Welcome

Welcome to Microsoft® Proxy Server.

Microsoft Proxy Server provides an easy, secure way to bring Internet access to every desktop in an organization.

Before You Begin

About This Book

What You Should Know

Finding Further Information

Microsoft AnswerPoint

Microsoft Service Advantage

Accessibility for People with Disabilities

Microsoft Proxy Server supports all Internet protocols, including WWW (HTTP), FTP, RealAudio (streaming audio), VDOLive (streaming video), IRC (Internet Relay Chat), and mail and news protocols. Support for Novell’s IPX/SPX transport means that deployment of TCP/IP on a private network is unnecessary. Internet sites can be accessed by Web browsers running on any operating system, and by all 16-bit and 32-bit Windows® Sockets applications, with no modifications to the applications.

For the latest information about Microsoft Proxy Server, browse our World Wide Web page at http://www.microsoft.com/proxy/.


Overview

What is the Internet?

What is TCP/IP?

What is the World Wide Web?

What is an Intranet?

What is an ISP?

What is a Proxy Server?

What is a Gateway?

What is a Client?

What is Microsoft Proxy Server?

What Does Setup Install?

© 1996 by Microsoft Corporation. All rights reserved.


Preinstallation Requirements

Hardware Requirements

Software Requirements

Before You Install

Server Security Checklist

Connecting the Server to the Internet

Before installing Microsoft Proxy Server, please review this entire chapter. It contains important information about installation requirements.


Server Installation

Installation Overview

What You Need to Know About the LAT

Setting the Web Proxy Listen-On Port

Installing Microsoft Proxy Server

Reviewing the Server Setup Log

Reinstalling Microsoft Proxy Server

Removing Microsoft Proxy Server

Installing Only the Administration Tool

Installing and Accessing the Documentation

Searching the Documentation


Server Features

Feature Summary

Web Proxy Service Features

WinSock Proxy Service Features


Server Administration

Server Administration Overview

Using Internet Service Manager

Putting Users in Windows NT Groups

Network Configuration

LAT Configuration

Dial-Up Support

Other Server Configuration Issues


Configuring the Web Proxy Service

Overview of Web Proxy Service Configuration

Setting Up Web Proxy Users

Controlling Web Proxy User Access to Internet Sites

Setting Up Caching of Internet Objects

Logging Web Proxy Service Activity


Configuring the WinSock Proxy Service

Overview of WinSock Proxy Service Configuration

Configuring WinSock Proxy Protocols and Ports

Setting Up WinSock Proxy Users

Controlling WinSock Proxy User Access to Internet Sites

Logging WinSock Proxy Service Activity

Setting WinSock Proxy Access Control


Setting Up Clients

Configuring the Client Setup Program

Installing Clients

Removing Clients

Reviewing the Client Setup Log

Web Proxy Clients

WinSock Proxy Clients

Using the WSP Client Application

Creating a Local LAT File

Editing the Mspclnt.ini File

Configuring Windows Sockets Applications


Security

Security Overview

Web Proxy Security

WinSock Proxy Security

Securing Your Network


Monitoring

Setup Logs

Microsoft Proxy Server Logs

Windows NT Logs

Performance Monitor Counters

SNMP MIBs


Registry Entries

Registry Editor

Reading Hexadecimal Key Values

Microsoft Proxy Server Registry Entries

Microsoft Proxy Server services are configured using the Microsoft Proxy Server Setup program and Internet Service Manager.

All configuration values for Windows NT are stored in a database known as the registry. You can optionally use the Registry Editor (Regedt32.exe) to view, modify, or change these values directly.

Warning Do not use Regedt32.exe as a substitute for Internet Service Manager. Values changed with Regedt32.exe will not be updated directly. You must stop and start the service to have them take effect. Changes made by using Internet Service Manager take effect immediately.


Network Considerations

Overview of Network Considerations with Microsoft Proxy Server

Considerations for Setting Up Your Private Network

Considerations for Connecting to the Internet


Troubleshooting

Web Proxy Service Troubleshooting

WinSock Proxy Service Troubleshooting

Performance Troubleshooting

RAS Troubleshooting


Architecture

How the Web Proxy Service Works

How the WinSock Proxy Service Works


Web Proxy Service Reference

This appendix provides a reference to the property sheets and dialog boxes displayed in Internet Service Manager for the Web Proxy service of Microsoft Proxy Server.

Opening the Administrative Interface for the Web Proxy Service

Web Proxy Service Properties

Web Proxy Permissions Properties

Web Proxy Caching Properties

Web Proxy Logging Properties

Web Proxy Filters Properties


WinSock Proxy Service Reference

This appendix provides a reference to the property sheets and dialog boxes displayed in Internet Service Manager for the WinSock Proxy service of Microsoft Proxy Server.

Opening the Administrative Interface for the WinSock Proxy Service

WinSock Proxy Service Properties

WinSock Proxy Protocols Properties

WinSock Proxy Permissions Properties

WinSock Proxy Logging Properties

WinSock Proxy Filters Properties


IIS Considerations

The Default Configuration

Publishing to the Internet

Publishing On Your Private Network


Setup Messages

The server Setup and client Setup programs create log files with information about the setup process. The Microsoft Proxy Server setup log is created as a file named C:\Mpssetup.log on the server computer. The client setup log is created as a file named C:\Mpcsetup.log the client computer.

Customers calling their support provider for assistance should have these log files available when calling. They contain valuable information beyond any error messages that are displayed to users.

The following is an alphabetized listing of messages that can be returned from the server and client Setup programs of Microsoft Proxy Server.

Call to LoadString with ID number failed.

[Client Setup]

An unexplained error in setup occurred.

Consult with your technical support team or network administrator for further assistance. If you contact your support provider regarding this error, be sure to have the setup log file, typically C:\Mpssetup.log, available when you call, and reference the ID number displayed with this message.

Call to LoadString with ID number failed err=error number.

[Client Setup]

An unexplained error in Setup occurred.

Consult with your technical support team or network administrator for further assistance. If you contact your support provider regarding this error, be sure to record the error number displayed with this message and have the setup log file, typically C:\Mpssetup.log, available when you call.

Could not identify disk drives configuration.

[Server Setup]

Indicates that setup was not able to recognize your current drive configuration.

Contact your technical support team for further assistance.

Either the logged account is not permitted to modify the system file: filename or the file is locked by another application.

[Server Setup]

Another Internet service is currently active on the server or the account you are using does not provide administrative access.

Use Internet Service Manager to manually stop all other Internet services. Also, verify that you have administrative rights for your current logon account before running Setup again.

Fail to wait for process termination.

[Server Setup]

A process was ended unexpectedly by the system.

Consult with your technical support team or network administrator for further assistance. If you contact your support provider regarding this error, be sure to have the setup log file (typically C:\Mpssetup.log) available when you call.

Failed to initialized Service Manager. Error=error number.

[Server Setup]

Microsoft Proxy Server could not be installed with your existing server configuration.

Contact your support provider for further assistance. Be sure to have information from the setup log (typically C:\Mpssetup.log) available when you contact your support provider.

Instances of Winsock DLLs appear in both system and windows directory. Setup cannot proceed until there is only one TCP/IP installation.

[Client Setup]

Setup found multiple copies of Winsock.dll. Only one copy of this file can be located within the Windows or System directories.

Delete or rename the additional copies of this file from the Windows and System directory and rerun Setup. If you have multiple TCP/IP client installations installed on this computer, or encounter further complications, contact your technical support team or network administrator for assistance.

Proxy Server setup requires administrator privileges.

[Server Setup]

You attempted to install Microsoft Proxy Server from a logon account that does not have administrator privileges.

Log off from your present user account and log on as Administrator before running Setup again.

Load of dynamic link library filename failed returning value.

[Server Setup]

The named DLL failed to load and may be missing.

Make sure that the named .dll file is located in the setup share path for Microsoft Proxy Server and run Setup again. Contact your technical support team or network administrator if the error occurs again.

Out of Memory

[Server Setup]

You do not have enough available resources on this computer to run the Setup program.

Close all other applications and restart the computer before running Setup again.

Please set a description of the internal network.

[Client Setup]

The Local Address Table (LAT) file is not present on your computer. This file is named Msplat.txt and is typically installed in C:\Wspclnt directory.

Make sure you have enough disk space and that the logon account you are using is permitted to write to C:\Wspclnt\Msplat.txt. Also, this file must contain at least one valid range of address pairs to identify internal IP network clients.

Setup cannot access the environment variable: variable name.

[Server Setup]

An environment variable was not defined or needs to be reset.

Try running Setup again. If the problem continues, contact your technical support group or network administrator.

Setup cannot access the file: filename.

[Server Setup]

This file could not be modified or updated during setup.

Try running Setup again. If the problem continues, contact your technical support group or network administrator.

Setup cannot access the registry value: valuename.

[Server Setup]

The registry was not updated, possibly because the required registry key was not previously defined.

Try running Setup again. If the problem continues, contact your technical support group or network administrator.

Setup cannot create the file: filename.

[Server Setup]

This file could not be created during setup.

Try running Setup again. If the problem continues contact your technical support team or network administrator.

Setup cannot create the file: filename Error=error number.

[Client Setup]

This file could not be copied onto your computer.

Check for available disk space, or contact your technical support team for further assistance.

Setup cannot create the share: share name.

[Server Setup]

A share could not be created on the share volume selected.

Try running Setup again. If the problem continues, contact your technical support group or network administrator.

Setup cannot delete the registry entry: entryname.

[Server Setup]

The registry was not updated properly by the setup program, possibly because one of the following conditions occurred:

  • The account you are using has limited logon access to the server.
  • A previous version of Microsoft Proxy Server was installed on the server.
  • There are further problems with the registry itself.

Make sure you are using an account that has administrator privileges. If Microsoft Proxy Server was previously installed, run Setup again and select Remove All to completely remove all components from the previous version before installing again. If the error continues, consult with your technical support staff or your Microsoft Windows NT documentation for further information on problems with the registry.

Setup cannot load protocols to the registry error no: number.

[Server Setup]

Possibly caused by the file Proto.bin being deleted from the setup installation share path. This is possible only if you are attempting to run Microsoft Proxy Server setup from a network share path created by using files copied from the Microsoft Proxy Server compact disc.

Copy the file Proto.bin from the Microsoft Proxy Server compact disc to the network share path being used for setup.

Setup cannot locate Internet Explorer 1.x location.

[Client Setup]

The installed path to your browser application cannot be located.

You can continue running Setup normally, but you will need to manually configure your browser for use with the Web Proxy service. For more details on manually configuring Internet Explorer 1.5 for use with Microsoft Proxy Server, see “Setting Up Clients.”

Setup cannot locate Internet Explorer 2.0 location.

[Client Setup]

The installed path to your browser application cannot be located.

You can continue running Setup normally, but you will need to manually configure your browser for use with the Web Proxy service. For more details on manually configuring Internet Explorer 2.0 for use with Microsoft Proxy Server, see “Setting Up Clients.”

Setup cannot locate Netscape Navigator location.

[Client Setup]

The installed path to your browser application cannot be located.

You can continue running Setup normally, but you will need to manually configure your browser for use with the Web Proxy service. For more details on manually configuring Netscape Navigator for use with Microsoft Proxy Server, see “Setting Up Clients.”

Setup cannot open or create the registry entry: filename.

[Server Setup]

The registry was not updated properly by the Setup program, possibly because one of the following conditions occurred:

  • The account you are using has limited logon access to the server.
  • A previous version of Microsoft Proxy Server was installed on the server.
  • There are further problems with the registry itself.

Make sure you are using an account that has administrator privileges. If Microsoft Proxy Server was previously installed, run Setup again and select Remove All to completely remove all components from the previous version before installing again. If the error continues, consult with your technical support staff or your Microsoft Windows NT documentation for further information on handling problems with the registry.

Setup cannot set the INI value: initialization value.

[Client Setup]

The .ini file may be corrupted or missing on this computer.

Try running Setup again. If the problem continues, contact your technical support group or network administrator.

Setup cannot set the registry value: registry value.

[Server Setup]

The registry was not updated properly by the setup program, possibly because one of the following conditions occurred:

  • The account you are using has limited logon access to the server.
  • A previous version of Microsoft Proxy Server was installed on the server.
  • There are further problems with the registry itself.

Make sure you are using an account that has administrator privileges. If Microsoft Proxy Server was previously installed, run Setup again and select Remove All to completely remove all components from the previous version before installing again. If the error continues, consult with your technical support team or your Microsoft Windows NT documentation for further information on problems with the registry.

Setup cannot write to the file: filename.

[Server Setup]

This file could not be updated during setup.

Try running Setup again. If the problem continues, contact your technical support group or network administrator.

Setup could not access system.ini err=error number.

[Client Setup]

The System.ini file may be missing.

Make sure that the System.ini file exists. Consult with your technical support team or network administrator as necessary. If you contact your support provider regarding this error, be sure to record the error number displayed with this message and have the setup log file (typically C:\Mpssetup.log) available when you call.

Setup could not access the service service name Error=error number.

[Server Setup]

Microsoft Proxy Server Setup was not able to complete because of problems in accessing other installed Internet services.

Contact your support provider for further assistance. Be sure to have information from the setup log (typically C:\Mpssetup.log) available when you call.

Setup could not close file handle to System.ini err=error number.

[Client Setup]

May be caused by insufficient file handles.

May be able to correct by increasing the number of file handles in FILES= statement in Config.sys. Reboot the computer and run Setup again. Consult with your technical support team or network administrator as necessary.

If you contact your support provider regarding this error, be sure to record the error number displayed with this message and have the setup log file, C:\Mpssetup.log, available when you call.

Setup could not config the name service.

[Server Setup]

Microsoft Proxy Server Setup was not able to configure this service.

Contact your support provider for further assistance. Be sure to have information from the setup log (typically C:\Mpssetup.log) available when you call.

Setup could not create directory directory name Error=error number.

[Server Setup]

Setup could not create the named directory, possibly because the disk drive is full.

Check for available disk space.

Setup Could not create link to name Error=error number.

[Server Setup]

Setup could not create the named link, possibly because the disk drive is full or because of other file system errors.

Check for available disk space and for file system and disk storage integrity. Consult your product support team or network administrator as necessary.

Setup could not create the name service.

[Server Setup]

Microsoft Proxy Server setup was not able to create this service.

Contact your support provider for further assistance. Be sure to have information from the setup log (typically C:\Mpssetup.log) available when you call.

Setup could not delete the file filename.

[Client Setup]

The named file may be in use by another application or system resource.

Close all other applications and run Setup again.

Setup could not delete the file filename Error=error number.

[Client Setup]

The named file may be in use by another application or system resource.

Close all other applications and run Setup again.

Setup could not delete the name service.

[Server Setup]

Microsoft Proxy Server Setup was not able to delete this service.

Contact your support provider for further assistance. Be sure to have information from the setup log (typically C:\Mpssetup.log) available when you call.

Setup could not find the file Wsock32.dll in your system. Please consult the documentation for your system.

[Client Setup]

For Windows NT clients, make sure that Wsock32.dll is located in the C:\Winnt\System32 directory path.

Consult your Microsoft Windows documentation for further details on Wsock32.dll or contact your technical support team or network administrator as necessary.

Setup could not open the name service.

[Server Setup]

Microsoft Proxy Server Setup was not able to open this service.

Contact your support provider for further assistance. Be sure to have information from the setup log (typically C:\Mpssetup.log) available when you call.

Setup could not rename the file filename1 back to filename2.

[Client Setup]

Setup was unable to complete a system file update for installation. Critical system files may be missing or incorrectly named.

Run Setup again and select Remove All to completely remove all components from the previous version before installing again. If the message still occurs, you may be able to correct by renaming the following files in the Windows system directory:

  • For Windows 95 or Windows NT clients, rename _msrws32.dll to Wsock32.dll.
  • For Windows 3.1 clients, rename _msrws16.dll to Winsock.dll.

After renaming the appropriate file, run Setup again.

Setup could not rename the file filename1 to filename2.

[Client Setup]

Setup was unable to rename a file for installation.

Try running Setup again. If that fails, contact your technical support team or network administrator as necessary.

Setup could not save Local Address Table.

[Client Setup]

The LAT file could not be saved to disk on the computer. This file is named Msplat.txt and is installed in the C:\Wspclnt directory.

Make sure that this file is not already installed and in use by another application (such as a text editor). Make sure you have enough disk space and that the user account you are using is permitted to write to C:\Mspclnt\Msplat.txt.

Setup could not start the service service name Error=error number.

[Server Setup]

Microsoft Proxy Server setup could not start another Internet service.

You can attempt to start the service manually by using the Internet Service Manager, and then run Setup again. If the error is not resolved by these steps, contact your technical support team or network administrator.

Setup could not stop the service service name because dependent services are running.

[Server Setup]

Microsoft Proxy Server setup could not stop a dependent service that is used by another active Internet service.

Make sure that all other Internet services are stopped manually (by using Internet Service Manager), and then run Setup again. If the error is not resolved by these steps, contact your technical support team or network administrator.

Setup could not stop the service service name Error=error number.

[Server Setup]

Another Internet service is active and could not be stopped by Microsoft Proxy Server Setup.

You can attempt to stop the service manually by using the Internet Service Manager, and then run Setup again. If the error is not resolved by these steps, contact your technical support team or network administrator.

Setup failed creating the temporary file.

[Client Setup]

Setup was unable to create a file needed temporarily for installation, possibly because of temporary files left from a previous installation attempt.

To delete temporary files, you may run Setup again or, if this fails, delete all files starting with and underscore (_) in your Windows and System directories and run Setup again.

Setup failed to create a process Error=error number.

[Client Setup]

Setup failed to create a process and may require system program files that are not present on this computer.

For Windows NT clients, make sure that the following files are present in the System directory: Router.exe, Lodctr.exe, and Unlodctr.exe. These are system files that Setup uses.

Setup failed to set Internet Explorer 1.x Proxy Settings. You may need to do this manually.

[Client Setup]

Your browser was not updated properly and must be manually configured for access to the server.

For more information on manually configuring your client, see “Setting Up Clients.”

Setup failed to set Internet Explorer 2.0 Proxy Settings. You may need to do this manually.

[Client Setup]

Your browser was not updated properly and must be manually configured for access to the server.

For more information on manually configuring your client, see “Setting Up Clients.”

Setup failed to set Netscape Navigator proxy settings. You may need to do this manually.

[Client Setup]

Your browser was not updated properly and must be manually configured for access to the server.

For more information on manually configuring your client, see “Setting Up Clients.”

Setup has failed to examine the system directory.

[Client Setup]

The Setup program could not examine or locate the Windows or Winnt system directory on this computer.

Contact your technical support team or network administrator for further assistance.

Setup has failed to examine the Windows Directory.

[Client Setup]

The Setup program could not examine or locate the Windows or Winnt directory on this computer.

Contact your technical support team or network administrator for further assistance.

Setup failed to write a line to _mssetup.bat.

[Client Setup]

Setup was unable to write needed changes to your Windows configuration files, possibly because these files are in currently in use by another application, or due to lack of disk space.

Make sure all other applications are closed and that there is enough disk space before running Setup again.

Setup failed to write a line to Winini.ini.

[Client Setup]

Setup was unable to write needed changes to your Windows configuration files, possibly because these files are currently in use by another application, or due to lack of disk space.

Make sure all other applications are closed and that there is enough disk space before running Setup again.

Setup has identified a newer version of the Microsoft Proxy Server (version number) installed on this computer in sharename. To install an older version you must first run version number’s Setup program and choose Remove All.

[Server Setup]

You are attempting to install an earlier version of Microsoft Proxy Server than the currently installed version.

You need to run Setup from the server’s local share path and select Remove All to remove all components from the current version of Microsoft Proxy Server before you can install an earlier version.

This software can only be installed on a computer with an Internet Information Server installation that includes the WWW service.

[Server Setup]

Microsoft Proxy Server requires that the WWW service be installed for Internet Information Server (IIS) 2.0 first.

You can install the WWW Service by running Internet Information Server Setup and selecting Add/Remove to install this service before running Microsoft Proxy Server Setup again.

For further information on installing Internet Information Server 2.0, consult your Microsoft product documentation for that product.

This software can only be installed on Windows NT Server version 4.00 build build number or later.

[Server Setup]

You have attempted to install Microsoft Proxy Server onto a preliminary release of Windows NT Server 4.0 that is not supported for the this release of Microsoft Proxy Server.

Upgrade Windows NT Server 4.0 to the current release before running Microsft Proxy Server Setup.

This software can only be installed on a computer running Windows NT Server version 4.00 or later.

[Server Setup]

You have attempted to install Microsoft Proxy Server onto an earlier version of Windows NT Server that is not supported for Microsoft Proxy Server.

Upgrade Windows NT Server to version 4.00 or higher before running Setup again to install the Microsoft Proxy Server.

Use of dynamic link library filename failed returning value.

[Server Setup]

The named .dll file failed an operation and may be missing or corrupted.

Make sure that the named .dll file is located in the setup share path for Microsoft Proxy Server and run Setup again. Contact your technical support team or network administrator if the error occurs again.

WSAStartup failed Error=error number.

[Server Setup]

Indicates an error occurred in TCP/IP services initialization.

Review your TCP/IP configuration settings to make sure they are valid.

You must reboot to complete previous installation before running Setup again.

[Client Setup]

A reboot of the computer is required to complete the installation.

Reboot the computer to complete the previous client Setup. You may also need to run Setup again to resolve errors or complete updating of system configuration settings.

Your system may be in an inconsistent state. Please run Setup again.

[Client Setup]

Setup was unable to complete file updating for installation. Critical system files may be missing or incorrectly named.

Run Setup again and select Remove All to completely remove all components from the previous version before installing again. If the message still occurs, you may be able to correct by renaming the following files in the Windows system directory:

  • For Windows 95 or Windows NT clients, rename _msrws32.dll to Wsock32.dll.
  • For Windows 3.1 clients, rename _msrws16.dll to Winsock.dll.

After renaming the appropriate file, run Setup again.


Web Proxy Messages

Web Proxy Service Messages

Web Proxy Client Messages


WinSock Proxy Messages

WinSock Proxy Service Messages Logged to the System

WinSock Proxy Service Messages Displayed to Clients


Glossary

A B C D E F G H I L M N O P R S T U V W

This glossary defines some of the terms found in the documentation for Microsoft Proxy Server. Click a letter (above) to jump to that section of the glossary, or use your browser’s Find command to search for a word across the entire glossary. For example, if you are running Microsoft Internet Explorer, from the Edit menu click Find and type in the word you are looking for.

To Top A

Access Control Entry (ACE)

An entry in an access control list (ACL) that specifies access rights for specific files and shares within Windows NT File System (NTFS) directories.

Access Control List (ACL)

A listing of Access Control Entries specifying access rights to services and specified data files located within Windows NT File System (NTFS) directories.

active caching

A service mechanism used to initiate new requests to update cached file objects. Requests can be activated based on the length of time an object has been cached or was last retrieved from the object’s source location. This type of caching can be used to assure the freshness of specified data within the cache. See also fresh data, stale data.

annotation file

For the FTP service, a summary of the information in a given directory. This summary appears automatically to browsers.

anonymous logon

This feature allows remote access to an Internet server computer. Remote users can connect to the computer without supplying a user name or password, but have only the guest permissions assigned to this account.

associating

See file-name extension mapping.

authentication

A process used to determine if a user has permission to access a resource or perform an operation.

To Top B

Backup Domain Controller (BDC)

A domain server used to replicate the master database for the domain. The master database contains centralized security data for all domain-assigned users and is updated when changes in security are made. See also Primary Domain Controller (PDC), member server.

bandwidth control

Setting the maximum capacity that a service is allowed to use. You can deliberately limit a server’s Internet workload by not allowing it to receive requests at full capacity, saving resources for other programs such as e-mail.

basic, clear-text authentication

An authentication protocol supported by Internet Explorer. There is no encryption with this protocol.

BDC

See Backup Domain Controller (BDC).

BIND

See Domain Name System (DNS).

bits per second (bps)

The measure of speed at which data is transferred over a network.

bps

See bits per second (bps).

browser

A tool for navigating and accessing information on either the Internet or an intranet.

To Top C

cache

A store of files from a Web server copied locally for quicker access. Caching is configured for Web clients by selecting the View menu in Internet Explorer and choosing Cache Settings.

cache consistency

The degree to which cached data remains accurate in comparison to source information.
See also Intelligent TTL (Time-to-Live), object modification checking.

CERN-proxy protocol

An accepted industry protocol standard for application-aware proxy services over HTTP-based client/server communications. The CERN standards are established by the Conseil Europeén pour la Recherche Nucléaire (European Laboratory for Particle Physics), located in Switzerland.

CGI

See Common Gateway Interface (CGI).

challenge/response

See Windows NT Challenge/Response Authentication.

client/server architecture

The structure of services that run on the Internet or an intranet. The client computer accesses the Web server, which supplies the client with resources or information not found on the client’s own host. Also, CGI and ISAPI applications can do processing on the Web server and return results to the client.

commit rate

Refers to the speed with which objects or URLs are added to the cache.

Common Gateway Interface (CGI)

An interface used by an application that runs on a Web server when a client requests it.

connected service

Refers to a service that provides a managed connection allowing networked computers to communicate reliably. TCP and SPX protocols support this type of service. Features of this type of service include the following: data integrity checking, packet sequencing, and error correction. Also known as “streamed” service.

connectionless service

Refers to those network communications which emphasize broadcast methods and unacknowledged delivery. UDP is a protocol that supports this type of service. Supports higher throughput speeds for real-time applications. See also User Datagram Protocol (UDP).

cookie

A customized or personalized HTML document page that is assembled and returned by a Web server, based on information sent by the client .

cryptography

A method of securing data transmissions to and from an Internet server.

C2-compliant

A high-level security rating established and granted by the U.S. government.

To Top D

daemon

Originally, a UNIX term used to describe a program that loads and waits continuously in the background for a request before executing. When a request is received, the program operates in the foreground, and once it has completed an execution, returns to the background and awaits further requests.

data integrity

A way of preventing data from being altered in transit.

Data Source Name (DSN)

The name that allows a connection to an ODBC data source, such as an SQL database. You set this name by using the ODBC application in Control Panel.

DHCP

See Dynamic Host Configuration Protocol (DHCP).

DNS

See Domain Name System (DNS).

DNS spoofing

Assuming the DNS name of another system by either corrupting a name-service cache, or by compromising a domain-name server for a valid domain.

domain

For Windows NT Server, this is a collection of computers that share a common centralized domain database that administers access and establishes security policies. For the Internet, domains can also refer to a style of addressing on the Internet that uses the Domain Name System (DNS) to provide conventional names for Internet computers that can be mapped to IP addresses.

domain controller

For a Windows NT Server domain, the server that authenticates domain logons and maintains the security policy and the master database for a domain. See also Backup Domain Controller (BDC), member server, Primary Domain Controller (PDC).

domain filtering

The ability to control access to specific Internet sites by denying or granting permission to access those sites.

Domain Name System (DNS)

A protocol and naming system used throughout the Internet to map Internet Protocol (IP) addresses to user-friendly names. DNS is sometimes referred to as the BIND service.

DSN

See Data Source Name (DSN).

Dynamic Host Configuration Protocol (DHCP)

An industry-standard protocol that assigns Internet Protocol (IP) addresses to computers for temporary connected use on an IP network.

To Top E

encryption

A way of making data indecipherable while it is being sent from computer to computer.

To Top F

file-name extension mapping

Connecting all files with a certain file name extension to a program. For example, through the Windows NT Explorer, all .txt files are associated by default with Notepad. In Internet Explorer, you can associate file name extensions with applications by use of the Helpers dialog box. To display this dialog box, from the View Menu, choose Helpers.

File Transfer Protocol (FTP)

A TCP/IP-based standard protocol for sharing files between computers.

filter

A feature of ISAPI that allows pre-processing of requests and post-processing of responses, permitting site-specific handling of Hyper-Text Transfer Protocol (HTTP) requests and responses.

firewall

A system, or combination of systems, that enforces a boundary between two or more networks and keeps intruders out of private networks.

fresh data

Cached data that is verified to be current and consistent with its source. See also cache consistency, stale data.

friendly name

A name that substitutes for an IP address, for example, www.microsoft.com instead of an IP address such as 157.45.60.81.

FTP

See File Transfer Protocol (FTP).

To Top G

garbage collection

The process of removing unused or outdated object data from the cache.

gateway

A hardware or software device that directs network traffic between two separated networks. For example, Microsoft Proxy Server can act as a gateway between a private network (an intranet) and the public network (the Internet).

Gopher

A hierarchical system for finding and retrieving information from the Internet or an intranet.

Gopher Plus

An enhanced version of Gopher, including a way of getting more information about an item (such as file size, last date of modification, and the administrator’s name); the ability to display a single file in multiple formats (such as regular text, rich text, and PostScript); a way to add a short description of the item; and the ability to ask a user to fill out a form to obtain an item.

Gopherspace

All files available on a Gopher server for display by using the Gopher protocol.

To Top H

header

In packet-level communications, a specified number of bytes that precedes the actual data being transmitted. It identifies control information used to deliver, route and process the data contents of a packet.

hit rate

The percentage of client requests fulfilled through previously cached data, in contrast to the total of all client requests that have been processed by the caching service.

home directory

The root directory for a service, where the content files are stored. By default, the home directory and all its subdirectories are available to users.

HTML

See Hypertext Markup Language (HTML).

HTTP

See Hypertext Transfer Protocol (HTTP).

HTTPD server

Another name for a Web server, which uses HTTP for its primary means of communicating with clients and operates as a daemon-type process. See also daemon, Hypertext Transfer Protocol (HTTP).

hyperlink

A way of jumping to another place on the Internet. Hyperlinks usually appear in a different format from regular text. You initiate the jump to a new link by clicking the link.

hypertext

Documents with links to other documents. Click a link to display the linked document.

