Proxy Server

Proxy supports both inbound and outbound packet filtering. Unlike other packet-filtering firewalls, Proxy dynamically determines which packets can be passed through to the internal network's circuit and application layer proxy services. Individual packet filters are configured to prevent packets from being passed through Proxy except for the ones specified. Rather than forcing you to manually predefine and permanently open a set of ports for different applications, this feature opens ports automatically only as needed, then closes the ports when the communication ends. This approach minimizes the number of exposed ports in either direction and provides a high level of hassle-free security for your network.

SOCKS is a cross-platform mechanism that establishes secure communications between client and server computers. The Socks Proxy service supports SOCKS version 4.3a and allows users transparent access to the Internet by means of Proxy Server. The Socks Proxy service extends the redirection provided by the WinSock Proxy service to non-Windows platforms. It uses TCP/IP and can be used for Telnet, FTP, Gopher, and HTTP. The Socks Proxy service does not support applications that rely on the UDP protocol.

The Web Proxy service supports proxy requests from any browser that is compatible with the standard CERN proxy protocol, such as Microsoft Internet Explorer or Netscape Navigator. You can use a computer that runs any operating system, such as Windows 95, NT, Macintosh, or UNIX. The Web Proxy service supports all popular Internet browsers and the Hypertext Transport Protocol (HTTP), Gopher, and File Transfer Protocol (FTP) protocols. Also, the Web Proxy service supports the HTTP-S protocol for secure sessions by using Secure Socket Layer (SSL) connections.

The WinSock Proxy service makes a Windows Sockets-compatible client application, such as Telnet, mail, news, NetShow, RealAudio, or IRC, perform as if it were directly connected to the Internet. The client application makes Windows Sockets API calls to communicate with an application running on an Internet-based computer. The WinSock Proxy components redirect the necessary APIs to the Proxy Server computer, thus establishing a communication path from the internal application to the Internet application through the Proxy Server computer. The following illustration shows the communication path for the WinSock Proxy service.

SOCKS is a cross-platform mechanism that establishes secure communications between client and server computers. The Socks Proxy service supports SOCKS version 4.3a and allows users transparent access to the Internet by means of Proxy Server. The Socks Proxy service extends the redirection provided by the WinSock Proxy service to non-Windows platforms. It uses TCP/IP and can be used forTelnet, FTP, Gopher, and HTTP. The Socks Proxy service does not support applications that rely on the UDP protocol.

Proxy Server Setup installs a default set of predefined protocol definitions on the server for the WinSock Proxy service. These appear under Protocol on the WinSock Proxy or Socks Proxy Protocol tab. You are not limited to these predefined protocol definitions, nor are you restricted to Windows Sockets applications that work with these predefined protocol definitions. You use the Protocols tab to add protocol definitions that support additional Windows Sockets applications. The default port for HTTP is Port 80.

MS Proxy Server uses TCP/IP or IPX/SPX protocols to communicate with clients on your network. If you have one of these protocols already installed for all clients on your network, your network is ready for Microsoft Proxy Server. If you have a small network that is currently using NetBEUI only, you need to enable one of these other protocols for your network clients to have proxy access.

To select appropriate bandwidth connections for your network, you need to examine peak-level demands created by all of your network users who access the Internet. In most cases, users who browse graphic-intensive sites consume most of the available bandwidth. With the object caching capabilities and domain filtering features available in Microsoft Proxy Server, you may be able to reduce your actual bandwidth requirements by caching frequently accessed sites locally, or by restricting access to some graphic-intensive sites.

Reverse hosting takes publishing to the next logical step by maintaining a list of internal server computers (not just Web servers) that have permission to publish to the Internet, thereby allowing Proxy Server to listen and respond on behalf of multiple servers that are located behind it. Proxy Server maintains a mapping table to allow multiple server computers to publish to the Internet by means of a single IP address securely. To the Internet client, the process is transparent-there is no indication that the request is being passed through Proxy Server first before being forwarded to the applicable Web server. Proxy Server merely maps and redirects the incoming URL to the appropriate location.

Reverse proxying is the ability to listen to incoming requests for an internal Web (HTTP) server computer and respond on behalf of that server. In this way, an insecure server is made to "look" secure. Reverse proxying can be thought of as "inverse chaining" in that a request is forwarded downstream to the Web server located behind the Proxy Server computer.

If you have installed RAS and configured an initial port for dial-out use after Proxy Server was installed, check that port usage is set for Dial Out Only. If Dial Out and Receive Calls or Receive Calls Only is selected, the server is configured as a RAS server. In almost all cases, RAS should be reconfigured for RAS client use (to dial out only).

In the Local Address Table Configuration dialog box, review the entries in Internal IP ranges. To add a single IP address to the list, under Edit, type the same address in both From and To, and then click Add.

