Configuring WPAD Support for ISA Firewall Web Proxy and Firewall Clients

[LEFT][CODE]http://www.isaserver.org/tutorials/Configuring-WPAD-Support-ISA-Firewall-Web-Proxy-Firewall-Clients.html[/CODE]


The Web Proxy Autodiscovery Protocol (WPAD) can be used to allow Web browsers and the Firewall client application to automatically discover the address of the ISA firewall. The client can then download autoconfiguration information from the firewall after the Web Proxy or Firewall client discovers the address.
WPAD solves the problem of automatically provisioning Web browsers. The default setting on Internet Explorer is to autodiscover Web proxy client settings. When this setting is enabled, the browser can issue a DHCPINFORM message or a DNS query to find the address of the ISA firewall from which it can download autoconfiguration information. This greatly simplifies Web browser setup so that it automatically uses the firewall to connect to the Internet.
The ISA firewall’s Firewall client application can also use the wpad entry to find the ISA firewall and download Firewall client configuration information.
In this articlewe will discuss the following procedures:

[LIST][*]Configure DHCP WPAD support[*]Configure DNS WPAD support[/LIST]
After the wpad information is entered into DHCP and DNS, Web Proxy and Firewall clients will not require manual configuration to connect to the Internet through the ISA firewall.
[CENTER][URL="http://www.amazon.com/exec/obidos/ASIN/1931836191/wwwshindernet-20"]
[/URL][/CENTER]
[B]Configure DHCP WPAD Support[/B]

The DHCP scope option number 252 can be used to automatically configure Web Proxy and Firewall clients. In order for the DHCP wpad method to work, the Web Proxy or Firewall client computer must be configured as a DHCP client, and the logged on user must be a member of the local administrators group or Power users group (for Windows 2000). On Windows XP systems, the Network Configuration Operators group also has permission to issue DHCP queries (DHCPINFORM messages).
[B]Note:
[/B]For more information about the limitations of using DHCP for autodiscovery for Internet Explorer 6.0, please see KB article [B]Automatic Proxy Discovery in Internet Explorer with DHCP Requires Specific Permissions[/B] at [url=http://support.microsoft.com/default.aspx?scid=kb;en-us;312864]Automatic Proxy Discovery in Internet Explorer with DHCP requires specific permissions[/url] However, if you’ve been good and upgraded to Windows XP SP2, this is no longer a problem. I assume that the problem remains “fixed” in Windows Vista, but I don’t know that for sure. I also assume that the Windows XP SP2 fix also enables Internet Explorer 7.0 to work correct without requiring administrator permissions.
Perform the following steps at the DHCP server to create the custom DHCP option:

[LIST=1][*]Open the [B]DHCP[/B] console from the [B]Administrative Tools[/B] menu and right click your server name in the left pane of the console. Click the [B]Set Predefined Options[/B] command.[*]In the [B]Predefined Options and Values[/B] dialog box, click the [B]Add[/B] button.[/LIST]
[B][IMG]http://www.isaserver.org/img/upl/image0041197305974116.jpg[/IMG]
Figure 1[/B]

[LIST=1][*]In the [B]Option Type[/B] dialog box, enter the following information:[/LIST]
[B]Name:[/B] wpad
[B]Data type:[/B] String
[B]Code:[/B] 252
[B]Description:[/B] wpad entry
Click [B]OK[/B].
[B][IMG]http://www.isaserver.org/img/upl/image0061197305974132.jpg[/IMG]
Figure 2[/B]

[LIST=1][*]In the [B]Value[/B] frame, enter the URL to the ISA firewall in the [B]String[/B] text box. The format for this value is:

[I][url]http://ISAServername:AutodiscoveryPort[/url] Number/wpad.dat

[/I]The default autodiscovery port number is TCP 80. You can customize this value in the [B]ISA Firewall console[/B]. We will cover this subject in more detail later in this document.