Hypertext Markup Language (HTML)

The formatting language used for documents on the World Wide Web.

Hypertext Transfer Protocol (HTTP)

The underlying protocol by which WWW clients and servers communicate.

To Top I

IIS

See Internet Information Server (IIS).

Integrated Services Digital Network (ISDN)

A connection to the Internet installed by your Internet service provider (ISP). A dial-up ISDN line can offer speeds up to 128,000 bps.

Intelligent TTL (Time-to-Live)

A method for optimizing caching service that extends cache life for those cache objects which are frequently requested. Each time an object is retrieved from the cache, this function sets a new increased TTL expiration value for the object based on a percentage of the object’s remaining TTL within the cache.

interactive applications

A program written in C, Perl, or as a Windows NT batch file. The user initiates the program by clicking a hyperlink.

Internet

The global network of computers that communicate through a common set of protocols known collectively as TCP/IP. See also Transmission Control Protocol/Internet Protocol (TCP/IP).

Internet Information Server (IIS)

The Microsoft Internet server product designed for implementing and managing content sites for TCP/IP-based networks and client access. Microsoft Proxy Server integrates fully with IIS and Microsoft Windows NT Server.

Internet Network Information Center (InterNIC)

The agency that centrally coordinates assignment and registration of DNS names and IP addresses for use on the Internet. See also Domain Name System (DNS), Internet Protocol (IP) address.

Internet Protocol (IP)

The routing protocol part of TCP/IP that uses IP addressing to route messages from one Internet location to another. See also Internet Protocol (IP) address.

Internet Protocol (IP) address

A unique address that identifies a host on a network. It identifies a computer as a 32-bit address that is unique across a TCP/IP network. An IP address is usually represented in dotted-decimal notation, which depicts each octet (eight bits, or one byte) of an IP address as its decimal value and separates each octet with a period, for example: 102.54.94.97.

Internet Relay Chat (IRC)

A protocol that supports interactive text-based communications in established “chat room” sites on the Internet.

Internet Server Application Programming Interface (ISAPI)

A Microsoft-developed specification for establishing procedural calls between Internet-based applications and the underlying operating system.

Internet Service Providers (ISPs)

Public providers of remote connections to the Internet.

InterNIC

See Internet Network Information Center (InterNIC).

Internetwork Packet Exchange (IPX)

A routing protocol developed for Novell networks that is used in place of the Internet Protocol (IP) to manage communications access between network devices.

intranet

Any privately operated TCP/IP-based network (for example, a corporate network). Intranets can be connected to the Internet, but are usually protected by an intermediate set of barrier devices that secure Internet access. See also firewall.

IP

See Internet Protocol (IP).

IP address

See Internet Protocol (IP) address.

IPX/SPX

See Internetwork Packet Exchange (IPX), Sequenced Packet Exchange (SPX).

ISAPI

See Internet Server Application Programming Interface (ISAPI).

ISDN

See Integrated Services Digital Network (ISDN).

IUSR_computername

A default account with anonymous logon privileges for accessing Internet-based services, such as FTP, WWW, and Gopher. This account is created during Microsoft Internet Information Server installation.

To Top L

LAN

See Local Area Network (LAN).

LAT

See Local Address Table (LAT).

leased line

A high-capacity line (most often a telephone line) dedicated to network connections.

Least Recently Used (LRU)

Refers to the concept of discarding cached data on the basis of frequency of use.

link

See hyperlink.

LMHOSTS file

A text-based file that is used as a static routing table in Microsoft Windows NT Server to authenticate and register valid IP addresses and associated user-friendly domain names for IP nodes in a local TCP/IP network.

Local Area Network (LAN)

A group of computers that are linked together around a shared site and unified purpose.

Local Address Table (LAT)

A table of all internal IP address pairs on the private network where Microsoft Proxy Server is installed. This list is used to control access between clients on the internal network and remote IP addresses on external IP networks (or the Internet). The LAT is registered and stored in a text-based file (Msplat.txt) within the installed directory for Microsoft Proxy Server (C:\Msp\Clients). This file is distributed to clients during setup and updated periodically by Microsoft Proxy Server.

log file

The file in which logging records are stored. This file can be either a text file or a database file.

logging

Storing information about events that occurred on a firewall or network.

LRU

See Least Recently Used (LRU).

To Top M

Management Information Database (MIB)

A standard database component that uses the Simple Network Management Protocol (SNMP) to communicate information about hardware and software processes on your network for further management and monitoring.

member server

A server that has been assigned to a Windows NT domain, but is not designated as either the primary domain controller (PDC) or a backup domain controller (BDC) within the assigned domain. See also Primary Domain Controller (PDC), Backup Domain Controller (PDC).

metric

Any measurable or significant factor that can be used in analyzing client/server-based communications.

MIB

See Management Information Database (MIB).

MIME mapping

See Multipurpose Internet Mail Extension (MIME) mapping.

Multipurpose Internet Mail Extension (MIME) mapping

A way of configuring browsers to view files that are in multiple formats.

To Top N

name resolution

A configuration that maps friendly names to IP addresses.

negative caching

Refers to the caching of HTTP error conditions associated with accessing a particular URL. If the URL is unavailable, the error response message can be cached and returned to subsequent clients that request the same URL.

Network News Transfer Protocol (NNTP)

A protocol for reading messages posted in thousands of news groups on the Internet.

NNTP

See Network News Transfer Protocol (NNTP).

To Top O

object-cache scavenger

The code that periodically scans the cache for objects to be discarded. It deletes the cache files that have not been used recently, and therefore are unlikely to be used again in the near future.

object modification checking

A function of the caching service that performs a set of tests to verify if a cached object differs from the source object being requested. If a cached object is verified to be the same as it source, the cached object is returned. If a cached object is found to be different from its source, the source object is retrieved and the cache updated.

Open Database Connectivity (ODBC)

A standard specification for data storage and access that provides a means of interchange for tabled data across varying database systems.

To Top P

packet

A fixed number of bytes that forms the basic physical unit of distribution for all networked data transmissions.

page

See Web page.

passive caching

Refers to the most common type of caching performed, frequently referred to as “on-demand” caching. In this type of service, data is cached and discarded entirely on the basis of object size, popularity, or time since the requested object was last updated in the cache. All caching updates are user-initiated in this type of caching.

password authentication

See authentication.

PDC

See Primary Domain Controller (PDC).

Peer Web Services

A collection of services that enable a computer running Windows NT Workstation to publish a personal Web site from the desktop. The services include the WWW service, the FTP service, and the Gopher service.

Point-to-Point Protocol (PPP)

In contrast to SLIP, a more recently established Internet communications protocol that standardizes dial-up networking using analog modem hardware and standard telephone lines. Although PPP is a well-standardized protocol, vendor implementations of PPP service can vary significantly.

Point-to-Point Tunneling Protocol (PPTP)

A newer networking protocol that remote users can use to access corporate networks securely across the Internet by dialing into an Internet Service Provider (ISP) or by connecting directly to the Internet. Because PPTP allows multiprotocol encapsulation, users can send any packet type over an IP network.

policies

Conditions set by the system administrator, such as how quickly account passwords expire and how many unsuccessful logon attempts are allowed before a user is locked out. These policies manage accounts to prevent exhaustive or random password attacks.

port number

A number identifying a certain Internet application. For example, the default port number for the Gopher service is 70, and for the WWW service it is 80.

Primary Domain Controller (PDC)

A server assigned to administer security for a domain. This server stores the master database of all domain-assigned security data for users and must be updated when changes in security are made. See also Backup Domain Controller (BDC), member server.

program file

A file that starts an application or program. A program file has an .exe, .pif, .com, .cmd, or .bat file name extension.

protocol

Software that allows computers to communicate over a network. The Internet protocol is TCP/IP.

proxy

A software program that connects a user to a remote destination through an intermediary gateway.

proxy client

A client device that must use a proxy host to gain access to network services not directly supported for client usage.

proxy host

A host device that acts as a relay agent between servers and clients to intercept requests and process communications on behalf of proxy clients.

Proxy ISAPI Application

A linked library that serves as an active in-process mechanism for extending Web server functionality by providing the following services: client authentication, domain filtering, cache searching for requested objects, retrieval of requested objects from the Internet as necessary, and updating cached data.

Proxy ISAPI Filter

A linked library that is called by Microsoft Proxy Server (or a Web server) that determines if a client-initiated HTTP request is to be considered as a proxy request. If so, it is handled by the Web Proxy service and forwarded to the Proxy ISAPI application or, in the case of a non-proxy request, forwarded as a standard HTTP request.

To Top R

RAS

See Remote Access Service (RAS).

RealAudio

A streaming audio protocol supported by Microsoft Proxy Server that provides continuous sound over the Internet to compatible clients. RealAudio Player can be configured to work with Internet Explorer.

Remote Access Service (RAS)

A service that allows remote client computers (RAS clients) running MS-DOS, Microsoft Windows, or Windows NT to dial in to a network server (RAS server). RAS servers can also be configured to allow local client computers to dial out to servers outside a private network.

remote administration

Administering a computer from another computer over the network.

Remote Procedure Call (RPC)

A message-passing facility that allows a distributed application to call services available on various computers in a network.

retrieve rate

Refers to the speed with which objects or URLs are taken from the cache.

router

A hardware or software device that directs network traffic. The Microsoft Proxy Server is installed behind a router within a private network environment (intranet).

RPC

See Remote Procedure Call (RPC).

To Top S

script

A group of directives to an application or utility program. A CGI application, for example. See also Common Gateway Interface.

Secure Sockets Layer (SSL)

A protocol that supplies secure data communication through data encryption and decryption.

Sequenced Packet Exchange (SPX)

A transport-level protocol developed for use in Novell networks. SPX is used in place of the Transmission Control Protocol (TCP) to verify packet delivery, assure proper sequencing of packet data, and provide connected service between devices on a network. See also connected service, Internetwork Packet Exchange (IPX).

Serial Line Interface Protocol (SLIP)

A well-established Internet communications protocol that standardizes dial-up networking.

Server Message Block (SMB) protocol

The underlying protocol by which Microsoft Windows NT-based servers communicate critical service information with one another.

service

One of the services managed through the Internet Service Manager. These include the WWW, Gopher, and FTP services provided by Internet Information Server, and the Web Proxy and WinSock Proxy services provided by Microsoft Proxy Server.

Simple Mail Transfer Protocol (SMTP)

A protocol used for exchanging mail on the Internet.

Simple Network Management Protocol (SNMP)

A standard protocol used to communicate management information for monitoring your network. See also Management Information Database (MIB).

SMTP

See Simple Mail Transfer Protocol (SMTP).

SNMP

See Simple Network Management Protocol (SNMP).

socket

A communications channel used by TCP/IP-aware applications. Sockets are data structures created by using a combination of device IP addresses and reserved TCP/UDP port numbers to indicate connection and delivery service information.

SPX

See Sequenced Packet Exchange (SPX).

SSL security

See Secure Sockets Layer (SSL).

stale data

Cached data that is outdated or inconsistent in comparison to its source.

Standard Proxy Protocol

Refers to the accepted industry-standard protocol for application-aware services established by CERN. See also CERN-proxy protocol.

static page

HTML pages prepared in advance of the request and sent to the client upon request. This page takes no special action when requested. See also interactive applications.

subnet mask

A TCP/IP configuration parameter that extracts network and host configuration from an IP address.

To Top T

tag files

Files that contain information about files on a Gopher server. This information is sent to clients and it typically contains the file name, host name, and port number.

TCP/IP

See Transmission Control Protocol/Internet Protocol (TCP/IP).

Time-to-Live (TTL)

A standard field in a TCP/IP header that indicates an age-of-expiration value that is examined by receiving stations. Data with active TTL values is maintained and forwarded on the network; data with expired TTL values is discarded.

Transmission Control Protocol (TCP)

The main transport protocol within TCP/IP that manages reliable delivery of data between networked computers.

Transmission Control Protocol/Internet Protocol (TCP/IP)

A family of networking protocols that allows computers to communicate across interconnected networks and the Internet. Every computer on the Internet supports TCP/IP.

To Top U

UDP

See User Datagram Protocol (UDP).

Uniform Resource Locator (URL)

A naming convention that uniquely identifies the location of a computer, directory, or file on the Internet. The URL also specifies the appropriate Internet protocol, such as Gopher, HTTP, and so on.

URL

See Uniform Resource Locator (URL).

Usenet

The most popular news-group hierarchy on the Internet.

User Datagram Protocol (UDP)

A transmission-level protocol in TCP/IP networking that provides connection-less service for unacknowledged delivery of packeted data. See also connection-less service.

To Top V

VDOLive Player

A stand-alone application that provides stream-oriented service for continuous video imaging. VDOLive Player can be configured to work with Internet Explorer.

virtual directory

A directory outside the home directory that appears to browsers as a subdirectory of the home directory. For any of the three services (WWW, Gopher or FTP), you can configure a virtual directory by using the Directories property sheet in Internet Service Manager.

volatile objects

Typically, files that the Web site administrator updates frequently.

To Top W

WAN

See Wide Area Network (WAN).

Web browser

A software program, such as Internet Explorer, that retrieves a document from a Web server, interprets the HTML codes, and displays the document to the user with as much graphical content as the software can supply.

Web page

A World Wide Web document. Pages can contain almost anything, such as news, images, movies, and sounds.

Web Proxy service

This service provides a means for Microsoft Proxy Server to act as a proxy host.

Web server

A computer equipped with the server software to respond to Web client requests, such as requests from a Web browser. A Web server uses the Internet HTTP, FTP, and Gopher protocols to communicate with clients on a TCP/IP network.

Wide Area Network (WAN)

A network that extends across distance and is not confined to a single site. This type of network typically involves connecting multiple sites that use multiple physical topologies.

Windows Internet Name Service (WINS) server

A protocol for mapping Internet Protocol (IP) addresses to user-friendly names. See also Domain Name System.

Windows NT Challenge/Response Authentication

A method of authentication in which a server uses Windows NT security to allow access to its resources.

Windows Sockets

A standard specification for designing interprocess communications between computers running applications that utilize TCP/IP networking. See also socket.

WINS server

See Windows Internet Name Service (WINS) server.

WinSock Proxy service

This is an API service used by Microsoft Proxy Server that provides redirection and remote execution of Windows Sockets-compatible applications over connections involving a private intranet computer and remote computers on the Internet.

World Wide Web (WWW)

The most graphical service on the Internet. It provides sophisticated linking abilities.

WWW

See World Wide Web (WWW).


Index

A B C D E F G H I K L M N O P Q R S T U V W

Click a letter (above) to move to that section of the index, or use your browser’s Find command to search for a word across the entire index. For example, if you are running Microsoft Internet Explorer, from the Edit menu click Find and type the word you are looking for.

Top A

Access control

Server Administration Overview
Controlling Web Proxy User Access to Internet Sites
Setting WinSock Proxy Access Control
Turning the WinSock Proxy Client On or Off
Setting Access Control for the Web Proxy Service
Setting Access Control for WinSock Proxy
Securing Your Network
Restricting Inbound Access From the Internet
Restricting Outbound Access From Your Network

Access Control Entry

Access Control Entry (ACE)

Access Control List

Access Control List (ACL)

Accessibility for people with disabilities

Accessibility for People with Disabilities

ACE

Access Control Entry (ACE)

ACL

Access Control List (ACL)

Active caching

Caching
Setting Up Caching of Internet Objects
Basic Cache Configuration
Active Caching
Web Proxy Caching Property Sheet
active caching

Adapters property sheet

Setup Considerations When Using Two Adapters

Add/Remove Programs application in Control Panel

Reinstalling Microsoft Proxy Server
Removing Microsoft Proxy Server
Reinstalling a Client
Removing Clients

Adding addresses to the LAT

What is a Local LAT?
How is the LAT Defined?
LAT Configuration Considerations

Adding Microsoft Proxy Server components

Reinstalling Microsoft Proxy Server

Administering Microsoft Proxy Server

Server Administration Overview
Using Internet Service Manager
Putting Users in Windows NT Groups
Considerations For Planning Windows NT Groups
Assigning Groups to Service Permissions
Setting up Network Adapter Cards
Using TCP/IP Ports

Administration tool

Installing Only the Administration Tool

Administrative Interface for Web Proxy service

Opening the Administrative Interface for the Web Proxy Service

Administrative Interface for WinSock Proxy service

Opening the Administrative Interface for the WinSock Proxy Service

Administrative tools

Server Administration Overview
Windows NT Logs

Advanced Cache Policy dialog box

Basic Cache Configuration
Setting the Advanced Options for the Cache
Advanced Cache Policy Dialog Box

Advanced Research Projects Agency

What is the Internet?

Advanced TCP/IP security

Advanced TCP/IP Security with Windows NT

Always cache

Setting the Advanced Options for the Cache
Cache Filter Properties Dialog Box

Analog access

Assessing Bandwidth Requirements
Selecting Connection Hardware

Annotation file

annotation file

Anonymous access

Web Proxy Support for Anonymous FTP Clients

Anonymous authentication

About Web Proxy Security

Anonymous FTP client access

Web Proxy Support for Anonymous FTP Clients

Anonymous logon

Client Authentication
How Anonymous Logon Works
Enabling Basic Authentication
anonymous logon

AnswerPoint Information Services

Microsoft AnswerPoint
Information Services
Priority Support

APIs

About Windows Sockets
Connected Service using TCP Sockets
Connectionless Service using UDP Sockets
TCP Redirection
Using TCP/IP on the Internal Network
Windows Sockets APIs
socket()
bind()
connect()
listen() and accept()
recv() and send()
recvfrom() and sendto()
UDP Redirection

Apple Macintosh

Configuring Apple Macintosh Clients

Application-specific configuration

Configuring Windows Sockets Applications

Architecture

How the Web Proxy Service Works
How the WinSock Proxy Service Works
WinSock Proxy Architecture

ARPA

What is the Internet?

Assigning permissions for Web Proxy and WinSock Proxy services

Assigning Groups to Service Permissions

Associating

associating

Authenticating clients

Client Authentication
Selecting the Client Authentication Method
How Basic Authentication Works
How Challenge/Response Authentication Works

Authentication

Client Authentication
About Web Proxy Security
authentication

Auto dial

Using Microsoft Proxy Auto Dial
About Microsoft Proxy Auto Dial
Setting Credentials
Setting Dialing Hours
Restarting Services After a Dial-Up Connection

Top B

Backup Domain Controller

Software Requirements
Backup Domain Controller (BDC)

Bandwidth

Assessing Bandwidth Requirements
Analyzing Connection Costs
bandwidth control

Basic authentication

Client Authentication
About Web Proxy Security
How Basic Authentication Works
What is Basic Authentication?
Enabling Basic Authentication
basic, clear-text authentication

BDC

BDC

BIND

BIND

Bindings property sheet

Configuring the External Network Adapter Card
Configuring the Internal Network Adapter Card

Bits per second

bits per second (bps)

BOOTP

What is DHCP?
Filtering Access By DNS Domain Name

Bootstrap Protocol

What is DHCP?
Filtering Access By DNS Domain Name

bps

bps

Broadcasts

Using Broadcasts to Resolve Host Names

Browser

What is the World Wide Web?
Web Proxy Basics
Running Client Setup
About Web Proxy Clients
Configuring the Server’s Browser
Web Proxy Client Considerations
How the GET Method Works
Examples of GET Usage with Proxy Service
browser

Top C

C2-compliant

C2-compliant

Cache

Basic Cache Configuration
Setting the Advanced Options for the Cache
Changing the Drives and Space Allocated to the Cache
Turning Off the Cache
Cache-Only Implementation
Cache Keys
Caching Mechanisms
About Caching
Passive Caching
Active Caching
Web Proxy Caching Properties
Web Proxy Caching Property Sheet
Advanced Cache Policy Dialog Box
cache

Cache consistency

cache consistency

Cache drives

Running Server Setup
Basic Cache Configuration
Changing the Drives and Space Allocated to the Cache
Microsoft Proxy Server Cache Drives Dialog Box

Cache filters

Setting the Advanced Options for the Cache
Cache Filters
Cache Filter Properties Dialog Box

Cache Filters Properties dialog box

Setting the Advanced Options for the Cache
Cache Filter Properties Dialog Box

Cache parameters

Cache Parameters

Cache path

Cache Path

Cache registry values

Cache Keys
Cache Parameters
Cache Path
Cache Filters

Cache size

Changing the Drives and Space Allocated to the Cache

Caching

Software Requirements
Setting Up the Disk Drives
Running Server Setup
Caching
Setting Up Caching of Internet Objects
Basic Cache Configuration
Setting the Advanced Options for the Cache
Changing the Drives and Space Allocated to the Cache
Turning Off the Cache
Cache-Only Implementation
Caching Mechanisms
About Caching
Passive Caching
Active Caching
Web Proxy Caching Properties
Web Proxy Caching Property Sheet
Advanced Cache Policy Dialog Box

Caching properties of Web Proxy service

Web Proxy Caching Property Sheet
Microsoft Proxy Server Cache Drives Dialog Box
Advanced Cache Policy Dialog Box
Cache Filter Properties Dialog Box

CERN-proxy protocol

Web Proxy Basics
The CERN-Proxy Protocol
What is CERN-Proxy?
CERN-proxy protocol

CGI

CGI

Challenge/Response authentication

Client Authentication
WinSock Proxy Service Features
About Web Proxy Security
How Challenge/Response Authentication Works
What is Challenge/Response Authentication?
Enabling Challenge/Response Authentication
challenge/response

Changing settings in your system registry

Registry Editor

Changing Setup settings

Reinstalling Microsoft Proxy Server

Clear-text authentication

basic, clear-text authentication

Client

What is a Client?
Microsoft Proxy Server as a DNS Client
Microsoft Proxy Server as a WINS Client
Configuring the Client Setup Program
Installing Clients
Installing on a Dual-Boot Client
Removing Clients
Reviewing the Client Setup Log
Web Proxy Clients
Configuring Microsoft Internet Explorer 3.0 Clients
Configuring Microsoft Internet Explorer 1.5 Clients
Configuring Netscape Navigator Clients
Configuring Apple Macintosh Clients
Configuring UNIX Clients
Web Proxy Client Considerations
WinSock Proxy Clients
About WinSock Proxy Clients
WinSock Proxy Client Considerations
Updating the WinSock Proxy Client Configuration Files
Creating a Local LAT File
Client Information Fields
Web Proxy Client Problems
WinSock Proxy Client Problems
WinSock Proxy Client Components

Client authentication

Client Authentication
Selecting the Client Authentication Method
How Basic Authentication Works
How Challenge/Response Authentication Works

Client Configuration dialog box

Configuring the Client Setup Program

Client displayed messages

Web Proxy Client Messages
WinSock Proxy Service Messages Displayed to Clients

Client Installation/Configuration dialog box

Running Server Setup
Web Proxy Client Considerations

Client log information

Reviewing the Client Setup Log
The Client Setup Log
Client Information Fields

Client Setup

What is the LAT?
Configuring the Client Setup Program
Installing Clients
Running Client Setup
Reinstalling a Client
Installing on a Dual-Boot Client
Running Client Setup from the Command Line
Removing Clients
Reviewing the Client Setup Log
The Client Setup Log

Client Setup log

Reviewing the Client Setup Log
The Client Setup Log

Client/server architecture

client/server architecture

Command-line options to start Setup

Running Server Setup from the Command Line
Running Client Setup from the Command Line

Commit rate

commit rate

Common Gateway Interface

Common Gateway Interface (CGI)

Communicating with remote services on the Internet

What is an ISP?
What is a Proxy Server?
What is a Client?
What is Microsoft Proxy Server?
Web Proxy Service Features

Computername

computername

Configuring Apple Macintosh clients

Configuring Apple Macintosh Clients

Configuring clients

Web Proxy Clients
About Web Proxy Clients
Configuring the Internet Application in Control Panel
Configuring Microsoft Internet Explorer 3.0 Clients
Configuring Microsoft Internet Explorer 1.5 Clients
Configuring Netscape Navigator Clients
Configuring Apple Macintosh Clients
Configuring UNIX Clients
Configuring the Server’s Browser
Web Proxy Client Considerations
WinSock Proxy Clients
About WinSock Proxy Clients
WinSock Proxy Client Considerations
Using the WSP Client Application
Turning the WinSock Proxy Client On or Off
Updating the WinSock Proxy Client Configuration Files
Creating a Local LAT File
Editing the Mspclnt.ini File
Configuring Windows Sockets Applications

Configuring Microsoft Internet Explorer clients

Configuring Microsoft Internet Explorer 3.0 Clients
Configuring Microsoft Internet Explorer 1.5 Clients

Configuring Netscape Navigator clients

Configuring Netscape Navigator Clients

Configuring UNIX clients

Configuring UNIX Clients

Configuring your network

Setting up Network Adapter Cards
Using TCP/IP Ports
Using DNS, WINS and DHCP with Microsoft Proxy Server
Using Multiple Microsoft Proxy Server Gateways
More About DNS, WINS, and DHCP
LAT Configuration
Dial-Up Support
Using Microsoft Proxy Auto Dial
Other Server Configuration Issues
Securing Your Network
Domain Planning Considerations
Overview of Network Considerations with Microsoft Proxy Server
Considerations for Setting Up Your Private Network
Considerations for Connecting to the Internet

Connected service

Connected Service using TCP Sockets
connected service

Connecting to the Internet

What is an ISP?
What is a Proxy Server?
What is a Gateway?
What is a Client?
What is Microsoft Proxy Server?
Verifying Your Software Configuration
Verifying Your Hardware Configuration
Connecting the Server to the Internet
Assessing Bandwidth Requirements
Selecting Connection Hardware
Selecting an ISP
Analyzing Connection Costs
Web Proxy Service Features
Caching
Network Configuration
Dial-Up Support
Using Microsoft Proxy Auto Dial
Turning the WinSock Proxy Client On or Off
Considerations for Connecting to the Internet
Considerations When Using a Direct Link
Considerations When Using A Dial-Up Link
Managing Your Own Internet Domain
Where to Put DNS Servers on Your Network

Connection information

Connection Information Fields

Connection-less service

Connectionless Service using UDP Sockets

Connectionless service

WinSock Proxy Control Channel
connection-less service
UDP Redirection

Construct Local Address Table dialog box

Replacing the LAT
Construct Local Address Table Dialog Box
Construct Local Address Table Dialog Box

Control channel

WinSock Proxy Control Channel

Control Panel

Reinstalling Microsoft Proxy Server
Removing Microsoft Proxy Server
Microsoft Proxy Server as a DHCP Server
Configuring RAS Options
Reinstalling a Client
Removing Clients
Configuring the Internet Application in Control Panel
Using the WSP Client Application
Turning the WinSock Proxy Client On or Off
Changing the Server Used to Download Client Configuration Files
Defining a System Data Source Name

Controlling user access to Internet sites

Domain Filtering
Controlling Web Proxy User Access to Internet Sites
Controlling WinSock Proxy User Access to Internet Sites

Converting between hexidecimal and decimal values

Reading Hexadecimal Key Values

Cookie

cookie

Corporate network

What is an Intranet?

Counters

Performance Monitor Counters
Using Performance Monitor
Microsoft Proxy Server Counters
Web Proxy Server Cache Counters
Web Proxy Server Service Counters
WinSock Proxy Server Counters

Creating a Local Address Table

What You Need to Know About the LAT
Creating a Local LAT File

Credentials

About Microsoft Proxy Auto Dial
Setting Credentials

Credentials property sheet

Setting Credentials
Setting Dialing Hours

Cryptography

cryptography

Custom LAT table

Creating a Local LAT File

Top D

Daemon

daemon

Data integrity

data integrity

Data Source Name

Defining a System Data Source Name
Data Source Name (DSN)

Database

Logging to a Database
Database Logging Overview
Installing ODBC Drivers
Defining a System Data Source Name
Setting Up Database Tables
Configuring the Service to Log to a Database

Database logging

Logging to a Database
Database Logging Overview
Installing ODBC Drivers
Defining a System Data Source Name
Setting Up Database Tables
Configuring the Service to Log to a Database

Database tables

Setting Up Database Tables
Using the SQL Logging Table Tool
Microsoft SQL Server Table Format

Decimal values expressed in registry

Reading Hexadecimal Key Values
Setting RPC Bindings

Default gateway

Background on Internet Naming and Addressing

Default phone book entry

Creating RAS Phone Book Entries

Default security

Securing Your Network
About Default Inbound Security From the Internet

Default set of predefined protocol configurations

About the Predefined Protocol Configurations

Default values for Microsoft Proxy Server registry entries

Microsoft Proxy Server Registry Entries

Denying access to Internet sites

Domain Filtering
Controlling Web Proxy User Access to Internet Sites
Setting Up WinSock Proxy Users
Controlling WinSock Proxy User Access to Internet Sites
Examples of Domain Filtering
Denying Access to Specified Sites
Web Proxy Deny or Grant Access To Dialog Box
WinSock Proxy Permissions Properties
WinSock Proxy Add Users and Groups Dialog Box
WinSock Proxy Filters Properties

DHCP

What is DHCP?
How does DHCP work?
Using DNS with WINS and DHCP
DHCP

DHCP client

Microsoft Proxy Server as a DHCP Client
What is DHCP?
How does DHCP work?

DHCP relay agent

Microsoft Proxy Server as a DHCP Relay Agent
How does DHCP work?

DHCP Relay property sheet

Microsoft Proxy Server as a DHCP Relay Agent

DHCP server

Microsoft Proxy Server as a DHCP Server
What is DHCP?
How does DHCP work?

DHCP services

Using DNS, WINS and DHCP with Microsoft Proxy Server
Considerations for Using DHCP
Microsoft Proxy Server as a DHCP Server
Microsoft Proxy Server as a DHCP Client
Microsoft Proxy Server as a DHCP Relay Agent
More About DNS, WINS, and DHCP
What is DHCP?
How does DHCP work?