The Mspclnt.ini file contains client configuration information. The master copy of the Mspclnt.ini file is created during Microsoft Proxy Server Setup and is stored in the C:\Msp\Clients directory on the server computer. Every Microsoft Windows client receives a copy of the Mspclnt.ini file, which is stored in the Mspclnt directory on the client computer. The default permissions on the share mcpclnt (folder: C:\Msp\Clients) on the server is Everyone: Read; however the default permissions of the folder mspclnt on the client is Everyone: Full Control.

The following software components are installed from the server on a Proxy client computer:
- The WinSock Proxy client application.
- A shared client configuration file, Mspclnt.ini.
- A shared client Local Address Table (LAT) file, Msplat.txt.

All three services offered by Proxy 2.0 (Web Proxy, WinSock Proxy and Web Proxy, support TCP. UDP, however, is supported only by Web and WinSock Proxy.

Providing transparent access from an internal or private network to the public or external network while masking or protecting the internal network.

By running as an ISAPI application, Proxy Server benefits from the functional and performance features of IIS. One example is the Web server's support for HTTP Keep-Alives. Keep-Alives is a feature that, when supported by both browser and server, allows TCP connections to remain intact after a request and response are completed. This significantly improves performance if another request is made from the same client to the same server within a time limit for connections. Support for Keep-Alives requires that the Web server be able to return the byte size of responses to clients, and that timeouts are used by both the client and the server so as to efficiently manage Windows Sockets connections.

Content cache servers typically provide regular or passive caching. That is, the content cache server reacts to a specific user request for content. As the request is being fulfilled and the information passed through to the user, the content cache server will determine if the content is cache-able. If it is cache-able content and if there's room in the cache, the server will store it in the cache. Microsoft Proxy Server can perform passive caching.

MS Proxy Server 2.0 provides both distributed and hierarchical caching. Distributed caching is accomplished by linking multiple Proxy Server computers together to form an array. All array members communicate with each other in a peer-to-peer fashion and maintain their own array membership table. Hierarchical caching, also known as chaining or cascaded proxying, is also accomplished by linking multiple Proxy Server computers together. Individual computers, arrays, or any combination thereof can be chained. Chained Proxy Server computers communicate in an upstream, hierarchical fashion, with the Proxy Server computer closest to a client computer as the most downstream computer, and the Proxy Server computer connected to the Internet as the most upstream computer.

With passive caching, all objects returned to Proxy Server by Internet servers that can be cached are stored in the cache. Proxy Server calculates a Time-To-Live (TTL) for all objects in the cache. When an object's TTL has expired, the next request for the object is serviced from the Internet instead of the cache.

With active caching, the freshness and availability of popular objects is ensured. Active caching automatically goes out to the Internet for an object, without client prompting, when the TTL has expired or is near expiration. Internet objects are subject to active caching on the basis of their popularity relative to their rate of change. Additionally, the active caching algorithm incorporates calculations of current server load in order to process requests to the Internet at times of low usage. During heavy usage periods, URLs are automatically updated only if they are within a minute or so of expiring. During light usage periods, URLs are updated if they are at least 50 percent expired. As such, active caching usually takes place during non-business hours or during brief dips in network activity during business hours. It does not stop an URL from being updated before it expires, even during the busiest time of the day.

Active caching works as a superset to passive caching. Typically, during passive caching, an object is placed in the cache and a TTL expiration value is associated with that object. During this TTL, all requests for the object are serviced from the cache without generating traffic back to the upstream Web Server. After the TTL has expired, subsequent client requests for the object generate traffic to and from the Web Server. The response from the Server is stored in the cache and a new TTL is calculated. Active caching augments this system by having the server automatically generate requests for a specified subset of objects.

Windows Sockets is a mechanism for interprocess communication between network applications running on the same computer, or on different computers connected using a local area network (LAN) or wide area network (WAN). It defines a set of standard APIs that an application uses to communicate with one or more applications, usually across a network.

The Windows Sockets APIs support:
- Initiating an outbound connection for a client application.
- Accepting an inbound connection for the server application.
- Sending and receiving data on a client/server connection.
- Terminating a client/server connection.

With dynamic packet filtering, it is no longer necessary for the administrator to explicitly unbind specific services from the external network adapter of Proxy Server. Packets can now be automatically blocked from reaching those services, regardless of whether they are bound or not. Ports are automatically opened for transmit, receive, or both operations. Ports are then immediately closed after a connection has been terminated by any of the Proxy Server services. This offers a high degree of security with minimal administration required-the Web Proxy, WinSock Proxy, and Socks Proxy services do all the work. This minimizes the number of open ports and the duration of time that a port is open. For a finer level of control, you can manually configure static packet filters through the user interface, as described in the following procedures. If you run applications that access the Internet on the same computer that is running Proxy Server, you need to configure static filters.