In the current example, enter the following into the [B]String[/B] text box:

[I][url]http://isalocal.msfirewall.org:80/wpad.dat[/url][/I]

Make sure to enter wpad.dat in all [I]lower case[/I] letters. For more information on this problem, please refer to KB article [URL="http://support.microsoft.com/default.aspx?scid=kb;en-us;307502"]"Automatically Detect Settings" Does Not Work if You Configure DHCP Option 252[/URL]

Click [B]OK[/B].[/LIST]
[B][IMG]http://www.isaserver.org/img/upl/image0081197306027491.jpg[/IMG]
Figure 3[/B]

[LIST=1][*]Right click the [B]Scope Options[/B] node in the left pane of the console and click the [B]Configure Options[/B] command.[*]In the [B]Scope Options[/B] dialog box, scroll through the list of [B]Available Options[/B] and put a checkmark in the [B]252 wpad[/B] checkbox. Click [B]Apply[/B] and then click [B]OK[/B].[/LIST]
[B][IMG]http://www.isaserver.org/img/upl/image0101197306027491.jpg[/IMG]
Figure 4[/B]

[LIST=1][*]The [B]252 wpad[/B] entry now appears in the right pane of the console under the list of [B]Scope Options[/B].[/LIST]
[B][IMG]http://www.isaserver.org/img/upl/image0121197306027507.jpg[/IMG]
Figure 5[/B]

[LIST=1][*]Close the [B]DHCP [/B]console.[/LIST]
At this point DHCP clients will be able to use DHCP wpad support to automatically discover the ISA firewall and subsequently autoconfigure itself. However, the ISA firewall must be configured to support publishing autodiscovery information, which we will do later in this article.
[B]Configure DNS WPAD Support[/B]

Another method that can be used to deliver autodiscovery information to Web Proxy and Firewall clients is DNS. You can create a wpad alias entry in DNS and allow browser clients to use this information to automatically configure themselves. DNS is a viable option, but you have to be aware that if you have multiple networks, each with it’s own ISA Firewall, then you’ll need to have different wpad entries for each network. While you can support multiple networks and multiple ISA Firewalls using DNS by taking advantage of netmask ordering, most companies perform to use DHCP wpad to support local networks, since they need to use local DHCP server anyway to assign local clients addressing information.
Name resolution is a pivotal component to making this method of Web Proxy and Firewall client autodiscovery work correctly. In this case, the client operating system must be able to correctly fully qualify the name [I]wpad[/I]. The reason for this is that the Web Proxy and Firewall client only knows that it needs to resolve the name wpad; it does not know what specific domain name it should append to the query to resolve the name wpad. We will cover this issue in detail later in this document.
[B]Note:
[/B]In contrast to the DHCP method of assigning autodiscovery information to Web Proxy and Firewall clients, you do not have the option to use a custom port number to publish autodiscovery information when using the DNS method. You must publish autodiscovery information on TCP 80 when using the DNS method.
You need to perform the following steps to configure DNS support for Web Proxy and Firewall client autodiscovery of the ISA firewall:

[LIST][*]Create the wpad entry in DNS[*]Configure the client to use the fully qualified wpad alias[*]Configure the client browser to use autodiscovery[/LIST]
[B]Create the Wpad Entry in DNS[/B]

The first step is to create a wpad alias entry in DNS. This alias (also known as a CNAME record) points to a Host (A) record for the ISA Server 2004 firewall. The Host (A) record resolves the name of the ISA Server 2004 firewall to the internal IP address of the firewall. I should note her that you don’t have to use a CNAME record, you can use an A record if you like, but CNAME records have some management advantages.
The Host (A) record must be created before you create the CNAME record. If you enable automatic registration in DNS, the ISA firewall’s name and IP address will already be entered into a DNS Host (A) record. If you have not enabled automatic registration, you will need to create the Host (A) record for the ISA firewall yourself.
In the following example, the ISA firewall has automatically registered itself with DNS because the internal interface of the ISA firewall is configured to automatically register with DNS and the DNS server is configured to accept unsecured dynamic registrations. In a production environment, I’d recommend that you only accept secure DNS registrations. This won’t be a problem for your ISA Firewall, since it should be a member of the domain for security reasons.
Perform the following steps on the DNS server on the domain controller on the internal network:

[LIST=1][*]Click [B]Start[/B] and select [B]Administrative Tools[/B]. Click the [B]DNS [/B]entry. In the [B]DNS[/B] management console, right click on the forward lookup zone for your domain and click the [B]New Alias (CNAME)[/B] command.[*]In the [B]New Resource Record[/B] dialog box, enter [B]wpad[/B] in the [B]Alias name (uses parent domain if left blank)[/B] text box. Click the [B]Browse[/B] button.[/LIST]
[B][IMG]http://www.isaserver.org/img/upl/image0141197306052616.jpg[/IMG]
Figure 6[/B]