Dial-up access

Assessing Bandwidth Requirements
Dial-Up Support

Dial-up link to the Internet

Considerations When Using A Dial-Up Link

Dial-Up Networking program

Creating RAS Phone Book Entries

Dial-up support

How Dial-Up Support Works
Using RAS with Microsoft Proxy Server
Configuring RAS Options
Creating RAS Phone Book Entries
Considerations When Using A Dial-Up Link

Dialing hours

About Microsoft Proxy Auto Dial
Setting Credentials
Setting Dialing Hours

Dialing Hours property sheet

Setting Dialing Hours

Direct link to the Internet

Considerations When Using a Direct Link

Disable IP forwarding

Server Security Checklist

Disconnecting properly after dialing

RAS Troubleshooting

Disk drives

Setting Up the Disk Drives

Diskperf

Using Performance Monitor

DLL

About the Web Proxy Service
Proxy ISAPI Filter
Proxy ISAPI Application
WinSock Proxy Client Components

DNS

Selecting an ISP
What is DNS?
Filtering Access By DNS Domain Name
Using DNS with WINS and DHCP
Using Multiple DNS Servers
DNS

DNS client

Microsoft Proxy Server as a DNS Client
What is DNS?

DNS servers and services

Using DNS, WINS and DHCP with Microsoft Proxy Server
Considerations for Using DNS
Microsoft Proxy Server as a DNS Server
Microsoft Proxy Server as a DNS Client
Using Multiple Proxy Gateways in a DNS Environment
More About DNS, WINS, and DHCP
What is DNS?
Using DNS with WINS and DHCP
Using Multiple DNS Servers
Considerations When Using a Direct Link
Managing Your Own Internet Domain
Where to Put DNS Servers on Your Network
If you want to provide DNS services for Internet connections only
If you want to provide DNS services for your private network only

DNS spoofing

DNS spoofing

Documentation

About This Book
Installing and Accessing the Documentation
Before installation, to open the online documentation directly from the Microsoft Proxy Server compact disc
Searching the Documentation

Domain

Domain Planning Considerations
Managing Your Own Internet Domain
domain

Domain controller

domain controller

Domain Credentials dialog box

Web Proxy Client Considerations
WinSock Proxy Client Considerations

Domain filtering

Domain Filtering
Filtering Access By DNS Domain Name
Domain Filtering Keys
Examples of Domain Filtering
Denying Access to Specified Sites
Granting Access for Specified Sites
domain filtering

Domain Name System

What is TCP/IP?
Selecting an ISP
Domain Filtering
Using DNS, WINS and DHCP with Microsoft Proxy Server
Considerations for Using DNS
Microsoft Proxy Server as a DNS Server
Microsoft Proxy Server as a DNS Client
More About DNS, WINS, and DHCP
What is DNS?
Filtering Access By DNS Domain Name
Using DNS with WINS and DHCP
Using Multiple DNS Servers
Where to Put DNS Servers on Your Network
Domain Name System (DNS)

Domain names

What is TCP/IP?
Selecting an ISP
What is DNS?
Managing Your Own Internet Domain

DSN

Defining a System Data Source Name
DSN

Dual-boot client

Installing on a Dual-Boot Client

Dynamic Host Configuration Protocol

Using DNS, WINS and DHCP with Microsoft Proxy Server
Considerations for Using DHCP
Microsoft Proxy Server as a DHCP Server
Microsoft Proxy Server as a DHCP Client
Microsoft Proxy Server as a DHCP Relay Agent
More About DNS, WINS, and DHCP
What is DHCP?
How does DHCP work?
Using DNS with WINS and DHCP
Dynamic Host Configuration Protocol (DHCP)

Dynamic-link library

About the Web Proxy Service
Proxy ISAPI Filter
Proxy ISAPI Application
WinSock Proxy Client Components

Top E

Editing the LAT

What is a Local LAT?
How is the LAT Defined?
LAT Configuration Considerations

Enable IP forwarding

Server Security Checklist

Encryption

encryption

Entries for Microsoft Proxy Server services

Domain Filtering Keys
Web Proxy Service Keys
Cache Keys
WinSock Proxy Service Keys
Other Keys Added for Microsoft Proxy Server

Error messages

Web Proxy Service Messages
Web Proxy Client Messages
WinSock Proxy Messages Logged to the System
WinSock Proxy Service Messages Displayed to Clients

Event log

Windows NT Logs

Event Viewer

Windows NT Logs
To view system event messages with Event Viewer

Exchange Server

Microsoft Exchange and Internet Mail Connector

Extending Web server functionality

Proxy ISAPI Filter
Proxy ISAPI Application

External network adapter cards

Configuring the External Network Adapter Card

Top F

FastTips

Information Services

FAT

Setting Up the Disk Drives

Features of Microsoft Proxy Server

Feature Summary
Web Proxy Service Features
WinSock Proxy Service Features

File allocation table

Setting Up the Disk Drives

File Transfer Protocol

Setting WinSock Proxy Port Permissions
Web Proxy Support for Anonymous FTP Clients
Granting Permissions to Proxy Users
File Transfer Protocol (FTP)

File-name extension mapping

file-name extension mapping

Filter

filter

Filtering

Domain Filtering
Controlling Web Proxy User Access to Internet Sites
Controlling WinSock Proxy User Access to Internet Sites
Filtering Access By DNS Domain Name
Filtering Access By IP Address
Web Proxy Filters Properties
WinSock Proxy Filters Properties

Filtering properties of Web Proxy service

Web Proxy Filters Property Sheet

Filtering properties of WinSock Proxy service

WinSock Proxy Filters Property Sheet
WinSock Proxy Deny or Grant Access To Dialog Box

Firewall

firewall

Fresh data

Basic Cache Configuration
fresh data

Fresh installation of Microsoft Proxy Server

Running Server Setup

Friendly name

friendly name

FTP

Setting WinSock Proxy Port Permissions
Web Proxy Support for Anonymous FTP Clients
Granting Permissions to Proxy Users
Examples of GET Usage with Proxy Service
FTP

Functions performed by Microsoft Proxy Server

What is Microsoft Proxy Server?
Feature Summary

Top G

Garbage collection

garbage collection

Gateway

What is a Proxy Server?
What is a Gateway?
Web Proxy Basics
Using Multiple Microsoft Proxy Server Gateways
Multiple Gateway Overview
Using Multiple Proxy Gateways in a DNS Environment
Using Multiple Proxy Gateways in a WINS Environment
Using Multiple WinSock Proxy Service Gateways
gateway

GET

How HTTP Works
How the GET Method Works
Examples of GET Usage with Proxy Service

Global configuration

Configuring Windows Sockets Applications

Gopher

Web Proxy Client Considerations
Examples of GET Usage with Proxy Service
Gopher

Gopher Plus

Web Proxy Client Considerations
Gopher Plus

Gopherspace

Gopherspace

Granting access to Internet sites

Domain Filtering
Controlling Web Proxy User Access to Internet Sites
Setting Up WinSock Proxy Users
Controlling WinSock Proxy User Access to Internet Sites
Examples of Domain Filtering
Granting Access for Specified Sites
Web Proxy Deny or Grant Access To Dialog Box
WinSock Proxy Permissions Properties
WinSock Proxy Add Users and Groups Dialog Box
WinSock Proxy Filters Properties

Top H

Hardware

Hardware Requirements
Verifying Your Hardware Configuration
Setting Up the Disk Drives
Setting Up the Network Adapters
Setting Up a Modem or ISDN Adapter
Selecting Connection Hardware

Header

header

Help

About This Book
Finding Further Information
Microsoft AnswerPoint
Information Services
Standard Support
Priority Support
Text Telephone
Microsoft Service Advantage
Product Support Worldwide
Accessibility for People with Disabilities
Installing and Accessing the Documentation
Before installation, to open the online documentation directly from the Microsoft Proxy Server compact disc
Searching the Documentation

Helper applications

Web Proxy Client Considerations

Hexidecimal values expressed in registry

Reading Hexadecimal Key Values

Hit rate

hit rate

Home directory

home directory

Host files

What is DNS?

Host names

What is TCP/IP?
What is DNS?
Using Broadcasts to Resolve Host Names
Using WINS Service
Using DNS with WINS and DHCP
Using Multiple DNS Servers

How Web Proxy service works

The CERN-Proxy Protocol
Web Proxy Service
Caching Mechanisms

How WinSock Proxy service works

Understanding Windows Sockets and WinSock Proxy
About WinSock Proxy
WinSock Proxy Architecture
WinSock Proxy Client Components
WinSock Proxy Control Channel
TCP Redirection
Using TCP/IP on the Internal Network
Using IPX/SPX on the Internal Network
WinSock Proxy Limitations
UDP Redirection

HTML

What is the World Wide Web?
HTML

HTTP

What is the World Wide Web?
Configuring Netscape Navigator Clients
What is CERN-Proxy?
How HTTP Works
Proxy ISAPI Filter
Proxy ISAPI Application
About Caching
HTTP

HTTP Basic authentication

Client Authentication
About Web Proxy Security
How Basic Authentication Works
What is Basic Authentication?
Enabling Basic Authentication

HTTP errors

Web Proxy Server Problems
Web Proxy Client Problems

HTTP header

Client Authentication

HTTP Keep-Alives

Advantages of the Web Proxy Service

HTTPD server

HTTPD server

Hyperlink

hyperlink

Hypertext

hypertext

Hypertext Markup Language

Hypertext Markup Language (HTML)

Hypertext Transfer Protocol

What is the World Wide Web?
What is CERN-Proxy?
How HTTP Works
Hypertext Transfer Protocol (HTTP)

Top I

IIS

The Default Configuration
Publishing to the Internet
Publishing on Your Private Network
IIS
Web Proxy Client Messages

IIS WWW service

About Web Proxy Security
How Anonymous Logon Works

Implementing cache only

Cache-Only Implementation

Inbound connection

WinSock Proxy Service Features
Restricting Inbound Access From the Internet
About Default Inbound Security From the Internet

Inbound ports

What are TCP/IP ports?
Setting WinSock Proxy Port Permissions
Configuring WinSock Proxy Protocols and Ports

Installing clients

Configuring the Client Setup Program
Installing Clients
Running Client Setup
Reinstalling a Client
Installing on a Dual-Boot Client
Running Client Setup from the Command Line
Reviewing the Client Setup Log

Installing documentation only

Installing and Accessing the Documentation

Installing Microsoft Proxy Server

What Does Setup Install?
Hardware Requirements
Software Requirements
Verifying Your Software Configuration
Verifying Your Hardware Configuration
Installation Overview
What You Need to Know About the LAT
Setting the Web Proxy Listen-On Port
Installing Microsoft Proxy Server
Running Server Setup
Running Server Setup from the Command Line
Reviewing the Server Setup Log
Installing Only the Administration Tool
Setup Logs

Installing search components

Installing the Search Components

Integrated Services Digital Network

Assessing Bandwidth Requirements
Integrated Services Digital Network (ISDN)

Intelligent TTL

Intelligent TTL (Time-to-Live)

Interactive applications

Configuring the Internet Application in Control Panel
interactive applications

Internal network

What is an Intranet?
Using TCP/IP on the Internal Network
Using IPX/SPX on the Internal Network

Internal network adapter cards

Configuring the Internal Network Adapter Card

Internet

What is the Internet?
What is an ISP?
What is a Proxy Server?
What is a Gateway?
Background on Internet Naming and Addressing
Considerations for Connecting to the Internet
Internet

Internet access

What is an ISP?
What is a Proxy Server?
What is a Gateway?
What is a Client?
What is Microsoft Proxy Server?
Verifying Your Software Configuration
Verifying Your Hardware Configuration
Connecting the Server to the Internet
Assessing Bandwidth Requirements
Selecting Connection Hardware
Selecting an ISP
Analyzing Connection Costs
Network Configuration
Using Microsoft Proxy Auto Dial
Controlling Web Proxy User Access to Internet Sites
Controlling WinSock Proxy User Access to Internet Sites
Considerations for Connecting to the Internet
Considerations When Using a Direct Link

Internet application protocols

What is Microsoft Proxy Server?
Connected Service using TCP Sockets
Connectionless Service using UDP Sockets
Web Proxy Permissions Property Sheet
Web Proxy Client Messages

Internet applications

What is CERN-Proxy?
Examples of GET Usage with Proxy Service

Internet connections

Connecting the Server to the Internet
Analyzing Connection Costs
Considerations for Connecting to the Internet
Considerations When Using a Direct Link
Considerations When Using A Dial-Up Link
Managing Your Own Internet Domain
Where to Put DNS Servers on Your Network

Internet domain name

Managing Your Own Internet Domain

Internet Explorer

What is the World Wide Web?
Configuring Microsoft Internet Explorer 3.0 Clients
Configuring Microsoft Internet Explorer 1.5 Clients

Internet Information Server

The Default Configuration
Publishing to the Internet
Publishing on Your Private Network
Internet Information Server (IIS)
Web Proxy Client Messages

Internet Mail Connector

Microsoft Exchange and Internet Mail Connector

Internet Network Information Center

Internet Network Information Center (InterNIC)

Internet objects

Setting Up Caching of Internet Objects
Setting the Advanced Options for the Cache
Object Information Fields

Internet Protocol

What is TCP/IP?
Internet Protocol (IP)

Internet Protocol address

Selecting an ISP
What is the LAT?
What is a Local LAT?
How is the LAT Defined?
LAT Configuration Considerations
Background on Internet Naming and Addressing
Overview of LAT Configuration
Replacing the LAT
Controlling WinSock Proxy User Access to Internet Sites
Creating a Local LAT File
When Modifying the Local Address Table
Filtering Access By IP Address
Local Address Table Configuration Dialog Box
Construct Local Address Table Dialog Box
Internet Protocol (IP) address

Internet publishing

Internet Publishing with Microsoft Proxy Server
How to Enable Internet Publishing
Further Suggestions Before Publishing

Internet Relay Chat

Internet Relay Chat (IRC)

Internet Server Application Programming Interface

About the Web Proxy Service
Proxy ISAPI Filter
Proxy ISAPI Application
Internet Server Application Programming Interface (ISAPI)

Internet Service Manager

Installing Only the Administration Tool
Installing and Accessing the Documentation
Server Administration Overview
Using Internet Service Manager
Setting Up Caching of Internet Objects
Logging Web Proxy Service Activity
Registry Editor

Internet Service Providers

What is an ISP?
Selecting an ISP
Internet Service Providers (ISPs)

Internet site accessibility

Controlling Web Proxy User Access to Internet Sites
Turning the WinSock Proxy Client On or Off

Internet-based client software

What is a Client?

Internetwork Packet Exchange

Internetwork Packet Exchange (IPX)

InterNIC

InterNIC

Intranet

What is an Intranet?
What is a Proxy Server?
What is a Gateway?
What is Microsoft Proxy Server?
Installation Overview
What You Need to Know About the LAT
Securing Your Network
Overview of Network Considerations with Microsoft Proxy Server
Considerations for Setting Up Your Private Network
Considerations for Connecting to the Internet
Publishing on Your Private Network
intranet

IP

What is TCP/IP?
IP

IP address

Selecting an ISP
What is the LAT?
What is a Local LAT?
How is the LAT Defined?
LAT Configuration Considerations
Background on Internet Naming and Addressing
Overview of LAT Configuration
Replacing the LAT
Controlling WinSock Proxy User Access to Internet Sites
Creating a Local LAT File
When Modifying the Local Address Table
Filtering Access By IP Address
Local Address Table Configuration Dialog Box
Construct Local Address Table Dialog Box
Local Address Table Configuration Dialog Box
IP address

IP application gateway for IPX networks

How WinSock Proxy Security Works

IP forwarding

Server Security Checklist
About Default Inbound Security From the Internet

IPX

Web Proxy Client Considerations
Using IPX/SPX on the Internal Network

IPX/SPX

WinSock Proxy Service Features
Using IPX/SPX on the Internal Network
IPX/SPX

ISAPI

About the Web Proxy Service
Proxy ISAPI Filter
Proxy ISAPI Application
ISAPI

ISAPI application

About the Web Proxy Service
Proxy ISAPI Application

ISAPI filter interface

About the Web Proxy Service
Proxy ISAPI Filter

ISDN

Assessing Bandwidth Requirements
ISDN

ISDN adapter

Setting Up a Modem or ISDN Adapter
RAS and Microsoft Proxy Server
Setting Up an ISDN Adapter
Assessing Bandwidth Requirements
Selecting Connection Hardware

ISDN line

Assessing Bandwidth Requirements

ISPs

What is an ISP?
Selecting an ISP

Top K

Keep-Alives

Advantages of the Web Proxy Service

Keys

Domain Filtering Keys
Web Proxy Service Keys
Cache Keys
WinSock Proxy Service Keys
Other Keys Added for Microsoft Proxy Server
Current Version
SNMP

Top L

LAN

What is an Intranet?
LAN

LAT

What You Need to Know About the LAT
What is the LAT?
What is a Local LAT?
How is the LAT Defined?
LAT Configuration Considerations
Running Server Setup
Server Administration Overview
LAT Configuration
Overview of LAT Configuration
Modifying the LAT
Replacing the LAT
Creating a Local LAT File
When Modifying the Local Address Table
Local Address Table Configuration Dialog Box
Construct Local Address Table Dialog Box
Local Address Table Configuration Dialog Box
Construct Local Address Table Dialog Box
LAT

Lease period

What is DHCP?

Leased line

leased line

Least Recently Used

Least Recently Used (LRU)

Limiting client access to the Internet

Using the WSP Client Application
Turning the WinSock Proxy Client On or Off
Web Proxy Deny or Grant Access To Dialog Box
Publishing to the Internet

Link

link

Listen-on port

Setting the Web Proxy Listen-On Port

Listing the IP addresses on your private network

What is the LAT?

LMHOSTS file

Considerations for Using WINS
LMHOSTS file

Load balancing for your network

Multiple Gateway Overview
Using Multiple Proxy Gateways in a DNS Environment
Using Multiple WinSock Proxy Service Gateways

Local Address Table

What You Need to Know About the LAT
What is the LAT?
What is a Local LAT?
How is the LAT Defined?
LAT Configuration Considerations
Running Server Setup
LAT Configuration
Overview of LAT Configuration
Modifying the LAT
Replacing the LAT
Creating a Local LAT File
When Modifying the Local Address Table
Local Address Table Configuration Dialog Box
Construct Local Address Table Dialog Box
Local Address Table Configuration Dialog Box
Construct Local Address Table Dialog Box
Local Address Table (LAT)

Local Address Table Configuration dialog box

What You Need to Know About the LAT
How is the LAT Defined?
LAT Configuration Considerations
Running Server Setup
Modifying the LAT
Replacing the LAT
Local Address Table Configuration Dialog Box
Construct Local Address Table Dialog Box
Local Address Table Configuration Dialog Box

Local area network

What is an Intranet?
Local Area Network (LAN)

Local copy of Web objects

Caching

Local LAT

What is a Local LAT?
Creating a Local LAT File

Log entries

Log Field Summary
Client Information Fields
Server Information Fields

Log fields

Log Field Summary
Client Information Fields
Server Information Fields

Log file

log file

Logging

Logging WinSock Proxy Service Activity
Setup Logs
The Server Setup Log
The Client Setup Log
Microsoft Proxy Server Logs
Logging Overview
Logging to a File
Logging to a Database
Log Fields
logging

Logging capabilities

Microsoft Proxy Server Logs
Logging Overview
Logging to a Database
Log Fields
Logging Issues

Logging client installation

Reviewing the Client Setup Log
The Client Setup Log

Logging during Microsoft Proxy Server installation

Reviewing the Server Setup Log
The Server Setup Log

Logging information about Internet requests

Logging Web Proxy Service Activity
Logging WinSock Proxy Service Activity
Log Fields

Logging parameters

Logging WinSock Proxy Service Activity
Logging to a File

Logging properties of Web Proxy service

Web Proxy Logging Properties

Logging properties of WinSock Proxy service

WinSock Proxy Logging Properties

Logging services

Logging Overview
Logging to a File
Logging to a Database
Configuring the Service to Log to a Database
Log Fields
Logging Issues

Logging to a database

Logging WinSock Proxy Service Activity
Logging to a Database
Database Logging Overview
Installing ODBC Drivers
Defining a System Data Source Name
Setting Up Database Tables
Configuring the Service to Log to a Database

Logging to a text file

Logging WinSock Proxy Service Activity
Logging to a File

LRU

LRU

Top M

Macintosh clients

Configuring Apple Macintosh Clients

Management Information Database

Management Information Database (MIB)
SNMP

Member server

member server

Messages

Web Proxy Service Messages
Web Proxy Client Messages
WinSock Proxy Messages Logged to the System
WinSock Proxy Service Messages Displayed to Clients
Setup Messages

Methods

How HTTP Works
How the GET Method Works
Examples of GET Usage with Proxy Service

Metric

metric

MIB

SNMP MIBs
MIB

Microsoft Access table format

Microsoft Access Table Format

Microsoft AnswerPoint

Microsoft AnswerPoint
Information Services
Priority Support

Microsoft Developer Network

Finding Further Information

Microsoft Developer Network Library

Information Services

Microsoft DHCP Server

Microsoft Proxy Server as a DHCP Server

Microsoft Download Service

Information Services

Microsoft Exchange

Microsoft Exchange and Internet Mail Connector
WinSock Proxy Client Considerations

Microsoft FastTips

Information Services

Microsoft Index Server

Microsoft AnswerPoint
Searching the Documentation
Installing the Search Components

Microsoft Internet Explorer

What is the World Wide Web?
Configuring Microsoft Internet Explorer 3.0 Clients
Configuring Microsoft Internet Explorer 1.5 Clients

Microsoft Internet Information Server

The Default Configuration
Publishing to the Internet
Publishing on Your Private Network
Web Proxy Client Messages

Microsoft Internet Service Manager

Installing Only the Administration Tool
Installing and Accessing the Documentation
Server Administration Overview
Using Internet Service Manager
Setting Up Caching of Internet Objects
Logging Web Proxy Service Activity
Registry Editor

Microsoft Network

Information Services

Microsoft Proxy Auto Dial utility

How Dial-Up Support Works
Using Microsoft Proxy Auto Dial
About Microsoft Proxy Auto Dial
Setting Credentials
Setting Dialing Hours
Restarting Services After a Dial-Up Connection

Microsoft Proxy Server

What is a Proxy Server?
What is Microsoft Proxy Server?
What Does Setup Install?
Installing Microsoft Proxy Server
Removing Microsoft Proxy Server
Installing Only the Administration Tool
Installing and Accessing the Documentation
Feature Summary
Network Configuration
Using DNS, WINS and DHCP with Microsoft Proxy Server
Using RAS with Microsoft Proxy Server
Cache-Only Implementation
Security Overview
Domain Planning Considerations
Microsoft Proxy Server Logs
Overview of Network Considerations with Microsoft Proxy Server
Performance Troubleshooting
Web Proxy Service
How the WinSock Proxy Service Works
WinSock Proxy Service Properties
Publishing to the Internet

Microsoft Proxy Server Cache Drives dialog box

Basic Cache Configuration
Changing the Drives and Space Allocated to the Cache
Microsoft Proxy Server Cache Drives Dialog Box

Microsoft Proxy Server counters

Microsoft Proxy Server Counters
About the Microsoft Proxy Server Objects
Web Proxy Server Cache Counters
Web Proxy Server Service Counters
WinSock Proxy Server Counters

Microsoft Proxy Server documentation

Installing and Accessing the Documentation
Before installation, to open the online documentation directly from the Microsoft Proxy Server compact disc
Searching the Documentation

Microsoft Proxy Server logs

The Server Setup Log
The Client Setup Log
Logging to a File
Logging to a Database
Log Fields
Logging Issues

Microsoft Proxy Server objects

About the Microsoft Proxy Server Objects

Microsoft Proxy Server registry entries

Microsoft Proxy Server Registry Entries
Domain Filtering Keys
Web Proxy Service Keys
Cache Keys
WinSock Proxy Service Keys
Other Keys Added for Microsoft Proxy Server

Microsoft Proxy Server troubleshooting

Web Proxy Service Troubleshooting
WinSock Proxy Service Troubleshooting
Performance Troubleshooting
RAS Troubleshooting

Microsoft Service Advantage

Microsoft Service Advantage
Direct Services
Product Support Worldwide

Microsoft SQL Server table format

Microsoft SQL Server Table Format

Microsoft TCP/IP Properties sheet

Advanced TCP/IP Security with Windows NT

Microsoft TechNet

Finding Further Information
Information Services

Microsoft WinSock Proxy Client dialog box

Turning the WinSock Proxy Client On or Off
Changing the Server Used to Download Client Configuration Files
Updating the WinSock Proxy Client Configuration Files

MIME mapping

MIME mapping

Mkplog.exe

Using the SQL Logging Table Tool

Modem

Setting Up a Modem or ISDN Adapter
RAS and Microsoft Proxy Server
Setting Up a Modem
Selecting Connection Hardware

Modifying the LAT

Modifying the LAT

Monitoring performance

Using Performance Monitor
Performance Troubleshooting

Monitoring your system

Setup Logs
Microsoft Proxy Server Logs
Log Fields
Log Field Summary
Logging Issues
Windows NT Logs
Performance Monitor Counters
Microsoft Proxy Server Counters
SNMP MIBs

Mpcsetup.log

Reviewing the Client Setup Log
The Client Setup Log
Setup Messages

MPR

How WinSock Proxy Security Works

Mpssetup.log

The Server Setup Log
Setup Messages

MSDL

Information Services

MSN

Information Services

Mspclnt.ini file

Editing the Mspclnt.ini File

Multi-homed environment

Using Multiple Proxy Gateways in a WINS Environment

Multi-Protocol Routing

How WinSock Proxy Security Works

Multiple Proxy gateways

Using Multiple Microsoft Proxy Server Gateways
Multiple Gateway Overview
Using Multiple Proxy Gateways in a DNS Environment
Using Multiple Proxy Gateways in a WINS Environment
Using Multiple WinSock Proxy Service Gateways

Multipurpose Internet Mail Extension mapping

Multipurpose Internet Mail Extension (MIME) mapping

Top N

Name resolution

More About DNS, WINS, and DHCP
Using Broadcasts to Resolve Host Names
Using WINS Service
Using DNS with WINS and DHCP
Using Multiple DNS Servers
name resolution

Name space

What is DNS?