With dynamic packet filtering, it is no longer necessary for the administrator to explicitly unbind specific services from the external network adapter of Proxy Server. Packets can now be automatically blocked from reaching those services, regardless of whether they are bound or not.

Proxy Server can also issue alerts for specific events, such as for dropped packets or packets sent to an unused service port. Alerts can be sent to a log file, to the NT system event log, as an e-mail message, or any combination thereof.

Microsoft Proxy Server version 2.0 offers numerous enhancements, improvements, and new features. · Array-based content caching · Chain-based content caching · Cache Array Routing Protocol (CARP) · Dynamic packet filtering · Packet alerts and logging · Proxy-to-proxy authentication · Reverse proxying · Server proxying · SOCKS version 4.3a support · Virtual bundling · Command-line administration · Array administration. · Client configuration scripts · Configuration backup and restore · Hypertext Transport Protocol (HTTP) version 1.1 support · Client configuration scripts.

Reverse proxying is the ability to listen to incoming requests for an internal Web (HTTP) server computer and respond on behalf of that server. In this way, an insecure server is made to "look" secure. Reverse proxying can be thought of as "inverse chaining" in that a request is forwarded downstream to the Web server located behind the Proxy Server computer. Reference: Proxy Server Installation and Administration Guide; Configuring Multiserver Environments Exam Skill Being Measured: Planning: Choose a secure access strategy for various situations. Access includes outbound access by users to the Internet and inbound access to your Web site.

Microsoft Windows NT Server version 4.0, Microsoft Internet Information Server (IIS) version 3.0 (or later), and Service Pack 3 (or later) must be installed before you can install Proxy Server. An NTFS volume is required only if you are caching and RAS Services must be installed if a dial-up connection is used.

If you use Netscape Navigator to access an IIS server that uses Windows NT challenge/response password authentication, a dialog box appears that requests your user name and password. After you enter the correct user name and password, you see the message <> Even though Netscape Navigator prompts you for a user name and password, it does not support Windows NT challenge/response password authentication. To correct this problem, use Anonymous access or Basic user authentication in Internet Information Server, or upgrade clients to Internet Explorer version 2.0 or later.

MS Proxy server allows you to specify Primary and Backup routes. The Backup route is completely functional and provides redundancy in case the Primary route fails. Switching between the Primary and Backup is an automatic routine. If the Primary Proxy malfunctions, the Backup Proxy Server will query the unresponsive Primary until it becomes available, and then automatically relinquishes control to the Primary.

To utilize DNS Round-Robin services for load balancing on your MS Proxy Servers, specify an appropriate client configuration file on each workstation. Client information is stored in the MSPCLNT.INI file.

To utilize DNS Round-Robin services for load balancing on your proxy servers, specify an appropriate clinet configuration file on each workstation. Client information is stored in the MSPCLNT.INI file. In this question, typographical errors make the DNS entries invalid.

The WinSock Proxy service for Proxy Server does not support Windows for Workgroups clientsusing IPX.

To configure the client web browser to function with MS Proxy server, either use the browser's own configuration interface or, if you are using IE 4.0, run the Proxy Server Client Setup Program. Since Windows 3.x clients do not use IE 4.0, manual configuration of the client is required.

To monitor disk activity, log on as a member of the Administrators group and activate disk counters from a command prompt with the diskperf -y command. Diskperf can be set for the local machine, or a remote computer with a UNC name. Be sure to reboot the computer after activating the disk counters, or counters will still register 0.

To monitor disk activity, log on as a member of the administrators group and activate disk counters from a command prompt with the diskperf command. Diskperf can be set for the local machine, or a remote computer with a UNC name. Be sure to reboot the computer after activating the disk counters, or counters will still register 0.

For optimal performance, allow 100MB of free disk space + 0.5MB for each proxy client for the proxy cache.

For optimal performance, allow 100MB of free disk space + 0.5MB for each proxy client for the proxy cache.

For optimal performance, allow 100MB of free disk space + 0.5MB for each proxy client for the proxy cache.

With MS Proxy Server 2.0, you only need to specify a Domain address and not the Domain and IP address in the Domain filter. MS Proxy Server supports DNS lookups and DNS reverse resolution. MS Proxy Server 1.x required that you place both the Domain and Address for a Filter.

The MS Web Proxy Service Properties dialog box includes choices for Active and Passive caching as well as advanced configuration options. Only Web Proxy supports Caching!

The MS Web Proxy Service Properties dialog box includes choices for Active and Passive caching as well as advanced configuration options. Only Web Proxy supports Caching!