[LIST=1][*]In the [B]Browse[/B] dialog box, double click on your server name in the [B]Records[/B] list.[/LIST]
[B][IMG]http://www.isaserver.org/img/upl/image0161197306052616.jpg[/IMG]
Figure 7[/B]

[LIST=1][*]In the [B]Browse[/B] dialog box, double click on the [B]Forward Lookup Zone[/B] entry in the [B]Records[/B] frame.[/LIST]
[B][IMG]http://www.isaserver.org/img/upl/image0181197306052616.jpg[/IMG]
Figure 8[/B]

[LIST=1][*]In the [B]Browse[/B] dialog box, double click on the name of your forward lookup zone in the [B]Records[/B] frame.[/LIST]
[B][IMG]http://www.isaserver.org/img/upl/image0201197306092788.jpg[/IMG]
Figure 9[/B]

[LIST=1][*]In the [B]Browse[/B] dialog box, select the name of the ISA firewall in the [B]Records[/B] frame. Click [B]OK[/B].[/LIST]
[CENTER][URL="http://www.amazon.com/exec/obidos/ASIN/1931836191/wwwshindernet-20"]
[/URL][/CENTER]
[B][IMG]http://www.isaserver.org/img/upl/image0221197306092788.jpg[/IMG]
Figure 10[/B]

[LIST=1][*]Click [B]OK[/B] in the [B]New Resource Record[/B] dialog box.[/LIST]
[B][IMG]http://www.isaserver.org/img/upl/image0241197306092804.jpg[/IMG]
Figure 11[/B]

[LIST=1][*]The CNAME (alias) entry appears in the right pane of the [B]DNS[/B] management console.[/LIST]
[B][IMG]http://www.isaserver.org/img/upl/image0261197306131851.jpg[/IMG]
Figure 12[/B]

[LIST=1][*]Close the [B]DNS Management[/B] console.[/LIST]
[B]Configure the Client to Use the Fully Qualified wpad Alias[/B]

The Web Proxy and Firewall client needs to be able to correctly resolve the name [I]wpad[/I]. Both the Web Proxy and Firewall client configurations are [I]not aware of the domain containing the wpad alias[/I]. The Web Proxy and Firewall client operating system must be able to provide this information to the Web Proxy and Firewall client.
DNS queries must be [I]fully qualified[/I] before the query is sent to the DNS server. A fully qualified request contains a host name and a domain name. The Web Proxy and Firewall client only know the [I]host name[/I] portion. The Web Proxy and Firewall client operating system must be able to provide the correct domain name, which it appends to the [I]wpad[/I] host name, before it can send a DNS query to the DNS server.
There are a number of methods you can use to insure that a proper domain name is appended to [I]wpad[/I] before the query is sent to the DNS server. Two popular methods for doing this include:

[LIST][*]Using DHCP to assign a primary domain name[*]Configuring a primary domain name in the client operating system’s network identification dialog box.[/LIST]
We already configured a primary DNS name to assign DHCP clients when we configured the DHCP scope. The following steps demonstrate how to set the primary domain name to append to unqualified DNS queries:
[B]Note:
[/B]You do not need to perform these steps on the client machine on the Internal network in our example network. The reason for this is that the client is a member of the Active Directory domain on the internal network. However, you should go through the following steps to see how the primary domain name can be configured on non-domain member computers.

[LIST=1][*]Right click the [B]My Computer[/B] icon on the desktop and click the [B]Properties[/B] command.[*]In the [B]System Properties[/B] dialog box, click the [B]Network Identification[/B] tab. Click the [B]Properties[/B] button.[/LIST]
[B][IMG]http://www.isaserver.org/img/upl/image0281197306131851.jpg[/IMG]
Figure 13[/B]

[LIST=1][*]In the [B]Identification Changes[/B] dialog box, click the [B]More[/B] button.[/LIST]
[B][IMG]http://www.isaserver.org/img/upl/image0301197306131866.jpg[/IMG]
Figure 14[/B]

[LIST=1][*]In the [B]DNS Suffix and NetBIOS Computer Name[/B] dialog box, enter the domain name that contains your wpad entry in the [B]Primary DNS suffix of this computer[/B] text box. This is the domain name that the operating system will append to the wpad name before sending the DNS query to the DNS server. By default, the primary domain name is the same as the domain name the machine belongs to. If the machine is not a member of a domain, then this text box will be empty. Note the [B]Change primary DNS suffix when domain membership changes[/B] is enabled by default. In the current example, the machine is not a member of a domain.[/LIST]
Cancel out of each of the dialog boxes so that you do not configure a primary domain name at this time.
[B][B][IMG]http://www.isaserver.org/img/upl/image0321197306156413.jpg[/IMG]
Figure 15[/B][/B]
Note that if you have multiple domains and clients on your internal network that belong to multiple domains, then you will need to create wpad CNAME alias entries for each of the domains.
[B]Configure the Client Browser to Use Autodiscovery[/B]