Negative caching

negative caching

NetBIOS

Using Broadcasts to Resolve Host Names

Netscape Navigator

Configuring Netscape Navigator Clients
Web Proxy Client Problems

Network adapter cards

Setting Up the Network Adapters
Setting up Network Adapter Cards
Setup Considerations When Using Two Adapters
Configuring the External Network Adapter Card
Configuring the Internal Network Adapter Card
Setup Considerations When Using a Single Adapter
When Setting TCP/IP Properties for Network Adapter Cards

Network configuration

Server Administration Overview
Setting up Network Adapter Cards
Using TCP/IP Ports
Using DNS, WINS and DHCP with Microsoft Proxy Server
Using Multiple Microsoft Proxy Server Gateways
More About DNS, WINS, and DHCP
LAT Configuration
Dial-Up Support
Using Microsoft Proxy Auto Dial
Other Server Configuration Issues
Securing Your Network
Domain Planning Considerations
Overview of Network Considerations with Microsoft Proxy Server
Considerations for Setting Up Your Private Network
Considerations for Connecting to the Internet

Network News Transfer Protocol

Network News Transfer Protocol (NNTP)

Network Properties dialog box

Configuring RAS Options
Using RAS Server and Microsoft Proxy Server

Never cache

Setting the Advanced Options for the Cache
Cache Filter Properties Dialog Box

New list of IP addresses

Replacing the LAT

NNTP

NNTP

NTFS

Software Requirements
Setting Up the Disk Drives

Top O

Object modification checking

object modification checking

Object-cache scavenger

object-cache scavenger

ODBC drivers

Installing ODBC Drivers
Defining a System Data Source Name

ODBC-compliant database

Logging Web Proxy Service Activity
Logging WinSock Proxy Service Activity
Database Logging Overview
Installing ODBC Drivers
Defining a System Data Source Name

On-demand caching

Passive Caching

On-demand dial-out

Server Administration Overview

Ongoing link to the Internet

Considerations When Using a Direct Link

Online documentation

Installing and Accessing the Documentation
Before installation, to open the online documentation directly from the Microsoft Proxy Server compact disc

OOB

WinSock Proxy Limitations

Open Database Connectivity

Open Database Connectivity (ODBC)

Out-Of-Band data transfer

WinSock Proxy Limitations

Outbound connection

WinSock Proxy Service Features
Restricting Outbound Access From Your Network
Overview of Outbound Access Security Options
Using Groups to Assign Internal User Permissions

Outbound ports

What are TCP/IP ports?
Setting WinSock Proxy Port Permissions
Configuring WinSock Proxy Protocols and Ports

Top P

Packet

packet

Page

What is the World Wide Web?
page

Passive caching

Caching
Passive Caching
passive caching

Password authentication

Selecting the Client Authentication Method
password authentication

PDC

PDC

Peer Web Services

Peer Web Services

People with disabilities

Accessibility for People with Disabilities

Performance Monitor

Performance Monitor Counters
Using Performance Monitor

Performance Monitor counters

Using Performance Monitor

Performance Monitor objects

Using Performance Monitor

Performance troubleshooting

Performance Troubleshooting

Permission properties of Web Proxy service

Web Proxy Permissions Property Sheet
Web Proxy Add Users and Groups Dialog Box

Permission properties of WinSock Proxy service

WinSock Proxy Permissions Property Sheet
Protocol Selection Dialog Box

Permission rights for users to Web Proxy and WinSock Proxy services

Considerations For Planning Windows NT Groups
Assigning Groups to Service Permissions
Setting Access Control for the Web Proxy Service
Web Proxy Permissions Property Sheet
Web Proxy Add Users and Groups Dialog Box
WinSock Proxy Permissions Property Sheet
Protocol Selection Dialog Box

Phone book entries

Creating RAS Phone Book Entries
Setting Credentials
Setting Dialing Hours

Ping utility

Ping and Tracert
WinSock Proxy Server Problems

Point-to-point connection-oriented communication

TCP Redirection

Point-to-Point Protocol

Point to Point Protocol (PPP)

Point-to-Point Tunneling Protocol

Using PPTP and Microsoft Proxy Server

Policies

policies

Pop-up messages

Web Proxy Service Messages

Port number

port number

Port Range Definition dialog box

Setting Up Protocol Configurations
Port Range Definition Dialog Box

Ports

Using TCP/IP Ports
What are TCP/IP ports?
Setting WinSock Proxy Port Permissions
Configuring WinSock Proxy Protocols and Ports

POST

How HTTP Works

PPTP

Using PPTP and Microsoft Proxy Server

Predefined protocol configurations

About the Predefined Protocol Configurations

Preinstallation requirements for Microsoft Proxy Server

Hardware Requirements
Software Requirements
Before You Install
Verifying Your Software Configuration
Verifying Your Hardware Configuration
Server Security Checklist
Connecting the Server to the Internet

Preventing Internet users from connecting to your private network

What is a Gateway?
Security Overview

Primary Domain Controller

Software Requirements
Primary Domain Controller (PDC)

Private network

What is an Intranet?
What is a Gateway?
What is Microsoft Proxy Server?
Installation Overview
What You Need to Know About the LAT
LAT Configuration
Security Overview
Securing Your Network
Overview of Network Considerations with Microsoft Proxy Server
Considerations for Setting Up Your Private Network
Considerations for Connecting to the Internet
Managing Your Own Internet Domain
Performance Troubleshooting
Using TCP/IP on the Internal Network
Using IPX/SPX on the Internal Network
Publishing to the Internet
Publishing on Your Private Network

Problems with Web Proxy

Web Proxy Server Problems
Web Proxy Client Problems

Problems with WinSock Proxy

WinSock Proxy Service Troubleshooting
WinSock Proxy Diagnostic Utility
WinSock Proxy Server Problems
WinSock Proxy Client Problems

Problems with your system

Web Proxy Service Troubleshooting
WinSock Proxy Service Troubleshooting
Performance Troubleshooting
RAS Troubleshooting

Product support

About This Book
Finding Further Information
Microsoft AnswerPoint
Information Services
Standard Support
Priority Support
Text Telephone
Microsoft Service Advantage
Direct Services
Product Support Worldwide
Installing and Accessing the Documentation
Before installation, to open the online documentation directly from the Microsoft Proxy Server compact disc
Searching the Documentation

Program file

program file

Properties of Web Proxy service

Web Proxy Service Property Sheet
User Sessions Dialog Box
Local Address Table Configuration Dialog Box
Web Proxy Permissions Properties
Web Proxy Caching Properties
Web Proxy Logging Properties
Web Proxy Filters Properties

Properties of WinSock Proxy service

WinSock Proxy Service Property Sheet
Local Address Table Configuration Dialog Box
Construct Local Address Table Dialog Box
WinSock Proxy Protocols Properties
WinSock Proxy Permissions Properties
WinSock Proxy Logging Properties
WinSock Proxy Filters Properties

Property sheets for Web Proxy service

Web Proxy Service Property Sheet
Web Proxy Permissions Property Sheet
Web Proxy Caching Property Sheet
Web Proxy Logging Properties
Web Proxy Filters Properties

Property sheets for WinSock Proxy service

Opening the Administrative Interface for the WinSock Proxy Service
WinSock Proxy Service Property Sheet
WinSock Proxy Protocols Property Sheet
WinSock Proxy Permissions Property Sheet

Protecting your private network

What is a Gateway?
Server Security Checklist
Security Overview
Web Proxy Security
WinSock Proxy Security
Securing Your Network
Restricting Inbound Access From the Internet
Domain Planning Considerations
Restricting Outbound Access From Your Network
Publishing to the Internet

Protocol

protocol

Protocol Definition dialog box

Setting Up Protocol Configurations
Protocol Definition Dialog Box

Protocol properties of WinSock Proxy service

WinSock Proxy Protocols Property Sheet
Protocol Definition Dialog Box
Port Range Definition Dialog Box

Protocol Selection dialog box

Protocol Selection Dialog Box

Protocols

What is TCP/IP?
Granting Permissions to Proxy Users
Configuring WinSock Proxy Protocols and Ports
Setting Up Protocol Configurations
About the Predefined Protocol Configurations
WinSock Proxy Protocols Properties

Proxies

Using Groups to Assign Internal User Permissions

Proxies property sheet

Configuring Netscape Navigator Clients

Proxy

Web Proxy Basics
proxy

Proxy client

Web Proxy Client Problems
proxy client

Proxy host

proxy host

Proxy ISAPI application

Domain Filtering
About the Web Proxy Service
Proxy ISAPI Application
Proxy ISAPI Application

Proxy ISAPI filter

About the Web Proxy Service
Proxy ISAPI Filter
Proxy ISAPI Filter

Proxy permissions

Granting Permissions to Proxy Users

Proxy protocols

Granting Permissions to Proxy Users
Web Proxy Permissions Property Sheet
Web Proxy Add Users and Groups Dialog Box

Proxy server

What is a Proxy Server?
Web Proxy Server Problems

Proxy service

Web Proxy Basics

Proxy users

Creating New Groups For Proxy Users
Setting Up Proxy Users
Selecting the Client Authentication Method
Granting Permissions to Proxy Users
Controlling Web Proxy User Access to Internet Sites

Publishing on your private network

Publishing on Your Private Network

Publishing to the Internet

Internet Publishing with Microsoft Proxy Server
How to Enable Internet Publishing
Further Suggestions Before Publishing

Putting users in Windows NT groups

Server Administration Overview
Considerations For Planning Windows NT Groups
Creating New Groups For Proxy Users
Assigning Groups to Service Permissions

Top Q

Query

Installing the Search Components

Top R

RAS

RAS and Microsoft Proxy Server
Setting Up RAS
How Dial-Up Support Works
Using RAS with Microsoft Proxy Server
Configuring RAS Options
Creating RAS Phone Book Entries
Other RAS-Related Issues
Using RAS Server and Microsoft Proxy Server
RAS Troubleshooting
RAS

RAS client

Setting Up RAS
How Dial-Up Support Works
Using RAS Server and Microsoft Proxy Server

RAS phone book entries

Creating RAS Phone Book Entries
Setting Credentials
Setting Dialing Hours
RAS Troubleshooting

RAS server

Using RAS Server and Microsoft Proxy Server

RealAudio

Web Proxy Client Problems
RealAudio

Redirected TCP connection

TCP Redirection

Reducing security risks

What is a Proxy Server?
What is a Gateway?
Server Security Checklist

Registering events for active services

Windows NT Logs

Registry Editor

Registry Editor
Reading Hexadecimal Key Values

Registry entries

Registry Editor
Reading Hexadecimal Key Values
Microsoft Proxy Server Registry Entries

Regular logging

Logging Web Proxy Service Activity
Logging Overview
Log Field Summary

Reinstalling clients

Reinstalling a Client

Reinstalling Microsoft Proxy Server

Reinstalling Microsoft Proxy Server

Remote Access Service

RAS and Microsoft Proxy Server
Setting Up RAS
How Dial-Up Support Works
Using RAS with Microsoft Proxy Server
Configuring RAS Options
Creating RAS Phone Book Entries
Other RAS-Related Issues
Using RAS Server and Microsoft Proxy Server
Remote Access Service (RAS)

Remote administration

Installing Only the Administration Tool
remote administration

Remote Procedure Call

Remote Procedure Call (RPC)

Removing clients

Removing Clients

Removing Microsoft Proxy Server

Removing Microsoft Proxy Server

Removing Microsoft Proxy Server components

Reinstalling Microsoft Proxy Server

Replacing the LAT

Replacing the LAT

Restarting services

Restarting Services After a Dial-Up Connection

Restarting Web Proxy services

Restarting Services After a Dial-Up Connection

Restarting WinSock Proxy services

Restarting Services After a Dial-Up Connection

Restoring missing files

Reinstalling Microsoft Proxy Server

Restoring the registry

Registry Editor

Restricting inbound access

Restricting Inbound Access From the Internet
About Default Inbound Security From the Internet
Domain Planning Considerations

Restricting outbound access

Restricting Outbound Access From Your Network
Overview of Outbound Access Security Options
Filtering Access By DNS Domain Name
Filtering Access By IP Address
Using Groups to Assign Internal User Permissions

Retrieve rate

retrieve rate

Router

Selecting Connection Hardware
router

RPC

RPC

RpcBindings

Setting RPC Bindings

Running WinSock Proxy diagnostic utility

WinSock Proxy Diagnostic Utility

Top S

Scope

What is DHCP?

Script

script

Search

Installing the Search Components

Secure Sockets Layer

Web Proxy Basics
Secure Sockets Layer (SSL)

Securing your private network

What is a Proxy Server?
What is a Gateway?
Server Security Checklist
Security Overview
Web Proxy Security
WinSock Proxy Security
Securing Your Network
Restricting Inbound Access From the Internet
Domain Planning Considerations
Restricting Outbound Access From Your Network
Publishing to the Internet

Security

What is a Gateway?
Server Security Checklist
LAT Configuration Considerations
Security Overview
Web Proxy Security
WinSock Proxy Security
Considerations for WinSock Proxy Security
Securing Your Network
Restricting Inbound Access From the Internet
Restricting Outbound Access From Your Network
Publishing to the Internet

Sequenced Packet Exchange

Sequenced Packet Exchange (SPX)

Serial Line Interface Protocol

Serial Line Interface Protocol (SLIP)

Server

What is Microsoft Proxy Server?
Connecting the Server to the Internet
Microsoft Proxy Server as a DNS Server
Microsoft Proxy Server as a WINS Server
Configuring the Server’s Browser
Changing the Server Used to Download Client Configuration Files
Server Information Fields
Web Proxy Server Problems
WinSock Proxy Server Problems

Server administration

Server Administration Overview
Using Internet Service Manager

Server Message Block protocol

Server Message Block (SMB) protocol

Service

service

Service logs

Logging Overview
Logging to a File
Logging to a Database
Configuring the Service to Log to a Database
Log Fields
Logging Issues

Services Properties dialog box

Configuring RAS Options

Setting dialing hours

Setting Dialing Hours

Setting Microsoft DHCP Server bindings

Microsoft Proxy Server as a DHCP Server

Setting up clients

What is the LAT?
Configuring the Client Setup Program
Installing Clients
Running Client Setup
Reinstalling a Client
Installing on a Dual-Boot Client
Running Client Setup from the Command Line
Reviewing the Client Setup Log
Web Proxy Clients
Configuring Microsoft Internet Explorer 3.0 Clients
Configuring Microsoft Internet Explorer 1.5 Clients
Configuring Netscape Navigator Clients
WinSock Proxy Clients
Creating a Local LAT File
Editing the Mspclnt.ini File
Configuring Windows Sockets Applications

Setting up your private network

What Does Setup Install?
Installation Overview
What You Need to Know About the LAT
Installing Microsoft Proxy Server
Setup Logs
Considerations for Setting Up Your Private Network

Setup

What Does Setup Install?
Hardware Requirements
Software Requirements
Verifying Your Software Configuration
Verifying Your Hardware Configuration
Installation Overview
What You Need to Know About the LAT
Setting the Web Proxy Listen-On Port
Installing Microsoft Proxy Server
Running Server Setup
Running Server Setup from the Command Line
Reviewing the Server Setup Log
Reinstalling Microsoft Proxy Server
Removing Microsoft Proxy Server
Installing Only the Administration Tool
About the Predefined Protocol Configurations
Configuring the Client Setup Program
Setup Logs
Setup Messages

Setup log

Reviewing the Server Setup Log
Setup Logs
The Server Setup Log
Setup Messages

Simple Mail Transfer Protocol

What is TCP/IP?
Simple Mail Transfer Protocol (SMTP)

Simple Network Management Protocol

SNMP MIBs
Simple Network Management Protocol (SNMP)

Single network adapter connection

Setup Considerations When Using a Single Adapter

Slow network connection

Performance Troubleshooting

SMTP

What is TCP/IP?
SMTP

SNMP

SNMP MIBs
SNMP

SNMP Management Information Base

SNMP MIBs

Socket

About Windows Sockets
Connected Service using TCP Sockets
Connectionless Service using UDP Sockets
socket

Software

Software Requirements
Verifying Your Software Configuration

Space allocated to the cache

Changing the Drives and Space Allocated to the Cache

Specifying Microsoft Proxy Server name

Configuring the Internet Application in Control Panel

Specifying Microsoft Proxy Server protocol port number

Configuring the Internet Application in Control Panel

SPX

SPX

SQL logging table tool

Using the SQL Logging Table Tool
Microsoft SQL Server Table Format

SQL Server table format

Microsoft SQL Server Table Format

SQL/ODBC database

Database Logging Overview

SSL

Web Proxy Basics

SSL security

SSL security

Stale data

Caching
stale data

Standard Proxy Protocol

Standard Proxy Protocol

Starting Performance Monitor

Using Performance Monitor

Starting Registry Editor

Registry Editor

Starting Setup from the command line

Running Server Setup from the Command Line

Static IP addressing

Background on Internet Naming and Addressing

Static page

static page

Stop caching

Turning Off the Cache

Subnet mask

Background on Internet Naming and Addressing
subnet mask

Subsequent connections

Port Range Definition Dialog Box

System architecture

How the Web Proxy Service Works
How the WinSock Proxy Service Works

System logged messages

Web Proxy Service Messages
WinSock Proxy Messages Logged to the System

System registry

Registry Editor
Reading Hexadecimal Key Values
Microsoft Proxy Server Registry Entries

System requirements

Hardware Requirements
Software Requirements

Top T

T1 line

Assessing Bandwidth Requirements

Tag files

tag files

TCP

What is TCP/IP?
What are TCP/IP ports?
Connected Service using TCP Sockets
TCP Redirection

TCP socket

Connected Service using TCP Sockets

TCP/IP

What is the Internet?
What is TCP/IP?
What is an Intranet?
Web Proxy Basics
Background on Internet Naming and Addressing
When Setting TCP/IP Properties for Network Adapter Cards
Overview of Network Considerations with Microsoft Proxy Server
Considerations for Setting Up Your Private Network
What is CERN-Proxy?
Using TCP/IP on the Internal Network
TCP/IP
Advanced TCP/IP Security with Windows NT

TCP/IP Advanced Configuration dialog box

Web Proxy Basics

TCP/IP ports

Using TCP/IP Ports
What are TCP/IP ports?
Setting WinSock Proxy Port Permissions
Advanced TCP/IP Security with Windows NT

Text file

Logging Web Proxy Service Activity
Logging to a File

Text file logging

Logging to a File

Text telephone

Text Telephone

Time-To-Live

Caching
Basic Cache Configuration
Active Caching
Time-to-Live (TTL)

Top-level domain names

What is TCP/IP?

Tracert utility

Ping and Tracert

Tracking performance

Using Performance Monitor
Performance Troubleshooting

Transmission Control Protocol

What is TCP/IP?
What are TCP/IP ports?
TCP Redirection
Transmission Control Protocol (TCP)

Transmission Control Protocol/Internet Protocol

What is TCP/IP?
Using TCP/IP Ports
Considerations for Setting Up Your Private Network
What is CERN-Proxy?
Transmission Control Protocol/Internet Protocol (TCP/IP)
Advanced TCP/IP Security with Windows NT

Troubleshooting

Ping and Tracert
Web Proxy Service Troubleshooting
WinSock Proxy Service Troubleshooting
Performance Troubleshooting
RAS Troubleshooting

Troubleshooting Web Proxy service

Web Proxy Service Troubleshooting
Web Proxy Server Problems
Web Proxy Client Problems

Troubleshooting WinSock Proxy service

WinSock Proxy Service Troubleshooting
WinSock Proxy Diagnostic Utility
WinSock Proxy Server Problems
WinSock Proxy Client Problems

TTL

Caching
Basic Cache Configuration
Active Caching

Turning off the cache

Turning Off the Cache

Two network adapter cards

Setup Considerations When Using Two Adapters

Top U

UDP

What are TCP/IP ports?
Connectionless Service using UDP Sockets
WinSock Proxy Control Channel
UDP
UDP Redirection

UDP socket

Connectionless Service using UDP Sockets
UDP Redirection

Uniform Resource Locator

Setting the Advanced Options for the Cache
How the GET Method Works
Cache Filter Properties Dialog Box
Uniform Resource Locator (URL)

Uninstall Proxy Client dialog box

Removing Clients

Uninstalling clients

Removing Clients

Uninstalling Microsoft Proxy Server

Removing Microsoft Proxy Server

UNIX

Configuring UNIX Clients

Updating client configuration files

Updating the WinSock Proxy Client Configuration Files

URL

Setting the Advanced Options for the Cache
How the GET Method Works
Cache Filter Properties Dialog Box
URL

Usenet

Usenet

User authentication

Client Authentication

User Datagram Protocol

What are TCP/IP ports?
Connectionless Service using UDP Sockets
WinSock Proxy Control Channel
User Datagram Protocol (UDP)
UDP Redirection

User Manager

Using Groups to Assign Internal User Permissions

User Manager for Domains

Server Security Checklist
Creating New Groups For Proxy Users
Using Groups to Assign Internal User Permissions

User permissions for Microsoft Proxy Server

Considerations For Planning Windows NT Groups
Creating New Groups For Proxy Users

User Sessions dialog box

User Sessions Dialog Box

Top V

VDOLine Player

VDOLive Player

Verbose logging

Logging Web Proxy Service Activity
Logging Overview
Log Field Summary

Verifying RAS client for dial-up support

Configuring RAS Options

Virtual directory

virtual directory

Volatile objects

volatile objects

Top W

WAN

What is an Intranet?
WAN

Web browser

Running Client Setup
About Web Proxy Clients
Configuring the Server’s Browser
Web Proxy Client Considerations
Web browser

Web browsing

What is the World Wide Web?
Performance Troubleshooting

Web objects

Caching
Caching Mechanisms

Web page

What is the World Wide Web?
Web page

Web Proxy

How the Web Proxy Service Works
The CERN-Proxy Protocol
How HTTP Works
How the GET Method Works
Web Proxy Service
Caching Mechanisms

Web Proxy Add Users and Groups dialog box

Web Proxy Add Users and Groups Dialog Box

Web Proxy authentication method

Selecting the Client Authentication Method

Web Proxy Caching property sheet

Web Proxy Caching Properties
Web Proxy Caching Property Sheet

Web Proxy clients

Running Server Setup
Web Proxy Clients
About Web Proxy Clients
Configuring the Internet Application in Control Panel
Configuring Microsoft Internet Explorer 3.0 Clients
Configuring Microsoft Internet Explorer 1.5 Clients
Configuring Netscape Navigator Clients
Configuring Apple Macintosh Clients
Configuring UNIX Clients
Configuring the Server’s Browser
Web Proxy Client Considerations
Web Proxy Client Messages

Web Proxy Deny or Grant Access To dialog box

Web Proxy Deny or Grant Access To Dialog Box

Web Proxy Filters property sheet

Web Proxy Filters Property Sheet

Web Proxy Logging property sheet

Web Proxy Logging Properties

Web Proxy messages

Web Proxy Service Messages
Web Proxy Client Messages

Web Proxy Permissions property sheet

Web Proxy Permissions Property Sheet

Web Proxy security

About Web Proxy Security
Setting Access Control for the Web Proxy Service

Web Proxy Server Cache counters

Web Proxy Server Cache Counters

Web Proxy Server Service counters

Web Proxy Server Service Counters

Web Proxy service

Setting the Web Proxy Listen-On Port
Feature Summary
Web Proxy Service Features
Web Proxy Basics
How Dial-Up Support Works
Overview of Web Proxy Service Configuration
Setting Up Proxy Users
Selecting the Client Authentication Method
Controlling Web Proxy User Access to Internet Sites
Setting Up Caching of Internet Objects
Logging Web Proxy Service Activity
Web Proxy Security
About Web Proxy Security
Setting Access Control for the Web Proxy Service
Domain Filtering Keys
Web Proxy Service Keys
Web Proxy Service Troubleshooting
How the Web Proxy Service Works
About the Web Proxy Service
Advantages of the Web Proxy Service
Opening the Administrative Interface for the Web Proxy Service
Web Proxy Service Properties
Web Proxy Service Property Sheet
Web Proxy Permissions Properties
Web Proxy Caching Properties
Web Proxy Logging Properties
Web Proxy Filters Properties
How to Enable Internet Publishing
Web Proxy service
Web Proxy Service Messages

Web Proxy service keys

Web Proxy Service Keys
Setting RPC Bindings
Cache Keys
Other Keys Added for Microsoft Proxy Server

Web Proxy service logging

Web Proxy Basics
Logging Web Proxy Service Activity

Web Proxy service logs

Logging Overview
Log Field Summary
Client Information Fields
Connection Information Fields
Object Information Fields
Logging Issues

Web Proxy Service Properties window

Basic Cache Configuration
Setting the Advanced Options for the Cache
Changing the Drives and Space Allocated to the Cache
Turning Off the Cache
Logging Web Proxy Service Activity

Web Proxy Service property sheet

Opening the Administrative Interface for the Web Proxy Service
Web Proxy Service Property Sheet

Web Proxy service protocols

Granting Permissions to Proxy Users

Web Proxy service registry values

Web Proxy Service Keys
Cache Keys

Web Proxy service text file logs

Logging to a File

Web Proxy users

Setting Up Proxy Users
Selecting the Client Authentication Method
Granting Permissions to Proxy Users
Controlling Web Proxy User Access to Internet Sites

Web server

Web server

Web site

What is the World Wide Web?

Wide area network

What is an Intranet?
Wide Area Network (WAN)

Windows Internet Name Service server

Windows Internet Name Service (WINS) server

Windows Internet Naming Service

Using DNS, WINS and DHCP with Microsoft Proxy Server
Considerations for Using WINS
Microsoft Proxy Server as a WINS Server
Microsoft Proxy Server as a WINS Client
Using Multiple Proxy Gateways in a WINS Environment
More About DNS, WINS, and DHCP
What is WINS?
Using WINS Service
Using DNS with WINS and DHCP

Windows NT Challenge/Response authentication

Client Authentication
WinSock Proxy Service Features
About Web Proxy Security
How Challenge/Response Authentication Works
What is Challenge/Response Authentication?
Enabling Challenge/Response Authentication
Windows NT Challenge/Response Authentication

Windows NT File System

Software Requirements
Setting Up the Disk Drives

Windows NT groups

Server Administration Overview
Putting Users in Windows NT Groups
Considerations For Planning Windows NT Groups
Creating New Groups For Proxy Users
Assigning Groups to Service Permissions

Windows NT Remote Access Service

RAS and Microsoft Proxy Server
Setting Up RAS
How Dial-Up Support Works
Using RAS with Microsoft Proxy Server
Configuring RAS Options
Creating RAS Phone Book Entries
Other RAS-Related Issues
Using RAS Server and Microsoft Proxy Server
RAS Troubleshooting

Windows NT Server

Software Requirements
Using Performance Monitor
Advanced TCP/IP Security with Windows NT

Windows NT system log

Windows NT Logs
Web Proxy Service Messages
WinSock Proxy Messages Logged to the System

Windows Sockets

WinSock Proxy Service Features
Setting WinSock Proxy Port Permissions
About WinSock Proxy Clients
Configuring Windows Sockets Applications
Understanding Windows Sockets and WinSock Proxy
About Windows Sockets
Connected Service using TCP Sockets
Connectionless Service using UDP Sockets
About WinSock Proxy
WinSock Proxy Limitations
WinSock Proxy Protocols Property Sheet
Windows Sockets

Windows Sockets APIs

WinSock Proxy Service Features
About Windows Sockets
WinSock Proxy Client Components
WinSock Proxy Control Channel
Windows Sockets APIs
socket()
bind()
connect()
listen() and accept()
recv() and send()
recvfrom() and sendto()

WINS

What is WINS?
Using WINS Service
Using DNS with WINS and DHCP

WINS client

Microsoft Proxy Server as a WINS Client
What is WINS?

WINS proxy

What is WINS?

WINS server

Microsoft Proxy Server as a WINS Server
Using Multiple Proxy Gateways in a WINS Environment
What is WINS?
WINS server

WINS services

Using DNS, WINS and DHCP with Microsoft Proxy Server
Considerations for Using WINS
Microsoft Proxy Server as a WINS Server
Microsoft Proxy Server as a WINS Client
Using Multiple Proxy Gateways in a WINS Environment
More About DNS, WINS, and DHCP
What is WINS?
Using WINS Service
Using DNS with WINS and DHCP

WinSock Proxy

How the WinSock Proxy Service Works
Understanding Windows Sockets and WinSock Proxy
About WinSock Proxy
WinSock Proxy Architecture
WinSock Proxy Client Components
WinSock Proxy Control Channel
WinSock Proxy Limitations

WinSock Proxy Add Users and Groups dialog box

WinSock Proxy Add Users and Groups Dialog Box

WinSock Proxy clients

WinSock Proxy Clients
About WinSock Proxy Clients
WinSock Proxy Client Considerations
Using the WSP Client Application
Turning the WinSock Proxy Client On or Off
Changing the Server Used to Download Client Configuration Files
Updating the WinSock Proxy Client Configuration Files
WinSock Proxy Client Problems
WinSock Proxy Client Components
WinSock Proxy Service Messages Displayed to Clients

WinSock Proxy control channel

WinSock Proxy Control Channel

WinSock Proxy Deny or Grant Access To dialog box

WinSock Proxy Deny or Grant Access To Dialog Box

WinSock Proxy diagnostic utility

WinSock Proxy Diagnostic Utility

WinSock Proxy DLL

WinSock Proxy Service Features
WinSock Proxy Client Components
WinSock Proxy Control Channel
Using IPX/SPX on the Internal Network
SNMP

WinSock Proxy Filters Property sheet

WinSock Proxy Filters Property Sheet

WinSock Proxy Logging property sheet

WinSock Proxy Logging Properties

WinSock Proxy messages

WinSock Proxy Messages Logged to the System
WinSock Proxy Service Messages Displayed to Clients

WinSock Proxy permissions

Setting Up WinSock Proxy Users

WinSock Proxy Permissions property sheet

Configuring WinSock Proxy Protocols and Ports
About the Predefined Protocol Configurations
WinSock Proxy Permissions Property Sheet

WinSock Proxy ports

Setting WinSock Proxy Port Permissions
Configuring WinSock Proxy Protocols and Ports

WinSock Proxy Protocols property sheet

Setting Up Protocol Configurations
About the Predefined Protocol Configurations
WinSock Proxy Protocols Property Sheet

WinSock Proxy security

WinSock Proxy Security
How WinSock Proxy Security Works
Setting Access Control for WinSock Proxy
Assigning Permissions for WinSock Proxy Users
Considerations for WinSock Proxy Security
When Modifying the Local Address Table
When Setting Port Protocol Permissions
When Setting TCP/IP Properties for Network Adapter Cards
When Running Microsoft Proxy Server in a Workgroup

WinSock Proxy server

WinSock Proxy Server Problems

WinSock Proxy Server counters

WinSock Proxy Server Counters

WinSock Proxy service

Feature Summary
WinSock Proxy Service Features
Setting WinSock Proxy Port Permissions
How Dial-Up Support Works
Overview of WinSock Proxy Service Configuration
Configuring WinSock Proxy Protocols and Ports
Setting Up Protocol Configurations
About the Predefined Protocol Configurations
Setting Up WinSock Proxy Users
Logging WinSock Proxy Service Activity
Setting WinSock Proxy Access Control
Configuring Windows Sockets Applications
WinSock Proxy Security
Domain Filtering Keys
WinSock Proxy Service Keys
WinSock Proxy Service Troubleshooting
WinSock Proxy Diagnostic Utility
WinSock Proxy Server Problems
WinSock Proxy Client Problems
How the WinSock Proxy Service Works
About WinSock Proxy
WinSock Proxy Architecture
WinSock Proxy Client Components
WinSock Proxy Control Channel
WinSock Proxy Limitations
Opening the Administrative Interface for the WinSock Proxy Service
WinSock Proxy Service Properties
WinSock Proxy Protocols Properties
WinSock Proxy Permissions Properties
WinSock Proxy Logging Properties
WinSock Proxy Filters Properties
WinSock Proxy service
WinSock Proxy Messages Logged to the System
WinSock Proxy Service Messages Displayed to Clients

WinSock Proxy service keys

WinSock Proxy Service Keys
Other Keys Added for Microsoft Proxy Server

WinSock Proxy service logging

Logging WinSock Proxy Service Activity

WinSock Proxy service logs

Logging Overview
Log Field Summary
Client Information Fields
Connection Information Fields
Object Information Fields
Logging Issues

WinSock Proxy Service Properties window

Configuring WinSock Proxy Protocols and Ports
Setting Up Protocol Configurations
Setting Up WinSock Proxy Users
Controlling WinSock Proxy User Access to Internet Sites
Logging WinSock Proxy Service Activity
Setting WinSock Proxy Access Control
Assigning Permissions for WinSock Proxy Users

WinSock Proxy service property sheet

WinSock Proxy Service Property Sheet

WinSock Proxy service protocols

Configuring WinSock Proxy Protocols and Ports
Setting Up Protocol Configurations
About the Predefined Protocol Configurations
Setting Up WinSock Proxy Users

WinSock Proxy service registry values

WinSock Proxy Service Keys

WinSock Proxy service text file logs

Logging to a File

WinSock Proxy users

Setting Up WinSock Proxy Users
Controlling WinSock Proxy User Access to Internet Sites
Setting WinSock Proxy Access Control
Assigning Permissions for WinSock Proxy Users

Workgroup

When Running Microsoft Proxy Server in a Workgroup

World Wide Web

What is the World Wide Web?
World Wide Web (WWW)

WSP Client application

Using the WSP Client Application
Turning the WinSock Proxy Client On or Off
Changing the Server Used to Download Client Configuration Files

Wspcfg.ini file

Configuring Windows Sockets Applications

WWW

What is the World Wide Web?
WWW

WWW service authentication method

Selecting the Client Authentication Method

WWW service port number

Setting the Web Proxy Listen-On Port

WWW Service Properties dialog box

Selecting the Client Authentication Method

WWW services

Restarting Services After a Dial-Up Connection
Selecting the Client Authentication Method
How Anonymous Logon Works


Before You Begin

About This Book
What You Should Know
Finding Further Information
 Microsoft AnswerPoint
Microsoft Service Advantage
Accessibility for People with Disabilities

Welcome to Microsoft® Proxy Server. Microsoft Proxy Server provides an easy, secure way to bring Internet access to every desktop in an organization.