Unlike Proxy Server 1.0, Proxy Server 2.0 requires an NTFS partition to store cached information. If your server only contains FAT partitions, sue the convert command from a command prompt. The syntax is: convert : /fs:NTFS

Unlike Proxy Server 1.0, Proxy Server 2.0 requires an NTFS partition to store cached information. If your server only contains FAT partitions, issue the convert command from a command prompt. The syntax is: convert : /fs:NTFS

Setting the cache size to 0 does not allow any storage space for cached information. Any previously cached information will be deleted, clearing the cache. If the cache size is reduced for a drive or partition, some info may be deleted. Increasing the cache size allows for additional storage without affecting current data.

The Advanced Cache Policy dialog box allows you to set the Object Time To Live (TTL) for HTTP caching and FTP caching. HTTP options include 0 or a percentage of the time last modified information provided by the source. The FTP option allows you to type in a number of minutes to expire before objects are updated.

The "Cache Expiration Policy" section of the Web Proxy Server properties sets the "Freshness" of objects in the cache. In other words, the expiration options determine whether a local or remote copy is used. These options include: 1. Updates are more important, 2. Equal importance, 3. Fewer network accesses are more important. These options provide freshness of information with performance. In this scenario, accuracy of information is required. Selecting "Updates are more important" sacrifices user response for more frequent downloads.

In this scenario, information is updates at the remote site in the evening. During the remainder of the day, information is stable. Active caching processes information more quickly by downloading data during off-peak hours when network traffic is reduced. The cache manager automatically generates a request to update the infromation when the TTL is near expiration. Options for active caching include faster user response, equal importance, or fewer network accesses. To support a large number of clients with relatively stable information optimally, allow for more pre-fetching of information by selecting "Faster User Response."

To improve performance, use Hierarchical Caching or Chaining. Individual computers, arrays, or any combination thereof can be chained. Chained Proxy Server computers balance the load over several proxy servers by allowing them to communicate in an upstream, hierarchical fashion. The Proxy Server computer closest to a client computer is the most downstream computer, and the Proxy Server computer connected to the Internet is the most upstream computer. If an array of servers is chained, cache performance can be increased by distributing the load both across an array and hierarchically in a chain. Chaining is used to control routing requests and is supported by DNS, while an array is used for fault tolerance and security. Round-Robin server selection can also improve performance by allowing requests to be answered by the least busy server. If the information is already contained in the array, the array is the fastest method; if not already in the array, an upstream retrieval of information is faster. DNS round-robin is often used to add additional load balancing support to currently configured arrays.

Array synchronization can only remove application level protocols such as HTTP, FTP, POP or RealAudio. Synchronization cannot remove system level protocols. IPX/SPX is a system level protocol. Tricky!

TCP is a connection-oriented protocol. For each TCP connection the WinSock Proxy Service establishes a connection between the client application and the WinSock Proxy Service, and another connection between the WinSock Proxy Service and the Internet Application. All support TCP, only WinSock supports UDP.

The WinSock Proxy Service utilizes both an internal and an external (Internet) connection interface. When the UDP protocol is setup, the WinSock Proxy Service binds an UDP socket to a local port for the client and an Internet IP address.

The WinSock Proxy Service does not support IPX for 16bit applications. In this scenario, the Windows 95 clients are using 16bit VLM's. Update the VLM's to 32bit protected mode 95 drivers like "Microsoft Client fopr NetWare" or "Novell IntranetWare 32 Client"

With IPX, domain credential validation is required for each Windows Sockets application that is launched if there is not a currently active Windows socket application. Minimizing an application allows you to connect to other domain WinSock applications without revalidating the user account and password each time.

The WinSock Proxy Service or server application MUST have a valid user name and password to work with the Proxy Server. Setting the option to never expire eliminates this problem. By default, the Proxy Service creates an account called IUSR_. You have to grant appropriate permissions to this account.

The client MSPLAT.TXT file is automatically downloaded at regular intervals from the Proxy Server. If a client needs special configuration settings, create a LOCALLAT.TXT file in the MSPCLNT directory on the workstation. This enables to client to utilize both files.

The client MSPLAT.TXT file is automatically downloaded at regular intervals from the Proxy Server. If a client needs special configuration settings, create a LOCALLAT.TXT file in the MSPCLNT directory on the workstation. This enables to client to utilize both files.

To improve routing performance and update browser configurations, a JavaScript configuration file can be downloaded from the Proxy Server to the client computers each time a Web browser is opened.

The MS Proxy Server product needs to be purchased from Microsoft. This is a 1 time purchase. Client licenses are not required.

The MS Proxy Server product needs to be purchased from Microsoft. This is a 1 time purchase. Client licenses are not required.

To utilize client configuration scripts (JScripts) or Secure Sockets Layer (SSL) with NT Challenge / Response, you should use Internet Explorer 4.0 as your browser. If you want to use Netscape, select Basic Authentication. Option D would be the long term goal.