The next step is to configure the browser to use autodiscovery. If you have not already done so, perform the following steps to configure the Web browser to use autodiscovery to automatically configure itself to use the ISA firewall’s Web Proxy service:

[LIST=1][*]Right click on the [B]Internet Explorer [/B]icon on the desktop and click [B]Properties[/B].[*]In the [B]Internet Properties[/B] dialog box, click the [B]Connections[/B] tab. Click the [B]LAN Settings[/B] button.[*]In the [B]Local Area Network (LAN) Settings[/B] dialog box, put a checkmark in the [B]Automatically detect settings[/B] checkbox. Click [B]OK[/B].[/LIST]
[B][IMG]http://www.isaserver.org/img/upl/image0331197306156413.gif[/IMG]
Figure 16[/B]

[LIST=1][*]Click [B]Apply[/B] and then click [B]OK[/B] in the [B]Internet Properties[/B] dialog box.[/LIST]
The next step is to configure the ISA firewall to publish autodiscovery information for autodiscovery Web Proxy and Firewall clients.
[B]Configuring the ISA Firewall to Publish Autodiscovery Information[/B]

The DHCP and DNS wpad entries are designed to point the Web proxy and Firewall client applications to the IP address and port that the ISA Firewall uses to provide autodiscovery information to the clients. However, by default autodiscovery publishing on the ISA Firewall is disabled. It’s your job to enable this setting on each ISA Firewall Network that contains Web proxy and Firewall clients.

[LIST=1][*]In the ISA Firewall console, expand the server name in the left pane of the console and then expand the [B]Configuration[/B] node in the left pane. Click on the [B]Networks[/B] node.[*]In the [B]Networks[/B] node, click on the [B]Networks[/B] tab in the middle pane of the console. Double click the ISA Firewall Network that you want to enable autodiscovery publishing. In this example, we’ll enable autodiscovery publishing for the default Internal ISA Firewall Network.[*]In the [B]Internal Properties[/B] dialog box, click on the [B]Auto Discovery[/B] tab. Put a checkmark in the [B]Publish automatic discovery information for this network[/B] checkbox. By default, the ISA Firewall will listen for requests from Web Proxy and Firewall clients on TCP port 80. If you’re using DHCP wpad entries, then you can change this port. However, if you use DNS based wpad support, then you must leave the value at its default, TCP port 80.[/LIST]
[B][IMG]http://www.isaserver.org/img/upl/image0351197306156429.jpg[/IMG]
Figure 17[/B]

[LIST=1][*]Click [B]Apply[/B] and then click [B]OK[/B].[*]Click [B]Apply [/B]to save the changes and update the firewall policy.[/LIST]
At this point you can close all browser windows and open them. The new settings will work at this point and the Web browsers will be able to get autoconfiguration information from the ISA firewall. For the Firewall clients, you can wait for about six hours for the update, or you can manually configure them to update their configuration. Right click on the Firewall client icon in the system tray and select the [B]Automatically detect ISA Server[/B] option and click [B]Detect Now[/B].
[B][IMG]http://www.isaserver.org/img/upl/image0371197306175226.jpg[/IMG]
Figure 18[/B]
[B][IMG]http://www.isaserver.org/img/upl/image0391197306175241.jpg[/IMG]
Figure 19[/B]
Click [B]OK[/B] to save the settings.
[CENTER][URL="http://www.amazon.com/exec/obidos/ASIN/1931836191/wwwshindernet-20"]
[/URL][/CENTER]
[B]Conclusion[/B]

In this article we discussed how to automatically configure the Web proxy and Firewall clients to use wpad entries to automatically discover the ISA Firewall and automatically configure themselves. We went over the two methods you an use for autodiscovery: DHCP and DNS. We also demonstrated how to configure the client to correctly qualify the unqualified wpad name and how to configure the ISA Firewall to publish autodiscovery information on the appropriate ISA Firewall Networks that contain clients that wish to use autodiscovery.

[/LEFT]