldn't that be a problem on clients in branch offices behind another TMG?

Only if they also are set to use WPAD too.   WPAD is global for everyone using the same AD/DNS structure.   If you have "exceptions" to that then you would continue to let the bulk of the Clienta use WPAD normally and then for the smaller groups of exceptions they would not use WPAD (disable the first auto detect checkbox in IE) but would still use proxy autodetection (enable only the second autodetect checkbox in IE,...the one that lets you give it a static URL to the script)

Remember that WPAD and Proxy Autodetection are two separate things.  WPAD autodetects the Script, not the Proxy,....it is the Script that then detects the proxy afterwards.