TMG web proxy

I found this in wpad:

DirectNames=new MakeNames();
cDirectNames=3;
HttpPort="8080";
cNodes=1;
function MakeProxies(){
this[0]=new Node("10.45.205.199",1443312282,1.000000);

10.45.205.4 should be 10.45.205.4 ..

So I found this:

After doing a little digging, I've found that this is actually a known issue with TMG.  If changing the binding order of the Network Interfaces doesn't help...either of the following can help with this issue.

1. Change to a static range of addresses for the VPN client.

...or...

2. Run the script found at the following link.  The blog references ISA 2006, but the script does work on TMG as well.  This script will force TMG to use it's fully qualified domain name in the autoconfig script (instead of IP).  


http://blogs.technet.com/isablog/archive/2008/06/26/understanding-by-design-behavior-of-isa-server-2006-using-kerberos-authentication-for-web-proxy-requests-on-isa-server-2006-with-nlb.aspx
 

Some things to note before trying this script.
-It will restart the Firewall service, so you may want to try it afterhours.
-It may take a few minutes for the change to apply.
-Verify TMG's FQDN and make sure that internal clients will resolve this name to 192.168.100.1 before running the script.

Regards,
Richard Barker (MSFT)

Will it be "safe" to run this script on TMG?

Ok i will give it a go. Thanks. Could i ask why you don't use wpad?

Sure - we use a .pac file which we use through GPO. Like a wpdat entry, it only operates when on the LAN and ignored when laptop users etc go off-site. The plus is that it is applied when VPN users connect.

When I'm putting TMG proxy settings like http://proxy:8080/wpad.dat in client IE no internet is available...

Get rid of the "8080".
Change it to http://proxy/wpad.dat,...
In fact you should create a CNAME entry in DNS called "wpad" and point it at the A Record of the ISA Server.  So the url becomes:
http://wpad.AD-domain.loc/wpad.dat
Then create the Option 252 "WPAD" in DHCP using that same URL.
This way Autodetection will work with both DNS and DHCP instead of DHCP only.
The Browser will not require any settings at all except enabling the first Checkbox for Autodetection.

WPAD is not published on 8080,...it is published on 80.   Yes, there are Technet articlaes that say "8080",...yes, they are wrong,...yes, I have told MS about it multiple times,...no they haven't done anything about it,...it falls on deaf ears.

"8080" is used for Web Request from Web Proxy Clients,....not WPAD.

Here's the whole story:

http://phillipwindell.wordpress.com/tech-pages/isatmg/wpad-setup/

Just for reference, I used to use 8080 for mine but no users were happy with the unfortunate delay that using the Auto detect option can introduce.

Thanks. I'll look at port 80 instead.

Just for reference, I used to use 8080 for mine but no users were happy with the unfortunate delay that using the Auto detect option can introduce.

That left you with two things at once trying to listen on 8080.  Normal browser web requests are sent to ISA/TMG on 8080.  Maybe that was the cause of the delay.  My WPAD process happens in the "blink of an eye", keeping everything on the defaults.

Oh, wait...you were using a PAC file?  So it was stored on a different "web server" instead of the ISA/TMG,...that should have been ok.

There was an IE patch out that was supposed to fix the unreasonable autodetect delay.  I had to apply it on a few machines in the past,..but haven't seen the problem now in over a year.

Hi..

No it was keith_alabaster that used PAC file...
I use (or try to use) wpad.

I tried running the script by Richard Barker on a test TMG server, and it seems to work.
I will change to port 80 as you mention.

By the way - publishing by DNS wouldn't that be a problem on clients in branch offices behind another TMG?

Only if they also are set to use WPAD too.   WPAD is global for everyone using the same AD/DNS structure.   If you have "exceptions" to that then you would continue to let the bulk of the Clienta use WPAD normally and then for the smaller groups of exceptions they would not use WPAD (disable the first auto detect checkbox in IE) but would still use proxy autodetection (enable only the second autodetect checkbox in IE,...the one that lets you give it a static URL to the script)

Remember that WPAD and Proxy Autodetection are two separate things.  WPAD autodetects the Script, not the Proxy,....it is the Script that then detects the proxy afterwards.