Microsoft Proxy Server supports all Internet protocols, including WWW (HTTP), FTP, RealAudio (streaming audio), VDOLive (streaming video), IRC (Internet Relay Chat), and mail and news protocols. Support for Novell’s IPX/SPX transport means that deployment of TCP/IP on a private network is unnecessary. Internet sites can be accessed by Web browsers running on any operating system, and by all 16-bit and 32-bit Windows® Sockets applications, with no modifications to the applications.

For the latest information about Microsoft Proxy Server, browse our World Wide Web page at http://www.microsoft.com/proxy/.

To Top About This Book

The Microsoft Proxy Server Installation and Administration Guide provides information about:

  • Preinstallation requirements
  • Server installation and configuration
  • Client installation and configuration
  • Administration of the Web Proxy and WinSock Proxy services
  • Monitoring the server by using logs, performance monitor counters, and simple network management protocol (SNMP) management information bases (MIBs).
  • Registry entries
  • Messages
  • Product architecture

To Top What You Should Know

It is assumed that you already understand the basic operation of the Microsoft® Windows NT® operating system and that Windows NT Server 4.0 is installed on your computer. It is also assumed that you have basic familiarity with the Internet and with Transmission Control Protocol/Internet Protocol (TCP/IP) networking.

To Top Finding Further Information

In addition to this book, information about using Microsoft Proxy Server is available from the following sources.

Microsoft TechNet is the front-line resource for fast complete answers to technical questions on Microsoft desktop and system products. Through two monthly compact discs, you get everything from crucial data on client/server and workgroup computing, systems platforms, and database products, to the latest applications support for Microsoft Windows and the Apple Macintosh. For ordering information, call your reseller or (800) 344-2121.

The Microsoft Developer Network provides in-depth information for developers. With Level 1 of the Developer Network, you get four quarterly releases of the Development Library, packed with inside information on programming for Microsoft® Windows® and Windows NT, plus other program benefits. With Level 2 of the Developer Network, you will receive all the Level 1 benefits plus quarterly releases of the Development Platform, containing the latest Windows and Windows NT Workstation operating systems and API-level software development kits (SDKs) and device development kits (DDKs) from Microsoft. For ordering information, call (800) 759-5474.

Visit the Microsoft Proxy Server home page on the Internet at http://www.microsoft.com/proxy . Find out about products that extend and add value to Microsoft Proxy Server at http://www.microsoft.com/proxy/partners.htm .

To Top Microsoft AnswerPoint

In the event you cannot install Microsoft® Proxy Server, please refer to the support offerings below. Microsoft’s standard support offerings range from no-cost and low-cost online information services (available 24 hours a day, 7 days a week) to annual support plans. Please also check the Technical Support section in online Help for detailed information.

Microsoft support services are subject to Microsoft’s then-current prices, terms, and conditions, which are subject to change without notice.

Information Services

AnswerPoint Information Services provides you with easy access to the latest technical and support information for Microsoft products. You can access a variety of low and no cost Information Services 24 hours a day, 365 days a year.

Internet services (World Wide Web and FTP sites): Access the Microsoft Frequently Asked Questions, Software Library, Knowledge Base, customer-to-customer newsgroups, and other technical information on our Internet sites.

  • The World Wide Web site is located at http://www.microsoft.com
  • The FTP site is located at ftp.microsoft.com

The Microsoft Network (MSN) and other online services: Access the Microsoft Frequently Asked Questions, Software Library, Knowledge Base, customer-to-customer Bulletin Board Services, and other technical information on MSN and other online services. To access Microsoft services on MSN, choose Go To Other Location from the Edit menu and type MSSUPPORT.

Microsoft TechNet: CD-ROM based Microsoft TechNet is the front-line resource for fast complete answers to technical questions on Microsoft desktop and systems products. For more information or to subscribe to Microsoft TechNet, call (800) 344-2121.

Microsoft Developer Network Library (MSDN): CD-ROM based MSDN is the comprehensive source of programming information and toolkits for those who write applications for the Microsoft Windows, Windows 95, and Windows NT operating systems, or use Microsoft products for development purposes. For more information or to subscribe, call (800) 759-5474.

Microsoft Download Service (MSDL): Direct modem access to a variety of technical information is available on MSDL by dialing (206) 936-6735. Connect information: 1200, 2400, 9600, or 14400 baud, no parity, 8 data bits, and 1 stop bit.

Microsoft FastTips: This automated service provides quick answers to your common technical questions via an automated toll-free telephone number, fax, or mail. To access FastTips or to receive a map and catalog, call the following FastTips numbers:

  • Desktop applications: (800) 936-4100
  • Development products: (800) 936-4300
  • Personal Systems products: (800) 936-4200
  • Business Systems: (800) 936-4400

Priority Support

Microsoft AnswerPoint offers priority telephone access to Microsoft support engineers 24 hours a day, 7 days a week, excluding holidays.

  • In the United States, call (900) 555-2100; $195 per incident. Charges appear on your telephone bill.
  • In the United States, call (800) 936-5900, at $195 (U.S.) per incident, billed to your VISA, MasterCard, or American Express card.
  • In Canada, call (800) 668-7975 for more information.

For more information on Priority support offerings, including annual contracts, call Microsoft AnswerPoint Sales at (800) 936-3500.

Text Telephone

Microsoft text telephone (TT/TDD) services are available for the deaf or hard-of-hearing. In the United States, using a TT/TDD modem, dial (206) 635-4948. In Canada, using a TT/TDD modem, dial (905) 568-9641.

To Top Microsoft Service Advantage

Microsoft Service Advantage provides large organizations with the services and support they need to successfully plan, build, and manage mission-critical systems based on Microsoft products. Microsoft Service Advantage combines direct services from Microsoft with those from established enterprise service partners, providing a total solution that delivers real business advantage.

Direct Services

Microsoft offers the following direct services for global enterprise organizations: Enterprise Program Manager, Premier, Premier Global, Custom Consulting, Technology Consulting Blueprints, and the Microsoft Solutions Framework. All can be purchased with a single Microsoft Master Service Agreement.

An Enterprise Program Manager is an on-site, senior-level consultant who combines high-level architectural expertise with a long-term commitment and in-depth knowledge of your organization, tailoring specific guidance to the way your organization uses technology.

Premier support services help you achieve smooth, stable systems deployments with maximum uptime. Premier includes a designated support team who gets to know your technical environment and works with you to provide proactive services to help avoid problems before they occur. You also get reactive support—24-hours-a-day, 7-days-a-week direct access to senior support engineers—to minimize unplanned downtime.

Premier Global extends Premier support for multinational organizations. Premier Global helps you with worldwide systems deployment by coordinating both proactive and reactive Premier support services across country/regions boundaries.

Custom Consulting, delivered by Microsoft Consulting Services, helps you plan, build, and manage distributed computing environments, with a strong emphasis on knowledge transfer—empowering you to become proficient with Microsoft technology. Highly skilled in client-server architecture and design, Microsoft consultants frequently serve in a project-management capacity, helping to ensure a quality implementation by working closely with both you and your third-party partners.

Technology Consulting Blueprints are predefined consulting projects around specific technology topics, such as Windows 95 and Office 95 migration planning, Microsoft Exchange planning, and Internet/Intranet application planning. These represent Microsoft Consulting Services’ best practices in areas critical to large organizations. As a result, the general requirements, deliverables, approach, and expectations are well defined in advance, with the implementation specifics tailored to each organization.

Microsoft Solutions Framework (MSF), developed from years of product development and customer experience, is a process guide for planning, building, and managing technology projects. MSF delivers a suite of concepts and reference models that help you identify effective team structures, a dynamic development and life cycle model, and flexible application architecture. It is available in facilitated training from Microsoft Solution Provider ATECs and Microsoft, and includes a CD-ROM knowledge base.

For more information on Microsoft Service Advantage, please contact your Microsoft Sales Representative or your local Microsoft Sales Office.

Product Support Worldwide

The following list contains Microsoft subsidiary offices and the countries/regions they serve. If there is no Microsoft office in your country/region, please contact the establishment from which you purchased your Microsoft product. This list provides only basic technical support phone and fax numbers; other services such as BBS and sales numbers may be available. For additional subsidiary information, check the Product Support Services Worldwide section in online Help.

When you call, you should be at your computer and have the appropriate product documentation at hand.

Area | Telephone Numbers | Fax Numbers | Area | Telephone Numbers | Fax Numbers
Argentina | (54) (1) 819-1900 | (54) (1) 819-1921 | Liechtenstein | See Switzerland (German-speaking) |
Australia | (61) (02) 870-2131 | (61) (02) 805-0519 | Luxembourg | (Dutch speaking): (32) 2-5133274 (English speaking): (32) 2-5023432 (French speaking): (32) 2-5132268 |
Austria | 0660-6593 | 0222-68 16 2710 | Mexico | (52) (5) 325-0912-Client (52)(5) 237-4800 -Server |
Belgium | (Dutch speaking): 02-5133274 (English speaking): 02-5023432 (French speaking): 02-5132268 |  | Netherlands | (Dutch speaking): 023-5677877 (English speaking): 023-5677853 |
Bolivia | See Argentina |  | New Zealand | 64 (9) 357-5575 | 64 (9) 307-0516 and 64 (9) 357-5577
Brazil | (55) (11) 871-0090 | (55) (11) 262-8638 | Northern Ireland | See United Kingdom |
Caribbean | (214) 714-9100 | (809) 273-3636 | Norway | (47) (22) 02 25 50 | (47) (22) 02 25 70
Chile | 56-2-330-6000 | 56-2-330-6190 | Papua New Guinea | See Australia |
Colombia | (571) 618 2255 | (571) 618 2269 | Paraguay | See Argentina |
Czech Republic | (+42) (2) 2451 0554 | (+42) (2) 2423 4343 | Poland | (+48) (2) 6216793 —Or— (+48) (71) 441357 | (+48) (2) 6615434
Denmark | (45) (44) 89 01 11 | (45) (44) 89 01 44 | Portugal | 351 1 4409280/1/2/3 | (351) 1 4411655
Dubai | (971) 4 513 888 | (971) 4 527 444 | Republic of Ireland | See United Kingdom |
Ecuador | (593) (2) 463-094 |  | Russia | (+7) (502) 224 50 46 | (+7) (502) 224 50 45
England | See United Kingdom |  | Scotland | See United Kingdom |
Finland | (0358) (90) 525 502 500 | (46) (0)8 752 29 00 | Singapore | (65) 337-6088 | (65) 337-6788
France | (33) (1) 69-86-10-20 | (33) (1) 69-28-00-28 | Slovenia | (+386) (61) 1232354 |
French Polynesia | See France |  | Slovak Republic | (+42) (7) 312083 | (+42) (2) 2423 4343
Germany | 089/3176-1199 | 089-3176-1000 | South Africa | 0 802 11 11 0(2) 11 445 010 | (27) 11 445 0045 —Or— (27) 11 445 0046
Greece | (30) (1) 6806-775 through (30) 1 6806-779 | (30) (1) 6806 780 | Spain | 91 807 99 60 | (34) (1) 803-8310
Hong Kong SAR, PRC | (852) 804-4222 | 2535-9293 | Sweden | (46) (8) 752 09 29 | (46) (0)8 752 29 00
Hungary | (36) (1) 267-4636 | (+36) (1) 268-1558 | Switzerland | (German speaking): 01/831-1581 (French speaking): 022-738 96 88 | 01-831 08 69
India | (01) (91) 646 0694 | (01) (91) 646-0813 | Taiwan Region | (886) (2) 508-9501 | (886) (2) 504-3121
Ireland | See United Kingdom |  | Turkey | (90) 212 2585998 | (90) 212 2585954
Israel | 972-3-613-0833 | 972-3-613-0834 | United Kingdom | (01734) 271007 | (01734) 270080
Italy | (39) (2) 7039-8351 | (39) (2) 7039-2020 | Uruguay | See Argentina |
Japan | (81) (424) 41-8700 | (81) (3) 5454-8100 (1#-0# for guidance) | Venezuela | (582)-2654337 | (582)2650863
Korea | (822) 566-0027 | (82) (2) 531-4600 | Wales | See United Kingdom |

To Top Accessibility for People with Disabilities

Microsoft is committed to making its products and services easier for everyone to use. The following features, products and services, make Microsoft® Windows®, Microsoft® Windows NT®, and Microsoft® Proxy Server more accessible for people with disabilities:

  • Microsoft services for people who are deaf or hard-of-hearing.
  • Access Packs for either Microsoft Windows or Microsoft Windows NT, a software utility that makes using Windows or Windows NT easier for people with motion or hearing disabilities.
  • Keyboard layouts designed for people who type with one hand or a wand.
  • Microsoft software documentation on audio cassette, floppy disk, or compact disc (CD).
  • Third-party utilities to enhance accessibility.
  • Hints for customizing Microsoft Windows or Microsoft Windows NT.
  • Other products and services for people with disabilities.

Note The information in this section applies only to users who purchased Microsoft products in the United States. If you purchased Windows or Windows NT outside the United States, your package contains a subsidiary information card listing Microsoft support services telephone numbers and addresses. You can contact your subsidiary to find out whether the type of products and services described in this appendix are available in your area.

Microsoft Services for People Who Are Deaf or Hard-of-Hearing

If you are deaf or hard-of-hearing, complete access to Microsoft product and customer services is available through a text telephone (TT/TDD) service.

Sales Information

You can contact Microsoft Sales Information Center on a text telephone by dialing (800) 892-5234 between 6:30 A.M. and 5:30 P.M. Pacific time.

Technical Assistance

For technical assistance in the United States, you can contact Microsoft Support Network on a text telephone at (206) 635-4948 between 6:00 A.M. and 6:00 P.M. Pacific time, Monday through Friday, excluding holidays. In Canada, dial (905) 568-9641 between 8:00 A.M. and 8:00 P.M. Eastern time, Monday through Friday, excluding holidays. Microsoft support services are subject to Microsoft prices, terms, and conditions in place at the time the service is used.

Customizing Windows or Windows NT

There are many ways you can customize Windows or Windows NT to make your computer more accessible.

  • Beginning with Windows 95, accessibility features are built in to Windows. These features are useful for individuals who have difficulty typing or using a mouse, have moderately impaired vision, or who are deaf or hard-of-hearing. The features can be installed during setup, or you can add them later from your Windows 95 installation disks. Look up “accessibility” in the Windows Help Index for information about installing and using these features.

  • Many of the features which make Windows 95 more accessible can be added to Windows NT, earlier versions of Microsoft Windows, and MS-DOS through Access Packs. You can download these files by modem, or you can order them on disks from Microsoft.

  • You can also use Control Panel and other built-in features to adjust the appearance and behavior of Windows or Windows NT to suit varying vision and motor abilities. These include adjusting colors and sizes, sound volume, and the behavior of the mouse and keyboard.

  • Dvorak keyboard layouts make the most frequently typed characters on a keyboard more accessible if you have difficulty using the standard “QWERTY” layout. There are three Dvorak layouts: one if you are a two-handed user, one if you type with your left hand only, and one if you type with your right hand only. You do not need to purchase any special equipment to use these features.

The specific features available, and whether they are built-in or must be obtained separately, depend on which operating system you are using.

For full documentation on the accessibility features available in the operating system you are using, obtain the appropriate application notes listed below. Accessibility features are also documented in the Microsoft Windows 95 Resource Kit and the Microsoft Windows NT Resource Kit.

Which Files to Download or Order

You can obtain these files by downloading them with your modem, or you can order them on disks by phone. Specific information about downloading or ordering these files immediately follows this list of files.

These files include:

  • Application notes providing more complete documentation on ways to customize Windows and Windows NT.
  • Access Packs and Dvorak keyboard layouts providing additional features for versions of Windows or Windows NT in which they are not already included.
For | You need
Application notes for Microsoft Windows NT 4.0 | Ww1279.doc
Application notes for Microsoft Windows 95 | Ww1062.exe
Application notes for Microsoft Windows NT 3.1 and 3.5 (includes Access Pack for Microsoft Windows NT) | Wn0789.exe
Application notes for Microsoft Windows for Workgroups 3.1 | Wg0788.txt
Application notes for Microsoft Windows 3.1 | Ww0787.txt
Application notes for Microsoft Windows 3.0 | Ww0786.txt
Access Pack for Microsoft Windows 3.0 and 3.1 | Accp.exe
Dvorak keyboard layouts for people who type with one hand (already included in Windows NT 3.5 and higher) | Ga0650.exe

To Download the Access Packs, Application Notes, and Alternative Keyboard Layouts by Modem

If you have a modem, you can download these files from the following network services:

  • Microsoft’s World Wide Web Site on the Internet. On the www.microsoft.com home page, choose the Support icon, choose Knowledge Base, and select MS-DOS as the product. Enter KBFILE followed by the appropriate filename from the list above, and choose GO! Open the article, and choose the button to download the file.
  • Microsoft’s Internet servers, ftp.microsoft.com and gopher.microsoft.com, in /softlib/mslfiles.
  • MSN™, the Microsoft Network online service.
  • CompuServe®: type GO MSL.
  • GEnie™.
  • Microsoft Download Service (MSDL), which you can reach by calling (206) 936-6735 any time except between 1:00 A.M. and 2:30 A.M. Pacific time.
  • MSDL supports 1200, 2400, 9600, or 14400 baud rates (V.22bis, V.32, V.32bis and V.42), with 8 data bits, no parity, and 1 stop bit.
  • Various user-group bulletin boards (such as the bulletin-board services on the Association of PC User Groups network).

To Order the Access Packs, Application Notes, and Alternative Keyboard Layouts on Disks by Phone

If you do not have a modem, within the United States you can order the Access Packs, Application Notes, and Alternative Layouts on disks by calling Microsoft Sales Information Center at (800) 426-9400 (voice) or (800) 892-5234 (text telephone).

In Canada, you can call (905) 568-3503 (voice) or (905) 568-9641 (text telephone).

Microsoft Documentation in Alternative Formats

In addition to the standard forms of documentation, many Microsoft products are also available in other formats to make them more accessible.

If you have difficulty reading or handling printed documentation, you can obtain many Microsoft publications from Recording for the Blind & Dyslexic, Inc. Recording for the Blind & Dyslexic distributes these documents to registered, eligible members of their distribution service, either on audio cassettes or on floppy disks. The Recording for the Blind & Dyslexic collection contains more than 80,000 titles, including Microsoft product documentation and books from Microsoft Press. You can contact Recording for the Blind & Dyslexic at the following address or phone numbers for information about eligibility and availability of Microsoft product documentation and books from Microsoft Press:

Recording for the Blind & Dyslexic, Inc.
20 Roszel Road
Princeton, NJ 08540

Phone: (609) 452-0606
Fax: (609) 987-8116
World Wide Web: http://www.rfbd.org/

Third-Party Utilities to Enhance Accessibility

A wide variety of third-party hardware and software products are available to make it easier to use personal computers. Among the different types of products available for the MS-DOS®, Windows, and Windows NT operating systems are:

  • Programs that enlarge or alter the color of information on the screen for people with visual impairments.
  • Programs that describe information on the screen in Braille or synthesized speech for people who are blind or have difficulty reading.
  • Hardware and software utilities that modify the behavior of the mouse and keyboard.
  • Programs that enable people to “type” using a mouse or their voice.
  • Word or phrase prediction software that enables people to type more quickly and with fewer keystrokes.
  • Alternate input devices, such as single switch or puff-and-sip devices, for people who cannot use a mouse or a keyboard.

To learn more about these products, see “Getting More Accessibility Information” below.

Getting More Accessibility Information

In addition to the features and resources already described in this section, other products, services, and resources are available from Microsoft and other organizations.

Additional Microsoft Products and Services for People with Disabilities

For more information, contact:

Microsoft Sales Information Center
One Microsoft Way
Redmond, WA 98052-6393

World Wide Web: http://www.microsoft.com/
Voice telephone: (800) 426-9400
Text telephone: (800) 892-5234

Directories of Computer Products that Help People with Disabilities

The Trace R&D Center at the University of Wisconsin–Madison produces a book and a compact disc that describe products that help people with disabilities use computers. The book, titled Trace ResourceBook, provides descriptions and photographs of about 2,000 products. The compact disc, titled CO-NET CD, provides a database of more than 18,000 products and other information for people with disabilities. It is issued twice a year.

To obtain these directories, contact:

Trace R&D Center
University of Wisconsin
S-151 Waisman Center
1500 Highland Avenue
Madison, WI 53705-2280

World Wide Web: http://trace.wisc.edu/
Fax: (608) 262-8848

Assistive Technology Programs for People with Disabilities

For general information and recommendations on how computers can help specific needs, you should consult a trained evaluator. An assistive technology program in your area will provide referrals to programs and services that are available to you.

To locate the assistive technology program nearest you, contact:

National Information System
Center for Developmental Disabilities
University of South Carolina
Columbia, SC 29208

Voice/text telephone: (803) 922-9234 outside South Carolina
(803) 922-1107 inside South Carolina
Fax: (803) 935-5250


CHAPTER 1, Overview

Overview

What is the Internet?
What is TCP/IP?
What is the World Wide Web?
What is an Intranet?
What is an ISP?
What is a Proxy Server?
 What is a Gateway?
What is a Client?
 What is Microsoft Proxy Server?
What Does Setup Install?

To Top What is the Internet?

The Internet can be described as a worldwide network of computers connected together and configured to share information.

Originally, the Internet started as a research project of the Advanced Research Projects Agency (ARPA). The original intent of the ARPA network was to create a means of connecting computers at its regionally based research centers. To achieve this intent, ARPA funded new work that included specifying standards for communications between networked computers, as well as establishing conventions for handling and routing network traffic. This work evolved into the development of the TCP/IP protocol suite, a family of standards for networking computers.

As the original ARPA network grew in scope, its membership and purpose grew as well. The first ARPA network, created in 1969, was a small number of leased telephone lines used to interconnect four ARPA sites. Later designs included the addition of other research sites for use by academic and military organizations, as well as by schools and universities throughout the world. By the 1980s, the original ARPA network term, “ARPANet,” no longer applied. As network membership expanded considerably beyond the original ARPA sites, the network became increasingly called “the Internet,” to indicate an internetwork connecting government agencies, and later private industries. Private industries are the largest group of contributors to the current and recent growth of the Internet.

Today, the Internet is continuing to grow rapidly. Because of its development through public funding and the global participation of over 61 countries worldwide, the Internet is not owned by any one business or organization. Instead, it can be seen as the internetwork formed by all the businesses and organizations that choose to link their computers to a global public network. The Internet is now a universal carrier of electronic mail, text files, multimedia objects, and real-time audio. In the future, even more information will be available in these and other formats.

To Top What is TCP/IP?

TCP/IP refers to a family of standards for connecting computers together to form networks.

The original ARPA network design team saw the difficulty in implementing reliable communications between computers that used different hardware and software. Because of differences in vendor designs, a common set of openly published standards was seen as the best solution to resolving this problem. All vendors could then have access to the standard specifications and new products could be designed to operate for networked use in predictable ways. These standards have come to be known collectively as TCP/IP.

TCP/IP refers to all of the established protocols approved and published by the Internet Engineering Task Force (IETF) that support two basic protocols:

  • Transmission Control Protocol (TCP). This is the main protocol that is used to handle connection-based service between networked computers. It specifies methods for reliable delivery of data between networked computers.

  • Internet Protocol (IP). This is the protocol that is used to move data through the network. It uses a standard addressing scheme of unique addresses to determine how data is routed through the network.

In order to see how TCP/IP works, it is useful to look at an example, such as how TCP/IP supports e-mail service.

For example, if some information (such as an e-mail message) is composed and sent to your computer as text-based data, this data is sent in chunks called packets, which are fixed-length parcels of the data contained within the message. These packets are then forwarded to your computer by using its Internet Protocol (IP) address. An IP address consists of four numbers between 0 and 255, separated by periods.

The use of TCP and IP in this way, combined with other TCP/IP member protocol sets, allows your computer to communicate with other computers on the Internet. In the preceding example, the other member protocols might include either the Simple Mail Transfer Protocol (SMTP) or the Post Office Protocol (POP), which are specific standards within TCP/IP for e-mail messaging services.

Another method of TCP/IP addressing beyond IP addressing is the Domain Name System (DNS), which uses conventional names to identify computers and services available on the network. Domain names, which are easier to remember than IP addresses, are mapped to IP addresses.

Domain names consist of the following elements, separated by periods:

  • A host name. The host name often indicates the protocol used by the Internet site, such as File Transfer Protocol (FTP).

  • A subdomain name. The subdomain name is usually the name of the private organization that manages the site. These domain names are registered and administered through the Internet Network Information Center (InterNIC).

  • A top-level domain name. The top-level domain, which indicates the type of organization that hosts the Web site, is assigned by InterNIC.

For example, www.microsoft.com is the domain name for the Microsoft World Wide Web site. The host name, www, indicates that it is a World Wide Web site. The subdomain, .microsoft, is the name registered with InterNIC by the owner of the site. In this case, the owner is the Microsoft Corporation. The top-level domain, .com, indicates that the Web site is operated by a commercial organization.

Some common Internet host names are:

  • www World Wide Web. A browser can download multimedia and HTML (Hypertext Markup Language) scripted pages from this site.

  • ftp File Transfer Protocol. This protocol indicates that an FTP application can download files from this site.

  • gopher Gopher. This protocol permits a browser to be used to view text documents and directory listings from this type of site.

  • irc Internet Relay Chat. This protocol supports interactive text chat between two or more users who are connected to the IRC site, sometimes called a “chat room.”

  • ra RealAudio. This protocol supports real-time (or “streamed”) continuous audio transmission from a connected site to a RealAudio client.

Some Internet top-level domain names include:

  • com Commercial. Used by all businesses and individual subscribers who use a commercial Internet Service Provider (ISP).

  • edu Educational. Used by all public schools, colleges, and universities.

  • org Nonprofit organization. Used by nonprofit organizations only.

  • mil Military. Used by member agencies of the U.S. Department of Defense only.

  • net Network. A more recent addition to the list of top-level domains, possibly added because of growth in the commercial domain. This domain is reserved for ISPs providing large-scale access to the Internet backbone.

To Top What is the World Wide Web?

The World Wide Web (WWW, or simply “the Web”) is an Internet service based on the Hypertext Transfer Protocol (HTTP), a recent addition to the TCP/IP protocol suite. HTTP delivers multimedia objects—text, sound, video, images, database access, and interactive applications—to your computer. These objects are grouped together into pages using a scripting language called Hypertext Markup Language (HTML). Each HTML page is also called a “Web page.”

A Web page is viewed with a browser. A browser is an application, such as Microsoft Internet Explorer, that requests a page on the Web by using HTTP and then displays the page on your screen. HTML pages are text files that include special codes called tags. These tags control text formatting, the placement of objects on the page, and hyperlinks to other Web pages. Hyperlinks can be clicked on with a pointing device, such as a mouse, to jump from one Web page to another.

The content for the Web is created and maintained on computers that are configured to act as Web sites. A Web site responds to requests from browsers and returns HTML pages. Web sites are typically maintained by organizations. Individuals sometimes run their own Web sites, or they create HTML pages and copy them onto public sites.

The content of the Web is dynamic. It changes daily, or even hourly. The number of Web sites and the scope and richness of content is growing astronomically. The Web offers business information, online shopping, and searchable databases.

To Top What is an Intranet?

An intranet is another name for a private network.

A TCP/IP intranet is an organization’s internal network of computers based on the Internet model. This internal network can be as small as a local area network (LAN) that connects two PCs over a serial link, or as large as a wide area network (WAN) that connects hundreds of computers worldwide. An intranet can be thought of as any network whose computers and network hardware are under the responsibility of a single organization. Many organizations use intranets to publish information for their network users. An intranet can be connected to the Internet with a gateway, such as Microsoft Proxy Server.

Throughout this guide, the term “private network” is used as a synonym for the terms “intranet,” “corporate network,” and “internal network.”

To Top What is an ISP?

The main trunks of the Internet, or “backbones,” are run by the major telecommunications carriers. These carriers provide access to the Internet through smaller companies called Internet Service Providers (ISPs). Users can get access to the Internet through an ISP to browse the World Wide Web, to download files, and to send and receive e-mail.

To Top What is a Proxy Server?

A proxy server is a server configured to act on behalf of assigned clients.

When a client application makes a request for an object on the Internet, a proxy server on the private network responds by translating the request and passing it to the Internet. When a computer on the Internet responds, the proxy server passes that response back to the client application on the computer that made the request. The proxy server is a gateway between the private network and the Internet.

To Top What is a Gateway?

A gateway is special software, or a computer running special software, that enables two different networks to communicate.

A proxy server provides a gateway between your private network to the Internet. You configure a proxy server to enable your workstations to communicate with remote services on the Internet. You select the appropriate hardware for a gateway computer, adequate bandwidth for the Internet connection, and choose the level of security for protecting your private network.

The gateway acts as a barrier that allows you to make requests to the Internet and receive information, but does not allow access to your network by unauthorized users.

To Top What is a Client?

A client is a computer that sends a request for data over a network to a server computer.

For example, when a computer running Microsoft® Internet Explorer on an private network makes a request to an Internet Information Server Web site, this computer is acting as a client. In this example, Internet Information Server responds by sending out HTTP objects addressed to the private network. Microsoft Proxy Server then receives these objects and passes them to the client computer running Internet Explorer, which displays the objects in a Web page.

Here are a few examples of Internet-based client software:

  • A Web browser (such as Microsoft Internet Explorer).
  • An FTP batch file transfer program.
  • The RealAudio Player.
  • A Visual Basic® or Visual C++® application that uses Microsoft® Windows® Sockets.

Many Microsoft applications are able to act as Internet clients. Each application is able to receive objects from the Internet into its own file format.

To Top What is Microsoft Proxy Server?

Microsoft Proxy Server provides an easy, secure way to bring Internet access to every desktop in an organization.

A server is software that listens for requests and performs a service in response. Microsoft Proxy Server listens to the computers on your private network. When a client application makes a request, Microsoft Proxy Server responds by translating the request and passing it to the Internet. When a computer on the Internet responds, Microsoft Proxy Server passes that response back to the client application on the computer that made the request.

Microsoft Proxy Server supports all Internet protocols, including WWW (HTTP), FTP, RealAudio (streaming audio), VDOLive (streaming video), IRC (Internet Relay Chat), and mail and news protocols. Support for Novell’s IPX/SPX transport means that deployment of TCP/IP on a private network is unnecessary. Internet sites can be accessed by Web browsers running on any operating system, and by all 16-bit and 32-bit Windows Sockets applications, with no modifications to the applications.

With Microsoft Proxy Server you can:

  • Extend Internet applications to every desktop on your private network.

    You can use Microsoft Proxy Server to establish access for all of your private network clients quickly and easily. Clients can be set up for proxy access in minutes. In some cases, Microsoft Proxy Server can also eliminate the need to install and support additional protocol drivers for each client’s desktop.

  • Improve performance and access for Internet-based services on your private network.

    Microsoft Proxy Server caches frequently accessed documents to ensure the immediate availability of fresh data. Cached copies of popular Web pages can be maintained locally and updated automatically, based on a study of cache usage. Microsoft Proxy Server also builds upon the high performance and scaleability of Windows NT Server for application services.

  • Provide secure access between your private network and the Internet.

    An administrator can configure Microsoft Proxy Server to grant or deny outbound Internet access by user, service, port, or IP domain. Access to specific domain sites can be blocked easily. In addition, Microsoft Proxy Server takes advantage of security features built into Windows NT Server.

  • Integrate proxy services closely within your current network operating system.

    Microsoft Proxy Server provides tight integration with Microsoft Windows NT Server and Microsoft Internet Information Server, resulting in a high level of performance and ease of administration.

To Top What Does Setup Install?

The Microsoft Proxy Server Setup program installs the following on a server:

  • The Web Proxy service
  • The WinSock Proxy service
  • A shared network directory containing a client Setup program
  • The online documentation in HTML format
  • The administrative components


CHAPTER 2, Preinstallation Requirements

Preinstallation Requirements

Hardware Requirements
Software Requirements
Before You Install
Server Security Checklist
Connecting the Server to the Internet

Before installing Microsoft Proxy Server, please review this entire chapter. It contains important information about installation requirements.

To Top Hardware Requirements

Microsoft Proxy Server has the same hardware requirements as Microsoft Windows NT Server version 4.0. For more information, see the documentation for Windows NT Server version 4.0.

To Top Software Requirements

The following must already be installed on the server computer before Microsoft Proxy Server can be installed:

  • Microsoft Windows NT Server version 4.0
  • Microsoft Internet Information Server version 2.0
  • The Windows NT Server 4.0 Service Pack (provided on the Microsoft Proxy Server compact disc)

The server computer can be configured as a stand-alone server, a primary domain controller (PDC), or a backup domain controller (BDC). However, for the highest security level and best performance it is recommended that you install Microsoft Proxy Server on a computer configured as a stand-alone server. For more information about member servers, PDCs, and BDCs, see your documentation for Windows NT.

For best cache performance, it is strongly recommended that at least one disk drive on the server computer be configured as an Windows NT File System (NTFS) volume.

To Top Before You Install

Verifying Your Software Configuration
Verifying Your Hardware Configuration

To Top Verifying Your Software Configuration

Before you install Microsoft Proxy Server, complete the following tasks:

  • Verify that Microsoft Windows NT Server 4.0 is installed.
  • Verify that Microsoft Internet Information Server 2.0 is installed.
  • Verify that TCP/IP is installed on the server.

To Top Verifying Your Hardware Configuration

Setting Up the Disk Drives
Setting Up the Network Adapters
 Setting Up a Modem or ISDN Adapter

To Top Setting Up the Disk Drives

Microsoft Proxy Server can be installed on computers that have their hard disks configured as file allocation table (FAT) or NTFS volumes. However, for security and performance, it is recommended that at least one of the server’s hard disks be configured as an NTFS volume.

Features that NTFS volumes provide (and FAT volumes do not) include:

  • A maximum file size of up to 64 gigabytes (GB) (depending on the size of the disk clusters).
  • Integration with Windows NT security to control and audit file, share, and directory access.
  • An Activity log, which can be used to restore the disk in the event of power failure or other problem.
  • Support for flexible per-file compression.

The Web Proxy service of Microsoft Proxy Server stores cached Internet objects on one or more of the server’s drives. The particular drives used for this purpose are selected during installation. For best cache performance, it is strongly recommended that all the drives having space allocated to the cache be configured as NTFS drives.

If your current server disk volume is formatted to use FAT partitions, before or after installing Microsoft Proxy Server you can convert these partitions to NTFS using the Convert program included with Windows NT Server. Convert does not overwrite data on the disk. For more information about using this program to convert FAT volumes to NTFS volumes, see your documentation for Windows NT Server or type convert /? at the command line in the Command Prompt window.

To Top Setting Up the Network Adapters

Before you install Microsoft Proxy Server, verify that network adapter cards are installed and configured properly. To create a secure configuration, the Microsoft Proxy Server computer must have at least one network adapter connected to the private network, plus one network adapter, modem, or integrated services digital network (ISDN) adapter to connect to the Internet.

You should install the network adapter cards in your server computer before installing Microsoft Proxy Server. For more information on installing network adapter cards, refer to documentation provided with your adapter cards. Once the adapter cards are installed, you can configure each card by using the Network application in Control Panel.

To configure additional network adapter cards

  1. Open Control Panel.
  2. Double-click the Network application, then click Adapters to display that property sheet.
  3. Add the additional network adapter card by clicking the Add button in the Adapters property sheet.

To configure TCP/IP settings for internal and external network adapter cards

  1. Set TCP/IP protocol bindings for the external network adapter card.

    Set the binding to TCP/IP, so that it can communicate over the Internet. When binding this network card to TCP/IP, you are prompted for the card’s Internet Protocol address. This address is usually supplied by your Internet Service Provider (ISP).

    If the external network adapter card will be used to connect to the Internet, it must be bound only to the TCP/IP protocol. In particular, do not bind IPX/SPX or NetBEUI to the externally connected cards.

  2. Set protocol bindings for the internal network adapter card.

    If the server will be running the Web Proxy service, the network adapter card connected to the private network must be bound to TCP/IP. If the server will be running the WinSock Proxy service, the network adapter card connected to the private network can be bound to TCP/IP, IPX/SPX, or both.

    Note You can choose to implement Microsoft Proxy Server on a server that has only one network adapter card. This configuration can be used primarily for providing limited proxy service in the following ways:

    • Caching service for internal Web Proxy clients.
    • An IP application-level gateway to support internal IPX clients that use WinSock Proxy service.

    For more information, see “Server Administration.”

  3. Use one IP default gateway.

    A Microsoft Proxy Server computer should have only one IP default gateway. The IP address of the default gateway should be configured on the external network adapter card only.

  4. Disable dynamic host configuration protocol (DHCP) for the adapter cards.

    Use static IP addresses on the adapter cards. DHCP will attempt to reset the IP default gateway you selected for Microsoft Proxy Server.

To Top Setting Up a Modem or ISDN Adapter

RAS and Microsoft Proxy Server
Setting Up a Modem
Setting Up an ISDN Adapter
Setting Up RAS

To Top RAS and Microsoft Proxy Server

With Microsoft Proxy Server you can use the Windows NT Remote Access Service (RAS) dial-out client to connect to an Internet service provider (ISP). RAS dial-out requires the use of at least one of the following on the Server computer:

  • Modem You can install one or more modems. High-speed modems, such as 28.8 Kbps modems, are recommended.
  • ISDN adapter If you are using an ISDN line and have signed up for the ISDN service option with an ISP, install an ISDN adapter.

When selecting any hardware for use with a dial-up network connection, check the Windows NT Hardware Compatibility List to confirm that the modem or adapter you are purchasing is supported. Microsoft has tested these modems and ISDN adapters for use with RAS.

Also, try to select a modem or ISDN adapter that is the same or very close to the one that is used by the ISP you are using. This helps ensure optimal performance and the highest possible connection rates.

For information about selecting and installing a modem or ISDN adapter, see your documentation for Windows NT Server 4.0 or documentation provided with your modem or ISDN adapter.

To Top Setting Up a Modem

To set up a modem on the server computer

  1. Install the modem and start the server computer.
  2. In Control Panel, double-click the Modems application icon.
  3. Follow the on-screen instructions for installing a new modem.

For information about installing a modem, see your documentation for Windows NT Server 4.0 and the documentation provided with your modem.

To Top Setting Up an ISDN Adapter

Integrated Services Digital Network (ISDN) offers a much faster communication speed than ordinary telephone service which uses analog equipment. ISDN can operate at speeds of 64 or 128 Kb per second.

Unlike most available modems, not all ISDN hardware uses the same signaling technology. This can introduce connection problems between your ISDN provider (local telephone company) and your hardware adapter. In some cases, the adapter may not work at all with service in your area. For this reason it is important to consult with both telephone and Internet service providers you will working with in your local area before making final selection on ISDN adapters. As with modems, obtaining an adapter that is support by Microsoft and listed on the Hardware Compatibility List is also highly recommended.

To install an ISDN adapter

  1. Install an ISDN card and start the server computer.
  2. In Control Panel, double-click the Network application icon, click the Adapters tab, and click Add.
  3. Follow the on-screen instructions to select or install a device driver for the ISDN adapter.

You must restart the computer after you have installed the ISDN drivers. Otherwise, not all of the available ISDN ports may be listed on screen when you configure Remote Access for ISDN.

To Top Setting Up RAS

RAS can be installed during initial Windows NT Server installation or afterward. To install and configure RAS after Windows NT is installed, use the Network application in Control Panel. You will need to logged on as member of the Administrators group. Also, because you are connecting to an ISP, you need to have the TCP/IP Protocol installed before installing RAS.

To install the RAS client with Microsoft Proxy Server

  1. In Control Panel, click on Network, click the Services tab, and click Add.

  2. From the Network Service box, select Remote Access Service, and then click OK.

  3. Follow the on-screen instructions to complete the installation of Remote Access Service.

    Select Dial out only for port usage to configure RAS for dialout-only connection to an ISP. Port usage can be set by clicking Configure in the Remote Access Service Setup dialog box.

    Network protocol settings should include TCP/IP only (the IPX/SPX and NetBEUI check boxes should be cleared). Network protocols can be set by clicking Network in the Remote Access Service Setup dialog box.

For more information on setting up RAS, see your documentation for Windows NT Server 4.0. For information on setting dial out options, see “Server Administration.”

To Top Server Security Checklist

Connecting computers to the Internet provides for some very powerful and useful scenarios. It becomes possible to communicate with millions of people and computers worldwide by using the TCP/IP protocols. This broad flexibility imposes a degree of risk: Not only can you communicate with people and systems using the protocols that you choose, it is also possible for users to attempt to initiate communication with your systems.

Review the following list to learn how to reduce security risks.

  • If your private network runs TCP/IP, the server’s Enable IP Forwarding check box in the Network application should not be selected.

    Clearing the Enable IP Forwarding check box prevents unauthorized IP packets from infiltrating your network. The Enable IP Forwarding check box is located in the Microsoft TCP/IP Properties dialog box. To open this, use the Network application in Control Panel.

    To disable IP forwarding on Windows NT Server 4.0

    1. From the Start menu, select Settings, and then click Control Panel.
    2. In Control Panel, double-click the Network icon.
    3. In the Network dialog box, click the Protocols tab, select TCP/IP Protocol, and then click Properties.
    4. In the Microsoft TCP/IP Properties dialog box, click Routing.
    5. Make sure the check box for Enable IP Forwarding is cleared.
    6. Click OK, then click OK again.

    Warning If the Windows NT Remote Access Service (RAS) is installed on your gateway after Microsoft Proxy Server is installed, IP forwarding will be enabled. You must disable IP forwarding after installing RAS.

  • Use NTFS volumes.

    The Windows NT File System (NTFS) provides security and access control for your data files. By using NTFS, you can limit access to portions of your file system for specific users and services.

  • Run only the services that you need.

    The fewer services you are running on your system, the less likely a mistake will be made in administration that could be exploited. Use the Services application in Control Panel to disable any services not absolutely necessary on your system.

    Also, if FTP or Gopher services are not needed or used, turn off these services using Internet Service Manager to stop each service.

  • Unbind unnecessary services from your Internet adapter cards.

    Use the Bindings feature in the Network application in Control Panel to unbind any unnecessary services from any network adapter cards connected to the Internet.

    For example, you might use the Server service to upload new images and documents from computers in your internal network, but you might not want users to have direct access to the Server service from the Internet. If you need to use the Server service on your private network, the Server service binding to any network adapter cards connected to the Internet should be disabled.

    You can use the Windows NT Server service over the Internet; however, you should fully understand the security implications and comply with Windows NT Server licensing requirements issues. When you are using the Windows NT Server service you are using Microsoft networking—that is, the Server Message Block (SMB) protocol—and all Windows NT Server licensing requirements still apply.

  • Check permissions set on network shares

    If you are running the Server service on your Internet adapter cards, be sure to double-check the permissions set on the shares you have created on the system. It is also wise to double-check the permissions set on the files contained in the shares’ directories to ensure that you have set them appropriately.

  • Limit the membership of the Administrator group.

    By limiting the members of the Administrator group, you limit the number of users who might choose bad passwords.

  • Enforce strict account policies.

    User Manager for Domains provides configuration options called security policies, such as one that allows a system administrator to specify how quickly account passwords expire (forcing users to regularly change passwords), and another that determines how many bad logon attempts will be tolerated before a user is locked out. Use the User Manager for Domains security policies to configure the server against exhaustive or random password attacks.

  • Choose good passwords.

    Although this may seem obvious, a stolen or easily guessed password is the best opportunity for someone to gain access to your system. Make sure that all passwords used on the system, especially those with administrative rights, have difficult-to-guess passwords. In particular make sure to select a good administrator password (long, mixed-case, alphanumeric password) and set the appropriate account policies. Passwords can be set by using Windows NT User Manager for Domains.

To Top Connecting the Server to the Internet

Assessing Bandwidth Requirements
Selecting Connection Hardware
Selecting an ISP
Analyzing Connection Costs

To Top Assessing Bandwidth Requirements

Before establishing a connection for your server to the Internet, estimate the amount of connected use that is expected to occur. First, determine the number of users requiring Internet access. Other factors to consider include determining what applications and services will be used for this connection, and setting reasonable limits for data transfer between remote sources on the Internet and computers on your private network. If real-time application processing is required, this could also enter into your decision-making process.

Internet access is generally scaled to fit a wide range of service needs by using one of several access methods. Service is usually packaged to offer either dial-up analog access with a modem, the use of Integrated Digital Services Network (ISDN) technology, or T1 line services for large-scale network access. This section describes each of these methods separately.

  • Dial-Up Analog Access

    This type of connection most often uses SLIP/PPP (Serial Line Interface Protocol/Point to Point Protocol) to connect to an Internet Service Provider (ISP) for access to the Internet. Using dial-up access, Microsoft Proxy Server can operate with an analog phone line using a high-speed analog modem with data rates limited to 28.8 Kbps. This type of access is acceptable for limited situations, such as a single network user requiring outbound access for Web browsing, or for handling routine e-mail traffic for a small to medium-sized office. The analog modem is generally connected to a serial port interface installed within the Microsoft Proxy Server computer. The Remote Access Service (RAS) in Windows NT is used on the server computer to manage dial-up sessions and connect to a service provider.

  • ISDN Lines

    The Integrated Services Digital Network (ISDN) specification is a digital replacement for the analog phone system. An ISDN phone system is similar to a computer network. Currently, standard phone service requires using modems to convert data from digital signals generated by computers to analog signals that can be transferred across the analog phone lines that are located in most homes and businesses. Because ISDN is digital, no modem conversion is needed.

    An ISDN network requires ISDN lines and adapters. There are two ISDN line standards; ISDN Basic Rate Interface (BRI) and ISDN Primary Rate Interface (PRI). Each of these ISDN line standards consists of the following:

    • B-channels for voice and data that can transfer data at 64 Kbps per channel.
    • D-channels for signaling and line control. This channel is used for out-of-band signaling for call setup.

    BRI service provides the option of split service over two 64-Kbps B-channels or, by bridging the B-channels, speeds of 128 Kbps are possible for a single connection. PRI service provides a combined service rate of up to 1.544 Mbps (megabits per second) over multiple B-channels.

    Starting in the 1960s, telephone companies began to replace their internal backbone networks with digital technology. This digital technology uses the same signaling system as that specified for use with ISDN to manage line traffic and increase the number of connections that can be placed over a single physical line. ISDN extends this improved digital networking to the consumer site. Some phone systems do not provide support for ISDN.

    Microsoft supports ISDN functionality and has provided a number of device drivers for ISDN adapters currently available on the market. Also, Windows NT Remote Access Service offers support for ISDN as well. For more information on using ISDN with Microsoft products, refer to the Microsoft Web site or Microsoft Technet. You may also contact ISDN providers in your area or call your local phone company for more information on ISDN in your area.

    Typically, ISDN lines require additional installation and usage fees beyond normal phone service, but can be a good option for small or mid-sized companies that need larger bandwidth requirements than dial-up access can provide. ISDN can also be used by single users who require the fastest possible connections for accessing the Internet.

  • T1 Line

    A T1 line is another standard for high bandwidth transmission. A T1 line is similar to an ISDN line in that it allows multiple simultaneous channels, with each channel forming a separate connection. Standard T1 service in the United States offers 24 channels that each have rated capacities of 56 Kbps for each channel. T1 service is generally considered expensive in comparison to ISDN or normal phone service, but T1 line costs are decreasing.

    T1 lines are typically used by large organizations that do high-bandwidth data communications between remote sites. A variant of T1 service, known as 64 Kbps Dedicated Digital Line (DDL) service, or “fractional T-1,” is also available. When planning for purchasing of T1 lines, remember that Microsoft Proxy Server offers caching capabilities that can reduce bandwidth demands significantly.

To Top Selecting Connection Hardware

You can connect your server to the Internet with any of several hardware options. This section will focus on several hardware options for direct connection from your Microsoft Proxy Server gateway to the Internet, or in some cases, installing Microsoft Proxy Server behind a router on your network.

  • Analog Modems

    A typical analog modem transfers data at 14.4 or 28.8 Kbps. These speeds are usually appropriate only for a single user connecting to the Internet from a workstation, or for a dial-up mail gateway computer performing light e-mail routing. To establish shared access for multiple users for Web browsing and access to other online services, additional analog modems must be available for each user. For multiple users requiring modem access, consider modem pooling or LAN communication servers.

  • ISDN Adapters

    As ISDN network service becomes more affordable, ISDN adapters are becoming more prevalent and less costly. Each ISDN adapter is used to dial an ISDN access number and maintain a continuous open connection to the ISDN carrier. Microsoft Windows NT and Windows 95 are fully compatible with ISDN adapters for which there are Windows standard drivers.

  • Routers

    A router is a hardware device that connects one network to another. The router usually functions on the network as a peer to other networked devices such as workstations and servers. Under TCP, the router can have its own network IP address or network name under IPX/SPX. The router then becomes responsible for maintaining the dial-out connection to the ISP—typically an ISDN or T1 connection.

To Top Selecting an ISP

Because the Internet consists of many networks and organizations linked together, service access points are not centrally administered. The Internet backbone networks are operated by large telecommunications companies who sell access to their high-speed network of computers to smaller companies. These companies may in turn sell or further parcel out service to other smaller companies who deliver service to individual consumers.

Any company that connects an organization to the worldwide Internet for a fee is termed an Internet Service Provider (ISP). This model is in flux and even the largest Internet providers are providing service to homes, while some smaller ISPs offer ISDN and even T1 service. Listings of ISPs can be found everywhere from Internet-related magazines to your local newspaper.

In most cases, selecting an ISP requires answering questions related to your own specific needs. The most basic concerns that all Internet users must consider are the type of service connection and bandwidth you will require (such as dial-up, ISDN, or T1) and how your service usage will be billed. In most cases, ISPs can offer a single flat rate for unlimited usage, or as an alternative, charge an hourly rate for a limited number of hours of Internet access time each month.

Another issue to consider when choosing an ISP is whether you will require assistance in setting up a registered DNS domain name or IP address for your private organization or company. Some ISPs provide this service for an additional fee.

Note This is a distinction between commercial online services, such as CompuServe and America Online, which do provide Internet access by use of proprietary dial-up software, and an ISP, which provides a direct network connection to the Internet. You cannot connect your Internet gateway to a commercial online service.

To Top Analyzing Connection Costs

Two factors that can affect the cost of your Internet connection are bandwidth and the persistence of connection.

To select appropriate bandwidth connections for your network, you will want to examine peak level demands created by all of your network users using Internet access. In most cases, users who browse graphics-intensive sites will consume most of the available bandwidth. With the object caching capabilities and domain filtering features available with Microsoft Proxy Server, you may be able to reduce your actual bandwidth requirements by caching frequently accessed sites locally, or by restricting access to some graphic intensive sites. For more information about caching, see “Configuring the Web Proxy Service,” and Appendix D, “Architecture.”

Also, ISPs provide access in some cases that is available at an hourly rate or on a 24-hour, 7-days per week basis. Consider whether your users need full-time or part-time access to the Internet and compare pricing for alternative service plans.


CHAPTER 3, Server Installation

Server Installation

Installation Overview
What You Need to Know About the LAT
Setting the Web Proxy Listen-On Port
Installing Microsoft Proxy Server
Reviewing the Server Setup Log
Reinstalling Microsoft Proxy Server
Removing Microsoft Proxy Server
Installing Only the Administration Tool
Installing and Accessing the Documentation
Searching the Documentation

To Top Installation Overview

When you install Microsoft Proxy Server:

  • The Web Proxy service is installed on the server.
  • The WinSock Proxy service is installed on the server.
  • A shared network directory is created on the server, and a client setup program is placed there.
  • The online documentation is installed.
  • The administrative components are added to Internet Service Manager.

Before installing Microsoft Proxy Server, be sure to read “Preinstallation Requirements.” It contains important information about installation.

For information about upgrading from a preliminary release of Microsoft Proxy Server, see the Readme.txt file provided on the Microsoft Proxy Server compact disc.

To Top What You Need to Know About the LAT

During Microsoft Proxy Server installation you are asked to complete the Local Address Table Configuration dialog box. The information you provide is used to create a Local Address Table (LAT). This section describes the LAT, tells you what the LAT does, and shows you how the LAT is defined.

What is the LAT?
What is a Local LAT?
How is the LAT Defined?
LAT Configuration Considerations

To Top What is the LAT?

During Microsoft Proxy Server installation, the Setup program helps you create a list of the IP addresses that constitute your private network. The information you provide is used to create a table, called the Local Address Table (LAT), that defines your private network. IP addresses that are external to your private network are specifically excluded from this table.

The Setup program installs the LAT on the server. The file containing the LAT is named Msplat.txt and on the server its default location is C:\Msp\Clients (if you install Microsoft Proxy Server in a different location on the server, the Msplat.txt file is relocated accordingly). The Microsoft Proxy Server Setup program also installs a client Setup program into this directory.

The Microsoft Proxy Server Setup program configures the \Clients subdirectory on the server to be a network share named Mspclnt. Clients can connect to this share by connecting to \\Servername\Mspclnt and then running the client Setup program. The client Setup program configures the client computer as a client of the WinSock Proxy service, and also attempts to configure the client computer’s Internet browser as a client of the Web Proxy service. (The exact client configuration that client Setup implements depends on configuration choices you make during Microsoft Proxy Server Setup.)

During client Setup, the LAT file (Msplat.txt) is copied to the client. In order to keep client LAT files current, the Msplat.txt file is regularly updated from the server. Each time a Windows Sockets application on that client attempts to establish a connection to an IP address, the LAT is used to determine whether the IP address is on the private network, or is external. If the address is internal, the connection is made directly. If the address is external, the connection is made remotely, through the WinSock Proxy service on Microsoft Proxy Server.

Note that this is only a basic overview of the LAT. For more information, see Appendix D, “Architecture.”

To Top What is a Local LAT?

In some situations, you may need to provide access to additional internal IP addresses for selected client computers. One way to accomplish this is to create a custom LAT file for a client by editing its copy of the Msplat.txt file. However, this would only be temporarily effective, because each client’s Msplat.txt file is overwritten at regular intervals by a fresh version downloaded from the server. Any changes you make locally are lost each time the server updates the client’s Msplat.txt file.

Instead, you can create a permanent local LAT file for a client by creating a file named Locallat.txt and placing it in the client’s Mspclnt directory. The client will use both the Msplat.txt and Locallat.txt files if present. In this way, you can add additional IP address ranges that the client recognizes as part of the private network. This is useful, for example, to allow client access to a private subnet inside a corporation’s network.

For more information about the local LAT file, including information about how to create and edit a Locallat.txt file by using a text editor, see “Setting Up Clients.”

To Top How is the LAT Defined?

The LAT is defined during Microsoft Proxy Server installation, when you complete the Local Address Table Configuration dialog box. The LAT consists of a series of IP address pairs. Each address pair defines either a range of IP addresses (from the first, lower address to the second, higher address), or a single IP address (if both addresses of the pair are identical).

Note Each IP address pair identifies either a range of addresses, or a single IP address. The second entry is not a subnet mask.

To add addresses to the LAT, you can:

  • Click the Construct Table button in the Local Address Table Configuration dialog box. This generates the list of IP address pairs from internal routing tables used by Windows NT Server.
  • Use the edit controls in the Local Address Table Configuration dialog box to manually enter pairs of IP addresses.
  • Use a combination of both techniques (generate a list of IP address pairs, then use the edit controls to manually add and remove addresses).

During Microsoft Proxy Server installation, when you click the Construct Table button in the Local Address Table Configuration dialog box that generates the list of IP address pairs from internal routing tables used by Windows NT Server, in some cases the generated addresses might not completely define your private network. For example, the generated addresses could omit a subnet of your private network, or could include addresses external to your private network. It is important that you review the generated list of IP addresses. Use the edit controls to add any needed IP address pairs until all addresses of your internal network are defined. Remove any IP address pairs that define external (Internet) addresses.

Note If you find that a subnet of your private network is omitted when the list of IP pairs is generated, you need to add the IP address pairs as described above, but you also need to review and correct the server or network configuration to ensure that the missing subnet becomes accessible for TCP/IP connections.

To Top LAT Configuration Considerations

Following are some considerations to keep in mind when administering the Local Address Table Configuration dialog box and defining the LAT:

  • If you generate the list of internal addresses by clicking the Construct Table button, and then remove an address from the Internal IP Ranges list, you can introduce redundant load on the server. Clients will redirect the connections to that address through Microsoft Proxy Server, when they are already connected to that computer on the internal network.

  • Make sure that external (Internet) addresses are not entered in the Internal IP Ranges list. Doing so will add them to the LAT and will therefore identify them as internal addresses. This is a security breach and can provide unwanted external access to your private network computers. Also, an attempt by a client to connect to such an address is not redirected through Microsoft Proxy Server, and therefore that address is not reachable from the private network.

  • The IP addresses of the server’s internally connected network adapter cards must be defined as internal addresses (by including them in the Internal IP Ranges list), and the IP addresses of its externally connected cards should be defined as external IP addresses (by excluding them from the Internal IP Ranges list).

  • Regardless of the addresses entered in the Internal IP Ranges list, if the client is running only IPX/SPX, then any attempt to communicate over IP will be redirected through Microsoft Proxy Server, even if the destination is on the private network.

  • After Microsoft Proxy Server has been installed, if the LAT needs to be modified it can be edited by using Internet Service Manager, or by using a text editor to edit the Msplat.txt file (located by default in the C:\Msp\Clients directory). For more information see “Server Administration.”

To Top Setting the Web Proxy Listen-On Port

The Web Proxy service uses the port set for the WWW service as its listen-on port. The default is port 80. If you want to use a different port, before installing Microsoft Proxy Server use Internet Service Manager to change the WWW service port number.

To change the port

  1. From Internet Service Manager, double-click the computer name next to the WWW Service.
  2. In the Service tab of the WWW Service Properties window, type the port number in the TCP Port box, and then click OK.
  3. From Internet Service Manager, stop and restart the WWW service.

During Microsoft Proxy Server setup, the Setup program reads this port number from the Windows NT registry and adds it to the WebProxyPort field of the Mspclnt.ini client configuration file that Setup adds to the server’s Mspclnt client installation share. When a client computer installs the client software from that share (and if the option to configure client browsers has been set), the client’s browser is configured to use this port on the proxy.

If you change the WWW service port number after installing Microsoft Proxy Server, you must edit the WebProxyPort value in the Mspclnt.ini file in the server’s Mspclnt share. If browser clients of that server are not already configured to use that port, also use each browser’s configuration interface to configure the browser to use the new port number.

For more information about client computer configuration, the Mspclnt.ini file, and browser configuration, see “Setting Up Clients.”

To Top Installing Microsoft Proxy Server

Running Server Setup
Running Server Setup from the Command Line

To Top Running Server Setup

Follow these instructions to perform a fresh installation of Microsoft Proxy Server. For information about upgrading from a preliminary release of Microsoft Proxy Server, see the Readme.txt file provided on the Microsoft Proxy Server compact disc.

To install Microsoft Proxy Server

  1. Verify that the prerequisites listed in “Preinstallation Requirements,” have been satisfied. Also verify that the server has Windows NT Server version 4.0 and Microsoft Internet Information Server (IIS) version 2.0 installed, and then log on using a user account that has administrative privileges on the server.

  2. From the Ntupdate directory on the Microsoft Proxy Server compact disc, open the subdirectory that is appropriate to the server's processor architecture, and run Update.exe to install the Windows NT Server 4.0 Service Pack. After the Service Pack is installed, reboot the server computer and log on again using a user account that has administrative privileges on the server.

  3. From the root directory of the Microsoft Proxy Server compact disc, run Setup.

    –Or–

    Copy the contents of the compact disc to a shared folder, connect the server to that share, and run Setup.

    The Welcome dialog box appears.

  4. Click Continue.

    The CD Key Number dialog box appears.

  5. To record the product identification number (displayed on the Certificate of Authenticity provided with the product), type the number in the CD Key box, click OK, and then click OK in the confirmation dialog box that appears.

    The Change Folder dialog box appears.

  6. To change the folder into which Microsoft Proxy Server is installed, click Change Folder and complete the dialog box that appears. To accept the default folder, skip this step.

  7. Click OK.

    The Installation Options dialog box appears.

  8. To determine which Microsoft Proxy Server components are installed, select or clear the check box for each option. The Installation Options dialog box contains check boxes for the following items:

    • Install Proxy Server
    • Install the Administration Tool
    • Install Documentation

    By default, all components are selected.

  9. When the installation options are set appropriately, click Continue.

    The Microsoft Proxy Server Cache Drives dialog box appears. The server’s local drives are listed.

  10. To assign a disk to store cached data, select the drive from the list, type a number in the Maximum Size (MB) box, and click Set.

    Repeat as necessary to assign additional drives to store cached data.

    When configuring the cache drives you must, at a minimum, allocate at least one drive and 5 MB for caching. However, the recommended minimum allocation is higher. It is suggested you allocate at least 100 MB plus 0.5 MB for each Web Proxy service client (and round up to the nearest full megabyte). For example, if a server will be servicing 79 Web Proxy service clients, it is recommended you allocate 140 MB or more to the cache. For each server the optimal cache allocation varies depending on load and configuration, but in general, increasing the disk space allocation benefits the cache.

    Allocate space from a drive to the cache in increments of 5 MB. If you assign a number to the cache that cannot be evenly divided by 5, the allocation is rounded down to the next lowest 5 MB increment. For example, if you assign 194 MB to the C drive, 190 MB is actually allocated from that drive to the cache.

    Note It is strongly recommended that you use only NTFS volumes for caching. Also, do not assign a read-only drive (for example, a CD-ROM drive) to the cache.

    See “Server Features,” and Appendix D, “Architecture,” for more information about caching.

  11. Click OK.

    The Local Address Table Configuration dialog box appears. Use this dialog box to define all the internal IP addresses of your network, and to exclude all external IP addresses. For important information about his dialog box, see What You Need to Know About the LAT , earlier in this chapter.

  12. To create a table of the IP addresses of your internal network, click the Construct Table button.

    The Construct Local Address Table dialog box appears.

  13. To add to the LAT three ranges of IP addresses defined by IANA as private address ranges that can be used in a private IP network that is not connected to the Internet, select the Add the private ranges check box.

  14. To choose the network adapter cards on the server whose IP addresses are included in the LAT, select Load from NT Internal Routing Table and complete its options.

    • If you do not know which of the server’s network adapter cards are connected to the private network, select Load known address ranges from all IP interface cards.

    • If you know which of the server’s network adapter cards are connected to the private (internal) network and which are connected to the Internet, select Load known address ranges from the following IP interface cards to load only those IP addresses associated with the server’s internally connected cards. Then, in the list of network adapter cards, select the check box for each of the internally connected cards, and clear the check box for each of the externally connected cards.

  15. When you have completed the Construct Local Address Table dialog box, click OK.

    The Local Address Table Configuration dialog box returns. A list of IP address pairs is displayed in the Internal IP Ranges box.

  16. Verify that the entries in the Internal IP Ranges box correctly identify your internal network. Add any needed IP address pairs until all addresses of your internal network are defined. Remove any IP address pairs that define external (Internet) addresses.

    • To add a range of IP addresses to the list, under Edit type a pair of addresses in the From and To boxes, and then click the Add button.

    • To add a single IP address to the list, under Edit type the same address in both the From and To boxes, and then click the Add button.

    • To remove an IP address or address pair from the list, select it from the Internal IP Ranges box, and then click the Remove button.

  17. When the LAT configuration is properly set, click OK.

    The Client Installation/Configuration dialog box appears. Use this dialog box to enter information that is used by the client Setup program that Microsoft Proxy Server Setup installs into the Mspclnt share.

  18. Use the choices under WinSock Proxy Client to specify how the client Setup program will configure WinSock Proxy clients that install from this server.

    • Select either Machine or DNS Name or IP Addresses. If you select Machine or DNS Name, verify that the name is correct. If necessary type the appropriate name.

    • When the Enable Access Control check box is selected, WinSock Proxy service security is enabled, and only those clients that have been assigned permissions are able to use the WinSock Proxy service on this server. If you clear this check box, all internal clients will be able to use the WinSock Proxy service on this server. By default, this check box is selected.

    See “Server Administration” for information about using Microsoft Proxy Server with DNS, and “Configuring the WinSock Proxy Service” for information about setting WinSock Proxy client permissions.

  19. Use the choices under Web Proxy Client to specify how the client Setup program configures Web Proxy clients that install from this server.

    • Under Web Proxy Client select Set Client Setup to Configure Browser Proxy Settings to have the client Setup program configure client browsers as a Web Proxy client (if the browser is Netscape Navigator or Microsoft Internet Explorer).

      If you select this option, verify that the name shown in the Proxy to be Used by Client box is correct. If necessary type the correct name.

      Also, if you select this option the Client Connects to Proxy Via Port value displays the port number that Web Proxy clients will be configured to use. The value in this box cannot be changed here. It is the TCP port number that is set for Internet Information Server, and is changed using Internet Service Manager to administer the WWW service. For more information see Setting the Web Proxy Listen-On Port, earlier in this chapter.

    • When the Enable Access Control check box is selected, Web Proxy service security is enabled. When this check box is cleared, the Web Proxy service will not attempt to validate connections from clients. By default, this check box is selected. For information about configuring Web Proxy security, see “Configuring the Web Proxy Service.”

  20. When the Client Installation/Configuration dialog box is complete, click OK.

    Setup installs Microsoft Proxy Server.

To Top Running Server Setup from the Command Line

Optionally, you can start Setup from the command line and take advantage of the command-line options. For server installations, the syntax is as follows.

Syntax

setup [/r] [/u] [/k]

where

/r

Reinstalls Microsoft Proxy Server.

/u

Removes Microsoft Proxy Server but leaves shared components.

/k “keynumber”

Provides the compact disc key number, where keynumber is enclosed in quotes. The keynumber is the product identification number displayed on the Certificate of Authenticity provided with the product.

Note When entering the keynumber, do not enter a dash or a space. For example, 123-4567890 is entered as:

/k “1234567890”

To Top Reviewing the Server Setup Log

During Microsoft Proxy Server installation, the Setup program creates a log, Mpssetup.log, and places it in the root directory of drive C.

If you encounter problems with Setup, review this log by using any text editor (such as Microsoft WordPad or Microsoft Notepad). For more information about logging, see “Monitoring.”

To Top Reinstalling Microsoft Proxy Server

To add or remove selected Microsoft Proxy Server components

  1. From the root directory of the Microsoft Proxy Server compact disc or from a shared network folder, run Setup.

    The Setup dialog box appears.

  2. Click Add/Remove, and then follow the on-screen instructions.

To restore missing files or change Setup program settings

  1. From the root directory of the Microsoft Proxy Server compact disc or from a shared network folder, run Setup.

    The Setup dialog box appears.

  2. Click Reinstall, and then follow the on-screen instructions.

You can also reinstall Microsoft Proxy Server using the Control Panel.

To use the Add/Remove Programs application in Control Panel to reinstall Microsoft Proxy Server

  1. From the server, open Control Panel and click Add/Remove Programs.
  2. The Add/Remove Programs Properties dialog box appears.
  3. Make sure the Install/Uninstall tab is selected.
  4. Select Microsoft Proxy Server, click Add/Remove, and follow the on-screen instructions.

To Top Removing Microsoft Proxy Server

To remove Microsoft Proxy Server

  1. From the Microsoft Proxy Server program group, click Uninstall.

    The Uninstall Proxy Server dialog box appears.

  2. Click Yes.

    All installed components (Microsoft Proxy Server, the Proxy Server documentation, and the administration components) are removed from the computer.

You can also remove Microsoft Proxy Server by using the Setup program, but you must have the Microsoft Proxy Server compact disc or be connected to a network share containing that software.

To remove Microsoft Proxy Server by using the Setup program

  1. From the root directory of the Microsoft Proxy Server compact disc or from a shared network folder, run Setup.

    The Setup dialog box appears.

  2. Click Remove All.

    A message appears, asking you to confirm that Microsoft Proxy Server should be removed.

  3. Click Yes.

    All installed components (Microsoft Proxy Server, the Proxy Server documentation, and the administration components) are removed from the computer.

You can also remove Microsoft Proxy Server by using Control Panel.

To use the Add/Remove Programs application in Control Panel to remove Microsoft Proxy Server

  1. From the server, open Control Panel and click Add/Remove Programs.
  2. The Add/Remove Programs Properties dialog box appears.
  3. Make sure the Install/Uninstall tab is selected.
  4. Select Microsoft Proxy Server, click Add/Remove, and follow the on-screen instructions.

To Top Installing Only the Administration Tool

To set up a workstation for remote administration of Microsoft Proxy Server, you can install the administration tool for the Web Proxy and WinSock Proxy services without installing Microsoft Proxy Server. The administration tool can be installed on computers running these operating systems:

  • Windows NT Server 4.0 At a minimum, the Internet Service Manager component of Microsoft Internet Information Server 2.0 must be installed on the server before the Microsoft Proxy Server administration components can be installed.

  • Windows NT Workstation 4.0 At a minimum, the Internet Service Manager component of Microsoft Peer Web Services must be installed on the workstation before the Microsoft Proxy Server administration components can be installed.

To install only the administration tool

  1. From the root directory of the Microsoft Proxy Server compact disc or from a shared network folder, run Setup.

  2. When the Installation Options dialog box appears, select the Install Administration Tool check box, but clear the Install Proxy Server check box.

    Optionally, to also install the online Installation and Administration Guide, select the Install Documentation check box.

  3. Click OK, and then follow the on-screen instructions.

After installation, you can open the administration tool from the Microsoft Proxy Serv er program group.

To open and use the administration tool

  1. From the desktop click Start, select Programs, and then select Microsoft Proxy Ser ver.

  2. Click Internet Service Manager.

    The Microsoft Internet Service Manager window is displayed. It lists the Internet services available on the local computer. Because Microsoft Proxy Server is not installed on this computer, the Web Proxy and WinSock Proxy services are not included in the list.

  3. From the Properties menu choose Connect to Server.

    The Connect to Server dialog box appears.

  4. Type a server name in the Server Name box, then click OK.

    The Internet services available on that server are listed in Internet Service Manager. If that server has already had Microsoft Proxy Server installed, the Web Proxy and WinSock Proxy services appear in the list.

  5. As necessary, administer the Web Proxy and WinSock Proxy services on that server.

To Top Installing and Accessing the Documentation

The Installation and Administration Guide for Microsoft Proxy Server is installed with Microsoft Proxy Server (unless you change the default settings of the Setup program). It is provided in HTML format and is available online. Once it is installed, you can access the Installation and Administration Guide from two locations:

  • From the Help menu of Internet Service Manager

  • From the Microsoft Proxy Server program group

Note A Web browser (such as Microsoft Internet Explorer) must be installed on the computer in order for the documentation to be displayed.

Open the Installation and Administration Guide directly from Internet Service Manager to refer to the documentation while you are administering a server.

To open the online documentation from Internet Service Manager

  1. From the server’s desktop click Start, select Programs, and then select Microsoft Proxy Ser ver.

  2. Click Internet Service Manager.

    The Microsoft Internet Service Manager window is displayed.

  3. From the Help menu, click Microsoft Proxy Server Documentation.

    The server’s browser starts and the table of contents for the Installation and Administration Guide is displayed.

You can also open the Installation and Administration Guide from the Microsoft Proxy Serv er program group.

To open the online documentation from the program group

  1. From the server’s desktop click Start, select Programs, and then select Microsoft Proxy Ser ver.

  2. Click Microsoft Proxy Server Do cumentation.

    The server’s browser starts and the table of contents for the Installation and Administration Guide is displayed.

If Microsoft Proxy Server has not yet been installed on a computer, you have the option of installing only the documentation. You can then read or print out the documentation before installing Microsoft Proxy Server.

To install only the documentation

  1. From the root directory of the Microsoft Proxy Server compact disc or from a shared network folder, run Setup.
  2. When the Installation Options dialog box appears, clear all check boxes except the Install Documentation check box.
  3. Click OK, and then follow the on-screen instructions.
  4. The documentation will be installed. After installation it can be accessed by clicking the Microsoft Proxy Server Documentation icon from the Microsoft Proxy Server program group.

As another option, without installing any components you can open the Installation and Administration Guide directly from the Microsoft Proxy Server compact disc. You can then read or print out the documentation before performing any installation tasks.

Before installation, to open the online documentation directly from the Microsoft Proxy Server compact disc

  1. Start an Internet browser.

  2. From the Docs folder on the Microsoft Proxy Server compact disc, open the file Toc_msp.htm.

    For example, if the compact disc drive is the computer’s D: drive, you would have the browser open the following address:

    file:D:\Docs\Toc_msp.htm

    The browser loads the Table of Contents for the Installation and Administration Guide.

To Top Searching the Documentation

With Microsoft Index Server, users can query an entire site with a click of a button. It automatically indexes the full text and properties of various files (including HTML) on your server, whether it is an intranet, an Internet, or a file-and-print server.

You can use Microsoft Index Server to perform full text searches of the Microsoft Proxy Server Installation and Administration Guide. The Search buttons at the top and bottom of every page in the Installation and Administration Guide take you to a query form, from which you perform your search. A search results page provides you with links to search hits. (Note that this query form intentionally restricts searches to only the Installation and Administration Guide.)

Before you can use the query form to search the Installation and Administration Guide, the following prerequisites must be satisfied:

  • You must use the Microsoft Proxy Server Setup program to install Microsoft Proxy Server and its documentation on a server that already has Windows NT Server version 4.0 and Internet Information Server 2.0 installed.

  • You must install Microsoft Index Server on the server.

To install Microsoft Index Server

  1. Open the Microsoft Proxy Server Installation and Administration Guide.

    From the server’s desktop click Start, select Programs, select Microsoft Proxy Ser ver, and then click Microsoft Proxy Documentation. The server’s browser starts and loads the table of contents for the Installation and Administration Guide.

  2. From the table of contents, click Installing the Search Components .

    The Installing the Search Components page appears.

  3. Follow the instructions displayed on the Installing the Search Components page.

To search the Microsoft Proxy Server

  1. From any page of the Microsoft Proxy Server Installation and Administration Guide, scroll to the top or bottom of the page.

  2. Click the Search button.

    The Search page appears.

  3. Compose and issue a query, following the instructions displayed on the Search page.

  4. For information on how to compose effective queries, from the Search page click the Tips button.

Note If the prerequisites above are not satisfied, or if Microsoft Index Server has not been installed, when you click the Search button an error will be displayed.


CHAPTER 4, Server Features

Server Features

Feature Summary
Web Proxy Service Features
WinSock Proxy Service Features

To Top Feature Summary

Microsoft Proxy Server provides:

  • Extensive protocol support. Microsoft Proxy Server is compatible with most Internet protocols and Windows Sockets-based applications. On your private network it supports both Internet Packet Exchange/Sequenced Packet Exchange (IPX/SPX) and Transport Control Protocol/Internet Protocol (TCP/IP).

  • Security. It prevents unauthorized external access to your private network, and eliminates the need to connect clients directly to the Internet. It provides user-level security and Windows NT Challenge/Response authentication. Data encryption is supported by means of Secure Sockets Layer (SSL) tunneling.

  • Access control. Access can be managed by user, service, port, and Internet domain, for both inbound and outbound connections.

  • Ease of use. Microsoft Proxy Server is easy to install, manage, and monitor.

  • Integration with Windows NT Server. Microsoft Proxy Server integrates with the networking, security, and administrative interface of the operating system.

  • Performance. Microsoft Proxy server is extensively engineered to take advantage of the performance and scaleability offered by the Windows NT Server operating system. Additional features provided by Microsoft Proxy Server, such as caching, offer improved client performance and lower network costs.

With Microsoft Proxy Server, clients can access the Internet through the Web Proxy service or the WinSock Proxy service.

The Web Proxy service:

  • Is CERN-proxy compatible.
  • Supports all popular Internet browsers and the Hypertext Transfer Protocol (HTTP), Gopher, and File Transfer Protocol (FTP) protocols.
  • Caches HTTP objects.
  • Uses the TCP/IP protocol on the private network.
  • Provides user-level security for each application protocol. Provides secure, encrypted logon for those browsers that support Windows NT Challenge/Response authentication. Provides HTTP basic authentication for other browsers.
  • Allows data encryption by means of SSL tunneling.
  • Can be used with all popular client operating systems and hardware platforms.
  • Logs information about Internet requests made by clients.
  • Is administered through the easy-to-use, graphical interface of Internet Service Manager.

The WinSock Proxy service:

  • In addition to TCP/IP, supports IPX/SPX on the private network.
  • Uses Windows NT Challenge/Response authentication between the client and the server, whether or not the client application supports it.
  • Is compatible with most existing Windows Sockets version 1.1-compatible applications. This includes most popular Web browsers.
  • Controls inbound and outbound access by port number, protocol, and user or group.
  • Restricts (filters) access to Internet sites by domain name, IP address, and subnet mask.
  • Blocks external (Internet) users from accessing internal (private network) computers.
  • Hides internal IP addresses from the Internet.
  • Logs information about Internet requests made by clients.
  • Can be used with Windows-based client computers.
  • Is administered through the easy-to-use, graphical interface of Internet Service Manager.

To Top Web Proxy Service Features

Web Proxy Basics
Client Authentication
Domain Filtering
Caching

To Top Web Proxy Basics

Proxy is defined in general terms as “authority or power to act for another.” In the context of network computing, a proxy service is a service provided by a computer that assumes authority and power to act for computers to which it is connected. Such a service is useful in situations that require computers on networks that are not directly connected to each other to exchange information. A proxy service allows information exchange while maintaining security for individual computers.

Proxy services are particularly appropriate for today’s environment, in which the popularity and growth of the Internet has created a need for corporations, organizations, and schools to allow Internet access from client computers on their private network. At the same time, these entities need to isolate their private network from the Internet for a variety of reasons, including security, private addressing, and transport incompatibility. A proxy service reconciles these potentially incompatible needs.

A proxy service runs on a computer with at least two network adapter cards, one for each network to which it is connected. Typically, this computer is the only computer to which both networks are connected. The computer running the proxy service thus serves as a gateway computer between the two networks. Larger networks may have multiple gateway computers, each running the proxy service. The following figure shows a common scenario implemented using Microsoft Proxy Server. The Web Proxy service provides a private network client with access to the Internet.

With Microsoft Proxy Server, if both networks are running Transmission Control Protocol over Internet Protocol (TCP/IP) you should disable routing by clearing the Enable IP Routing check box in the Windows NT Server TCP/IP Advanced Configuration dialog box. Disabling this feature means that there can be no direct routing between the two networks: All information must pass through the proxy service.

The Web Proxy service supports proxy requests from any browser that is compatible with the standard CERN proxy protocol, such as Microsoft Internet Explorer or Netscape Navigator. The browser can be on a computer running any operating system platform, such as Windows, Windows NT, Macintosh, or UNIX. The browsers must be configured to use the proxy server, but the Web Proxy service requires no client-side components (because all client support needed for this standard protocol is built into most popular browsers).

The Web Proxy service includes such features as domain filtering, Internet resource caching, and client authentication. The Secure Sockets Layer (SSL) tunneling protocol is also supported. SSL Tunneling allows a client to create a connection to a server through the proxy for sending and receiving encrypted data that cannot be interpreted by the proxy. This is used for SSL with the HTTPS protocol, and the secure news protocol, SNEWS.

The Web Proxy service has built-in request logging that allows log records to be written to a flat file or to a database by using Open Database Connectivity (ODBC). This logging is separate from the logging built into the WWW service of Internet Information Service (IIS) and includes proxy-specific information.

To Top Client Authentication

Microsoft Proxy Server can be configured to allow anonymous requests by users, or to require users to be authenticated (validated) by the server. Once users are authenticated, access control configuration determines which protocols (Web, FTP, or Gopher) are accessible for each user. Users can be granted access to selected protocols.

Access control is integrated into Windows NT security and administration. The user accounts used for logon, or authentication, are created with User Manager, the standard User Account administration tool. Each Internet protocol (Web, FTP, Gopher) is represented within Microsoft Proxy Server by an object on which Access Control Entries (ACEs) can be applied, indicating which users have access to the protocol, and which users do not. Assignment of Access Control Entries is done in Internet Service Manager.

A convenient way to configure user-level access control is with Local Groups. With User Manager, an administrator can create groups, and add user accounts to these groups. Within Internet Service Manager, the site would assign Access Control to each group, as appropriate. For example, one group may have HTTP access only, and no FTP access. When a user joins or leaves, no changes would be necessary in Internet Service Manager; the user account can be added or removed from a group by using User Manager.

Microsoft Proxy Server supports two forms of user authentication: HTTP Basic authentication, and Windows NT Challenge/Response authentication. When using Basic authentication, the user sends a request by typing in a URL or clicking a hyperlink. The server responds with an “authentication failure” message to the client, and clients typically display a user name/password dialog box in response. The user enters a valid user name and password, and the browser reissues the same request, but this time the header contains user information, which is used by the server to authenticate the user.

In order for basic authentication to work with Microsoft Proxy Server, the browser being used must support the new “proxy-authenticate” HTTP header; Internet Explorer 3.0 supports this. Earlier versions of Internet Explorer do not support this header, and therefore do not support HTTP Basic Authentication through a proxy.

Basic authentication does not encrypt your user name and password before transmission. Basic authentication is encoded only by using UUencode, and can be decoded easily by anyone with access to your network, or to a segment of the Internet that transfers your packets.

Warning If you use Basic authentication, you will send your Windows NT user name and password in clear text (unencrypted) over public networks. Intruders could easily learn user names and passwords.

Windows NT Challenge/Response authentication uses the same secure mechanism for Microsoft Proxy Server logon that is used by clients that log on to a Windows NT-based computer. When this mechanism is used, the user needs to be logged on to the client computer, with a computer or domain user account that is valid on the computer running Microsoft Proxy Server . When the user issues a request, the Windows NT Challenge/Response protocol is used between client and server. Windows NT Challenge/Response authentication requires that the browser support the “proxy-authenticate” HTTP header, as well as HTTP Keep-Alives to a proxy, and NT Challenge/Response. Once a user is authenticated, the user remains authenticated for the life of the TCP connection (by use of the Keep-Alive mechanism). Internet Explorer 3.0 supports these requirements; earlier versions of Internet Explorer do not.

The Microsoft ActiveX™ Software Development Kit (SDK) includes information for third parties on how to support the Windows NT Challenge/Response protocol in Web browsers, whether they directly connect to Web servers or use proxy servers.

To Top Domain Filtering

Microsoft Proxy Server offers the ability to control which Internet sites are accessible to private network clients. The Web Proxy service can be configured to grant access to all Internet sites except for the ones specified, or it can be configured to deny access to all Internet sites except for the ones specified. In either case, the list of sites applies to all requests issued to the Web Proxy service on that server. It is currently not possible to specify domain filtering on a user-level basis, although different Microsoft Proxy Servers on your network can offer access to different sites and for different users. (Also, the open, documented Internet Server API (ISAPI) provides an extensible means for third parties to provide customized filtering.)

Each entry in the grant/deny list can be an IP address, an IP subnet, or a domain name. A domain name can be a computer name (such as www.microsoft.com), or a domain name that represents multiple computers (such as microsoft.com), in which case the entry applies to all computers in the domain.

If domain filtering is enabled, the Proxy ISAPI application verifies that each WWW, FTP, and Gopher request is directed to an Internet site to which access is permitted, before issuing the request to the site. If access is not permitted, an error message is returned to the client.

If the request specifies a Domain Name System (DNS) site name, the site name is resolved to an Internet Protocol (IP) address, and both the DNS name and IP address are searched for in the domain filtering site list. If a client request is received that specifies an IP address rather than a DNS name, the IP address is searched for in the domain filtering site list, and if at least one entry in the site list contains a domain name, the request’s IP address is converted to a DNS name by doing a DNS reverse resolution, and the domain name is searched for in the site list.

To Top Caching

The Web Proxy service uses caching to maintain local copies of Web objects. Subsequent requests for these objects can be serviced from a local disk copy rather than issuing the request over the Internet, which improves user-perceived performance and reduces bandwidth consumption on the site’s Internet connection.

The Web Proxy service caching provides the following features:

  • Passive caching of appropriate Web objects served by HTTP.
  • Active caching of HTTP-served objects by popularity.
  • Sends expired cache objects when the originating server is unavailable.

Passive caching uses the cache to store all cacheable objects returned to Microsoft Proxy Server by Internet servers. Many objects on the Web have characteristics that make them difficult or impossible to cache properly (for example, they might be dynamically generated, or require authentication for access). For this reason, the caching system only caches appropriate objects. Microsoft Proxy Server calculates a Time-To-Live (TTL) for all objects in the cache. When an object’s TTL has expired, the next request for the object is serviced on the Internet instead of the cache. For more information about caching, see Appendix D, “Architecture.”

Active caching uses the cache to proactively ensure the freshness and availability of popular objects. In this mechanism, the cache manager creates its own request for an object, without client prompting, when the TTL has expired or is near expiration. Web objects are subject to active caching on the basis of their popularity relative to their rate of change. Additionally, the active caching algorithm incorporates calculations of current server load in order to process requests to the Internet at times of low usage.

Returning expired objects when an Internet site is unavailable maintains potentially stale data in the cache. Expired objects can be used to service client requests sent to a remote server when that remote server is temporarily inaccessible.

To Top WinSock Proxy Service Features

Windows Sockets is a mechanism for interprocess communication (IPC) between applications running on the same computer, or on different computers connected by a local area network (LAN) or wide area network (WAN). Windows Sockets defines a set of standard APIs that an application uses to communicate with one or more other applications, usually across a network. Windows Sockets supports initiating an outbound connection (for clients), accepting an inbound connection (for servers), sending and receiving data on those connections, and terminating the connection.

WinSock Proxy is a mechanism that makes a Windows Sockets-compatible application running on a private network perform as if it were directly connected to the Internet, when actually there is a gateway computer connecting the two networks. The client application calls Windows Sockets APIs to communicate with an application running on an Internet computer. The WinSock Proxy components redirect the necessary APIs to the gateway computer, thus establishing a communication path from the internal application to the Internet application through the gateway computer. This is totally transparent to the two applications.

The WinSock Proxy service provides the following features:

  • Supports TCP/IP and IPX/SPX on the private network.

    WinSock Proxy supports communication over TCP/IP and IPX/SPX on the private network. However, only applications that are written to use Windows Sockets over TCP/IP (Internet applications) can be redirected.

    Because Winsock Proxy Supports communication on the private network by use of the IPX/SPX transport protocol, it allows access to Internet sites from Internet applications on IPX/SPX networks by using IPX/SPX communications between the client and Microsoft Proxy Server. It also allows access to internal Web sites from Web browsers on IPX/SPX networks by using IPX/SPX communications between the client and Microsoft Proxy Server, with Microsoft Proxy Server running on the same computer as the Web server.

  • Uses Windows NT Challenge/Response authentication between the client and the server.

    No application support is needed. The WinSock Proxy service provides Windows NT Challenge/Response authentication (a secure, encrypted logon process) whether or not the client application supports it. You can use Windows NT Challenge/Response authentication between WinSock Proxy clients and the WinSock Proxy service to avoid sending passwords across the internal network. Once authentication is done, the WinSock Proxy service uses the logon user name to verify that the user has permission to do the network operations attempted by the application.

    Authentication for an application is done one time only, when the application first links to Windows Sockets. Use of the WinSock Proxy client dynamic-link library (DLL). This avoids the overhead of authentication on each network connection. Authentication is done between the WinSock Proxy service and the WinSock Proxy client DLL on the internal computer, regardless of whether the internal application will be initiating outbound connections to the Internet or receiving inbound connections from the Internet. This means that special support on external (Internet) computers is not needed.

  • Is compatible with virtually all existing Windows Sockets version 1.1-compatible applications.

    The WinSock Proxy service offers client and server support for most standard and custom Internet applications that communicate by using Windows Sockets. Almost all Windows Sockets 1.1 TCP/IP applications can be redirected.

  • Controls inbound and outbound access.

    Access is controlled by port number, protocol, and user or group. Each port can be enabled or disabled for communications by a specific list of users or user groups. The list of users allowed to initiate outbound connections on a port can be a different list than the list of users allowed to listen for inbound connections on the same port. Access for TCP protocols is controlled separately from User Datagram Protocol (UDP) protocols.

  • Restricts (filters) access to Internet sites.

    You can restrict access to remote Web sites by domain name, IP address, and subnet mask. You can choose to grant access to all Web sites except those listed, or deny access to all Web sites except those listed. The settings are global and affect all users who access the Internet through the Microsoft Proxy Server.

  • Blocks external (Internet) users from accessing internal (private network) computers.

    Routing from the Internet to the private network is never allowed. (If your private network runs TCP/IP, the server’s Enable IP Routing check box in the Network application should not be selected. Clear this check box to prevent unauthorized IP packets from infiltrating your network. The Enable IP Routing check box is located in the Advanced Microsoft TCP/IP Configuration dialog box. You can find this dialog box by running the Network application in Control Panel.)

  • Provides IP-address aggregation.

    All requests to the Internet are done with the gateway server’s Internet IP address as the source address. This hides internal IP addresses, and allows use of unregistered or private (net 10) addresses.

  • Logs information about Internet requests made by clients.

    Each log entry contains the user name of the client and all request information including the time and date of the request, and the size of the requested objects. A new log can be created periodically. This can be daily, weekly, monthly, or when the file size reaches a preset size. The log can be maintained in a text file or in an ODBC-supported database (such as Microsoft SQL Server).

  • Can be used with Windows-based client computers.

    The application running on the private network must be a 16-bit or 32-bit Windows Sockets version 1.1 application running on a computer running Windows 3.1, Windows For Workgroups 3.11, Windows 95, or Windows NT. The application running on the external (Internet) network can be any TCP/IP-based application on any common operating system (such as Windows, UNIX, or Apple Macintosh).

  • Is administered through the easy-to-use, graphical interface.

    The WinSock Proxy service is administered by using Internet Service Manager, the administrative tool that is installed as part of Microsoft Internet Information Server. Property sheets for the WinSock Proxy service provide a simple, intuitive administrative interface. You can use Internet Service Manager to manage both local and remote computers running Microsoft Proxy Server.


CHAPTER 5, Server Administration

Server Administration

Server Administration Overview
Using Internet Service Manager
Putting Users in Windows NT Groups
Network Configuration
LAT Configuration
Dial-Up Support
Other Server Configuration Issues

To Top Server Administration Overview

Microsoft Proxy Server can be administered by using administrative tools provided with the product. It also interacts closely with Internet Information Server (IIS) and Windows NT Server settings. Together, using the tools provided with each of these Microsoft server products, you can develop an appropriate administrative configuration for Microsoft Proxy Server on your private network.

This chapter covers the following topics, which discuss how to administer Microsoft Proxy Server, as well as further considerations for administering the server to operate appropriately with other services on your network.

  • Using Internet Service Manager

    Internet Service Manager is an administrative tool provided by IIS. Internet Service Manager can be used to administer properties for two services provided by Microsoft Proxy Server: the Web Proxy and WinSock Proxy services.

  • Putting users in Windows NT groups

    For administering access to Web Proxy and WinSock Proxy services, it is recommended that you add users to groups, and then assign permissions to those groups. By using group assignments, you can simplify the administrative tasks needed to grant or revoke user permissions for Microsoft Proxy Server.

  • Considerations for configuring Microsoft Proxy Server on your network

    A number of considerations can affect how you choose to configure or install Microsoft Proxy Server on your private network. Configuring server network adapter cards and TCP/IP ports correctly is an important consideration. Also, for networks that use other TCP/IP services such as DNS, WINS, DHCP, or multiple gateways, further considerations apply when using Microsoft Proxy Server on your network.

  • Configuring the LAT

    The Local Address Table (LAT) is used by Microsoft Proxy Server to define your private network. It is used actively by both the Web Proxy and WinSock Proxy services when processing client requests. Because the LAT is a critical component for correct functioning of the proxy service, any discrepancies between addresses recorded in the LAT and the actual addresses used on your network must be monitored and corrected as they occur. You can modify or replace the LAT that is stored on the server as necessary.

  • Configuring dial-out support

    On-demand dial-out is a supported feature of Microsoft Proxy Server. Dial-out uses a Remote Access Service (RAS) compatible tool that supports RAS phone book entries. These entries can be used to schedule automated dial-out connections to the Internet through your Internet service provider.

To Top Using Internet Service Manager

Use Internet Service Manager, provided with Microsoft Internet Information Server, to administer the Microsoft Proxy Server services.

To configure Microsoft Proxy Server services with Internet Service Manager

  1. Click Start, select Programs, select Microsoft Proxy Server, and click Internet Service Manager.

    The Microsoft Internet Service Manager window is displayed. All installed Internet services for the current server are listed.

  2. If you will be managing a remote server, connect to that server.

    • To connect to a specific server, from the Properties menu click Connect to Server and complete the Connect to Server dialog box that appears.

    • To connect to all Microsoft Proxy Servers on your network, from the Properties menu click Find All Servers.

      Note The WinSock Proxy service on other server computers is not detected when Find All Servers is used. To connect to WinSock Proxy service for different computers, use Connect to Server and specify the server name for connection.

  3. To administer a server’s Internet service, double-click the computer name next to the service name.

    • To administer a server’s Web Proxy service, double-click the computer name next to that service.
    • To administer a server’s WinSock Proxy service, double-click the computer name next to that service.

    The Service Properties window for the selected service appears.

  4. Use the Service Properties window to configure the service.

    For more information about administering the Microsoft Proxy Server services, see “Configuring the Web Proxy Service,” and “Configuring the WinSock Proxy Service.”

To Top Putting Users in Windows NT Groups

Considerations For Planning Windows NT Groups
Creating New Groups For Proxy Users
Assigning Groups to Service Permissions

To Top Considerations For Planning Windows NT Groups

The Microsoft Proxy Server allows several possibilities for assigning permission rights for users to the Web Proxy and WinSock Proxy services. These permissions can be configured or enabled by using the Internet Service Manager.

For each of the service options that allow user permissions to be assigned, it is recommended that you create and use groups of users to simplify management of permissions for each user. You can use User Manager for Domains to create groups, which can be local groups on the server, or groups on the domain.

By separating your users into groups, you can simplify the process of modifying, adding, and removing user permissions Microsoft Proxy Server as your network service needs change.

The following are some guidelines for how to simplify managing user permissions for Microsoft Proxy Server by creating new local groups for this purpose.

  • Determine the default proxy services that will be needed by all (or the majority) of your users.

    For example, if you have a very small network, you could decide to manage all proxy users within a single group. This group could then be granted all Web Proxy and WinSock Proxy service permissions you choose to enable.

  • Determine any special cases for proxy users who need special permissions for selected services.

    If your network has more than a few users, you might want to create separate permissions for some services on your network. To do this, you can create additional user groups so that you can limit these special permissions to only a certain group of proxy users.

To Top Creating New Groups For Proxy Users

To administer users and groups by using User Manager for Domains

  1. From the desktop, click Start, select Programs, and then select Administrative Tools (Common).

  2. Click User Manager for Domains.

  3. Connect to the domain or server to be administered.

    From the User menu choose Select Domain and complete the Select Domain dialog box that appears.

  4. As necessary add users and groups, and add users to groups.

For instructions see the online Help for User Manager for Domains. Also see your documentation for Windows NT.

For further examples of how to use groups effectively to restrict access permissions on your internal network using groups, see “Security.”

To Top Assigning Groups to Service Permissions

Once groups have been created, you can use Internet Service Manager to assign appropriate service permissions to each of the new groups.

To assign permissions for Web Proxy or WinSock Proxy services

  1. From Internet Service Manager, double-click the computer name next to the Web Proxy or WinSock Proxy service.
  2. The Service Properties window for that service is displayed.
  3. Click the Permissions tab.
  4. Select a protocol, and grant or revoke permissions for groups or users to use that protocol.

    For more information about administering service permissions, see “Configuring the Web Proxy Service,” and “Configuring the WinSock Proxy Service.”

To Top Network Configuration

Setting up Network Adapter Cards
Using TCP/IP Ports
Using DNS, WINS, and DHCP with Microsoft Proxy Server
Using Multiple Microsoft Proxy Server Gateways
More About DNS, WINS, and DHCP

To Top Setting up Network Adapter Cards

Setup Considerations When Using Two Adapters
Configuring the External Network Adapter Card
 Configuring the Internal Network Adapter Card
Setup Considerations When Using a Single Adapter

The following section outlines some considerations to be followed when installing network adapter cards for use with Microsoft Proxy Server. In most installations, two network adapter cards will need to be installed on the server; one network adapter card for connecting to the internal private network, and the other adapter card to be used for external connection to the Internet or another external network.

In some circumstances, Microsoft Proxy Server may also be used with only a single adapter card as a way to provide limited use for caching services on a local network. When only one server adapter card is installed, gateway services are not in effect and the server can be configured similarly to other internal servers or clients on your network.

To Top Setup Considerations When Using Two Adapters

When setting up two network adapter cards for gateway operation, first install both network adapter cards in the server computer. Comply with any special manufacturer instructions for configuring the multiple network adapters for use in the same computer.

In most cases, device conflicts are possible where hardware settings are preconfigured for memory base I/O addresses or IRQ levels on each of the adapter cards. Check that base I/O and IRQ settings are set differently for each card and use settings that do not conflict with other devices that are currently installed on your system.

Make note of the configured settings used for each network adapter card as the card is installed and update these notes if changes are made while you are installing. Keeping notes can help reduce the amount of time required to troubleshoot any hardware device conflicts later.

Verify that both adapter cards are installed and configured correctly by using the Adapters property sheet in the Network application of Control Panel. Check for unique I/O base address and IRQ values for each adapter.

Tip If the hardware description for both server adapter cards is identical, it may be confusing to keep track of which adapter you are configuring. Windows NT identifies each adapter added to the system with a leading number, such as [1] for the first adapter installed and [2] for the second adapter installed. Refer to these numbers when you are attempting to verify or change settings for a specific hardware adapter.

To Top Configuring the External Network Adapter Card

The following considerations must be complied with when setting up the network adapter card that will be connected to the Internet.

  • Set protocol bindings appropriately for the external adapter card. This is done by using the Bindings property sheet in the Network application of Control Panel.

    Disable bindings for SMB Server, NWLink IPX/SPX Compatible Transport, WINS Client (TCP/IP), and the NetBEUI Protocol. For the WINS Client listing, disable bindings for all interfaces (Server, Workstation and NetBIOS interface). The only binding to be enabled for the external network adapter card should be TCP/IP Protocol.

  • Verify TCP/IP properties are configured properly for the external adapter card. This can be done from the Protocols property sheet in the Network application of Control Panel.

    For external TCP/IP connection to the Internet, you should check with your Internet Service Provider (ISP) to obtain correct information to enter for TCP/IP settings. In particular, you will need to know the IP address, subnet mask, default gateway, Domain Name System (DNS) domain name, and IP addresses for DNS servers to be used in DNS name searches. In some cases, your ISP may be using dynamic host configuration protocol (DHCP) or Bootstrap Protocol (BOOTP) to enable dynamic assignment of client addresses. Contact your ISP for further information about configuring the external adapter card where these services are active.

  • Perform initial communications testing for the external network adapter card.

    Use the Ping.exe (or similar utilities) provided with Windows NT and Windows 95 on another internal IP client computer to verify the server external adapter card is set correctly. You will need to use another computer located on the external segment when using Ping or other echo-reply type testing.

To Top Configuring the Internal Network Adapter Card

The following process details considerations for setting up the network adapter card that will be used to connect Microsoft Proxy Server internally to your private network.

  • Set protocol bindings appropriately for each network adapter card. This is done using the Bindings property sheet in the Network application of Control Panel.

    Disable any bindings that are not needed or currently used on your internal network, such as NetBEUI Protocol or WINS Client (TCP/IP). You must enable bindings for either NWLink IPX/SPX Compatible Transport, or TCP/IP Protocol on this adapter card.

  • Verify that NWLink IPX/SPX Compatible Transport and/or TCP/IP Protocol are installed and properties configured properly. This can be done from the Protocols property sheet in the Network application of Control Panel.

    For NWLink IPX/SPX Compatible Transport protocol properties on the internal network adapter, enter the same network number for Internal Network Number that is used by other Novell-based servers and clients on your private network. In most cases, you can use Auto Frame Type Detection to have Windows NT automatically detect the correct frame type that is in use on your internal network. In some cases, you may need to enter the frame type manually by using Manual Frame Type Detection. If you manually enter a frame type, be sure it is the same frame type supported by other Novell-based servers and clients on your network.

    If your private network uses RIP/SAP routing internally, you may also choose to enable RIP routing on the Routing tab as well. (Because RIP routing adds a considerable amount of traffic to your network, enable this only where it is needed for devices to communicate on your network.)

    Although TCP/IP Protocol Properties must be set for both network adapter cards, for internal TCP/IP connection, all address settings should be specified manually.

    Do not use the Obtain an IP address from a DHCP server option for obtaining an IP address for use on the internal network. In particular, you should enter a permanent reserved IP address for the Microsoft Proxy Server and an appropriate subnet mask for your local network. Also, do not enter an address for Default Gateway for the internal network adapter.

    Note If your private network uses DNS, Windows Internet Name Service (WINS), or DHCP services, you will need to consider how to configure the internal network adapter for the Microsoft Proxy Server to work with these services. For more information on using Microsoft Proxy Server with DNS, WINS, or DHCP services, see the “Using DNS, WINS, and DHCP Services” section later in this chapter.

  • Perform initial communications testing for both server network adapter cards.

    Use the Ping.exe (or similar utilities) provided with Windows NT and Windows 95 on another internal IP client computer to verify the server internal adapter card is set correctly. Also, if you are using IPX/SPX exclusively on your internal network, you can use an IPX-based utility that does pinging or echo-reply type testing.

To Top Setup Considerations When Using a Single Adapter

In some cases, the Microsoft Proxy Server can be used with a single network adapter on a private network. In this type of installation, no gateway services for Internet access are configured and the Microsoft Proxy Server is used primarily to provide a document caching service for local network users.

For configuring a Microsoft Proxy Server for a single network adapter connection to the internal network, you can use IP and DNS settings that are appropriate for servers and clients on your local TCP/IP network. There are no special considerations for TCP/IP network settings for this type of installation.

To Top Using TCP/IP Ports

What are TCP/IP ports?
Setting WinSock Proxy Port Permissions
Advanced TCP/IP Security with Windows NT

To Top What are TCP/IP ports?

Ports are used in TCP/IP to name the ends of logical connections that carry long-term conversations. A port is an abstraction to allow transport protocols such as User Datagram Protocol (UDP) and Transmission Control Protocol (TCP) the capability of handling communications between multiple hosts. It allows a communication to be uniquely identified. The WinSock Proxy service uses ports extensively to provide a way of redirecting applications.

For the purpose of providing services to unknown callers, a service contact port is defined. Each WinSock Proxy-enabled application specifies a port to be used as the contact port on the server for TCP or UDP. The contact port is sometimes called the “well-known port.” To some extent, these same port assignments are used with UDP. In order to use UDP, the application must supply the IP address and port number of the destination application.

Ports are identified by a positive integer. Originally, the assigned ports available were in the range 0 – 255. Currently, the range for assigned ports has been expanded to the range allow 4-digit port numbers up to 9999. The assigned ports use a small portion of the range of possible port numbers, allowing other unassigned port numbers to be designated as alternatives if the initial port is not available or to be used for new custom server applications.

Ports can be designated to use either TCP or UDP as the transport-level protocol specifying how ports send and receive data. In addition, port assignments are enabled separately for inbound ports and outbound ports on Microsoft Proxy Server. Inbound ports are used to listen for client requests from Internet clients, and outbound ports are used to listen for requests from clients on the internal private network.

To Top Setting WinSock Proxy Port Permissions

The Microsoft Proxy Server uses application service ports for the WinSock Proxy service. In order for each Windows Sockets-based application to work through a network connection, ports are used in combination with IP addressing to form a “socketed” connection. For information on how Windows Sockets works, see Appendix D, “Architecture.”

When ports are defined for the WinSock Proxy service, port permissions can be assigned to users for each application defined on the Microsoft Proxy Server gateway. For example, VDOLive is a supported application for the WinSock Proxy service. It uses outbound TCP port 7000 and inbound UDP port 0 as its “well-known ports” for defining service on the Microsoft Proxy Server. Users can then be granted permission to use VDOLive with WinSock Proxy. Once permissions are granted by using the Permissions property sheet in WinSock Proxy Properties, users have access to those ports (both inbound and outbound) that are assigned.

If you want to enable access to inbound and outbound service ports separately for users on your network, you can create additional protocol definitions in WinSock Proxy service properties for that purpose.

For example, suppose you wanted to permit both outbound and inbound port access for FTP service to all internal users on your network, but allow only inbound FTP logon for a single Internet client user called FTPClient1.

In this example, you might use the predefined protocol, FTP, and assign all of the internal users permissions to this protocol because it enables inbound and outbound port access. Then, to allow only inbound port access for the FTPClient1 user account only, you could create a new protocol definition called “FTP (inbound only)” and define only the inbound TCP port 0 for it. The FTPClient1 account could then be assigned permissions to the “FTP (inbound only)” protocol permissions list.

For more information on how to add WinSock Proxy protocol definitions and set access permissions, see “Configuring the WinSock Proxy Service.”

To Top Advanced TCP/IP Security with Windows NT

In addition to port-access permissions and protocol definitions created by using the Microsoft Proxy Server properties, Windows NT Server 4.0 provides additional settings for advanced TCP/IP security. This feature can be useful in instances where you want to selectively enable and disable TCP/IP ports or protocols globally for all users of that server on your network.

Some examples of cases where this feature might be useful include the following scenarios:

  • You are conducting testing of a new application that uses UDP ports on your local network. While testing is occurring, you need a way to quickly enable and disable selected UDP ports on your computer running Microsoft Proxy Server. In this case, you could remove and recreate user permission assignments or UDP protocol service definitions by using the Web Proxy and WinSock Proxy service properties, but these steps become much too involved to be repeated numerous times.

  • You are setting up a firewall server on your private network to the Internet. For this purpose, you want to thoroughly limit all default enabling of TCP ports, UDP ports, and IP Protocols on the computer running Windows NT Server.

To enable advanced TCP/IP security with Windows NT

  1. From the desktop, click the Start button.

  2. Select Settings and click Control Panel.

  3. Double-click the Network icon.

    The Network properties window is displayed.

  4. Click the Protocols tab.

  5. Select the TCP/IP Protocol. Click Properties.

    The Microsoft TCP/IP Properties sheet is displayed.

  6. Click Advanced.

    The Advanced IP Addressing property sheet is displayed.

  7. Select the Enable Security option.

    The Configure button located beneath Enable Security is enabled.

  8. Click Configure.

    The TCP/IP Security dialog box is displayed.

  9. Select Permit Only for one of the three listed options available (TCP Ports, UDP Ports, IP Protocols).

    The Add button is enabled.

  10. Enable ports or protocols.

    • Click Add. The Security Add dialog box is displayed.
    • Enter a port or protocol number for the option you are specifying permissions for.
    • Click Add in the Security Add dialog box after entering a port or protocol number. The port or protocol number appears in the Permit Only list in the TCP/IP Security property sheet.

    Repeat this step for all ports or protocols that require enabling.

To Top Using DNS, WINS and DHCP with Microsoft Proxy Server

Considerations for Using DNS
Considerations for Using WINS
Considerations for Using DHCP

The following section details further considerations for using the Microsoft Proxy Server with DNS, WINS, or DHCP services on your private network. For an overview of these services, see More About DNS, WINS, and DHCP, later in this chapter.

To Top Considerations for Using DNS

Microsoft Proxy Server as a DNS Server
Microsoft Proxy Server as DNS Client

To Top Microsoft Proxy Server as a DNS Server

When DNS services are used on the internal network, a computer running Windows NT Server and Microsoft Proxy Server can also be used as a DNS server for the internal network. The internal server adapter card must use static IP addressing (a permanent address on the local network) and no default gateway should be specified.

If you use the same server for Internet gateway access with Microsoft Proxy Server and for DNS servicing, be sure that the Windows NT DNS service and all internal hosts file information is accessible only to internal network clients. Set file system security appropriately to deny Internet users access, and disable DNS Server for the external network adapter.

For more information on configuring Windows NT Server for use as a DNS server, see your documentation for Windows NT Server.

To Top Microsoft Proxy Server as a DNS Client

There are no special considerations for Microsoft Proxy Server as a DNS client on the internal network. This is a recommended configuration for networks already using DNS service. Also, a HOSTS file can be used as an alternative when no DNS services are available on the internal network.

For more information on configuring Windows NT Server for use as a DNS client, see your documentation for Windows NT Server.

To Top Considerations for Using WINS

Microsoft Proxy Server as a WINS Server
Microsoft Proxy Server as a WINS Client

To Top Microsoft Proxy Server as a WINS Server

When WINS services are used on the internal network, the computer running Microsoft Proxy Server can also be used as a WINS server. The internal server adapter card must use a permanent IP address on the local network, with no default gateway specified. To be sure that the internal WINS database information cannot be seen by Internet users, deny these users file access to WINS service and LMHOSTS files and disable all WINS services for the external network adapter.

To Top Microsoft Proxy Server as a WINS Client

There are no special considerations for Microsoft Proxy Server as a WINS client on the internal network. This is a recommended configuration for networks already using WINS service. Also, an LMHOSTS file can be used as a WINS alternative when no WINS services are available on the internal network.

For more information on configuring Windows NT Server for use as either a WINS server or a WINS client, see your documentation for Windows NT Server.

To Top Considerations for Using DHCP

Microsoft Proxy Server as a DHCP Server
 Microsoft Proxy Server as a DHCP Client
 Microsoft Proxy Server as a DHCP Relay Agent

To Top Microsoft Proxy Server as a DHCP Server

When DHCP services are used on the internal network, the computer running Microsoft Proxy Server can be used as a DHCP server. However, The server must use a permanent address on the local network and no default gateway should be specified on the internal server adapter card. Also, be careful to enable DHCP Server for the internal network adapter only and to disable DHCP Server for the external network adapter.

To set Microsoft DHCP Server bindings for use with Microsoft Proxy Server

  1. Install and configure Microsoft DHCP Server.

    For information on installing and configuring Microsoft DHCP Server, see your documentation for Windows NT Server.

  2. From the desktop, click Start, select Settings, click Control Panel.

  3. Double-click the Network icon.

  4. Click the Bindings tab.

  5. From the Show Bindings for list box, select all services.

  6. Double-click Microsoft DHCP Server.

    The service listing expands to show protocols supported for this service.

  7. From the service view window, double-click TCP/IP Protocol.

    The service listing expands to show all adapters that are bound for this protocol and service.

  8. Select the external network adapter, click Disable, and then click OK.

To Top Microsoft Proxy Server as a DHCP Client

It is recommended that the Microsoft Proxy Server not be enabled as a DHCP client on the internal network. Instead use static IP addressing and assign a permanent IP address for the internal network on the server adapter card. Do not specify a default gateway when assigning IP addressing for this card.

To Top Microsoft Proxy Server as a DHCP Relay Agent

There are no special considerations for using Microsoft Proxy Server as DHCP relay agent on the private network between another DHCP server and DHCP clients. Use the Network application in Control Panel to set TCP/IP properties to enable DHCP relay. This option can be enabled by adding DHCP server addresses to the search list on the DHCP Relay property sheet.

To Top Using Multiple Microsoft Proxy Server Gateways

Multiple Gateway Overview
Using Multiple Proxy Gateways in a DNS Environment
Using Multiple Proxy Gateways in a WINS Environment
Using Multiple WinSock Proxy Service Gateways

For an overview of the DNS, WINS, and DHCP services, see More About DNS, WINS, and DHCP, later in this chapter.

To Top Multiple Gateway Overview

A private network can have more than one Microsoft Proxy Server gateway in use. Where multiple server computers are configured for Microsoft Proxy Server, Internet traffic loads can be balanced across each separate gateway by configuring clients to use all gateways evenly. For example, if you have two Microsoft Proxy Server gateways, one named PROXY1 and the other PROXY2, you would specify either PROXY1 or PROXY2 in the proxy connection settings for each client browser and the valid port to be used (typically, port 80 is used for HTTP proxy service). Load balancing is managed in this manner when multiple proxy gateways are added.

Another option with multiple proxy gateways is to separate loads by service type across different servers. For example, you can enable HTTP proxy service for server (such as PROXY1) for a client and specify a second server (such as PROXY2) for enabling FTP proxy service.

To Top Using Multiple Proxy Gateways in a DNS Environment

When you use multiple gateways on a private network with DNS services, you must configure at least one entry for each gateway that indicates an IP address to be searched for on the local network to provide DNS name resolution. The DNS server address specified will be used to forward all domain name requests. In some cases, you may also have a secondary DNS server address to be searched for and used if the first DNS server is not available.

Note When working with DNS environments that are located on the Internet, it is not unusual for companies to make mutual arrangements to host each other’s DNS entries. This ensures that, if a primary DNS server becomes unavailable, there is a backup domain server for the domain. This backup domain server is listed with the domain record that is registered with the Internet Network Information Center (InterNIC). Both DNS servers are mutually configured to provide secondary DNS service to the complimentary domain.

You can also use DNS “round-robin,” a feature that offers load balancing for multiple DNS servers on a network. Round-robin involves assigning a single DNS domain name to be serviced by multiple DNS servers, each with its own IP address on the local network. The round robin configuration assures that for all DNS name lookup requests, any server assigned for round-robin can that is currently available can respond to a DNS request.

For more information about configuring Windows NT Server as a DNS server, see your documentation Windows NT Server.

To Top Using Multiple Proxy Gateways in a WINS Environment

In a WINS environment, you use the WINS Server to configure a multi-homed environment. This is similar to the DNS environment in that you create one entry, which contains the list of IP addresses for all the Microsoft Proxy Server gateways. In a WINS environment, there are three levels of name resolution. At first the WINS Server matches a client’s request with the client’s IP address. The WINS Server seeks a Proxy Server with the same subnet as the client. The WINS Server then seeks a Microsoft Proxy Server gateway with the same net as the client. If WINS cannot match a client to a gateway in this fashion, it picks a gateway from the WINS list at random.

For more information about configuring Windows NT Server as a WINS server, see your documentation for Windows NT Server.

To Top Using Multiple WinSock Proxy Service Gateways

WinSock Proxy clients use the WinSock Proxy service on the server they were configured to use by the client Setup program.. This information is preconfigured during Proxy Client Setup, in the Mspclnt.ini file. To balance the load across each of your Microsoft Proxy Server gateways configure the Microsoft Proxy Server client initialization files appropriately (for example, to use DNS round-robin).

For information about configuring WinSock Proxy clients and the Mspclnt.ini file, see “Setting Up Clients.”

To Top More About DNS, WINS, and DHCP

Background on Internet Naming and Addressing
What is DNS?
What is WINS?
What is DHCP?

To Top Background on Internet Naming and Addressing

As the Internet continues to increase grow in size and numbers, the use of TCP/IP for private internetworking increases along with it as well. The primary reason for this increase is that TCP/IP offers the benefit of a widely deployed set of open protocol standards that are well suited to forming wide area networks (WANs).

In order for each computer to identify itself on the TCP/IP network, each host must be uniquely identified by the following information:

  • An IP address This is a 32-bit field that is composed of four octets (8-bit numbers from 0 to 255). Each address has decimal notation to separate octet numbers, such as 10.10.100.201.

  • A subnet mask This indicates how the IP address is to be read. It indicates how to separate the network identifying information from the host identifying information, and interprets the IP address correctly. For example, if a subnet mask of 255.255.255.0 is applied for an address 10.85.189.24, it indicates that the host number is 24 located on the 10.85.189 subnetwork.

  • A default gateway This is used to specify the address for the nearest routing device that will be used by the host device to forward addressed packets onto the network.

One way to configure this address information is to have a network administrator or technician manually enter these settings on each computer before it is joined to the local network. For small networks, this does not present an overly difficult problem, but as networks become larger or further divide into multiple subnetworks, integrating new devices onto existing networks becomes a significant chore for network administrators to manage. In addition, this chore might need to be repeated each time a device is relocated to a different subnetwork.

This type of manually applied configuration is referred to as static IP addressing. It requires that all addresses be recorded and centrally maintained by a network administrator. This is to provide an orderly procedure for adding new devices and avoid problems that can arise from duplicating address assignments on the network.

Another limitation of IP addressing is that users find it awkward to deal with numbers when locating devices on the network. Although IP addressing is an efficient scheme that works optimally for computers and routers, in practice it is true that network users find common names for hosts(such as myserver.mycompany.com) much easier to remember than IP addresses (such as 10.100.206.195). Further solutions for mapping user-friendly names to assigned IP addresses simplify user access, but compound the existing administrative problems already inherent in TCP/IP.

The following section covers some of the accepted and proposed standards that have been drafted to provide solutions for all of these TCP/IP shortcomings. Standards for mapping IP addresses to common names through the use of the Domain Naming System (DNS) and for maintaining dynamic storage of network names and IP addresses by use of the Windows Internet Name Service (WINS) are discussed first. Protocols developed to automate the process of assigning IP addresses and configuring clients, such as the Dynamic Host Configuration Protocol (DHCP) are also discussed.

To Top What is DNS?

The Domain Naming System (DNS) was developed by the Internet Engineering Task Force (IETF) as an attempt to standardize a way to map pairings of logical host names to actual IP addresses on a TCP/IP network.

DNS is an acceptable method for resolving names to addresses, but it requires the use of host files, and DNS servers must be overseen and updated manually as names and addresses are modified. This furthers the administrative chores that a TCP/IP network administrator must perform, although it does simplify network access for users.

For DNS to work properly it requires the use of a name space. The DNS name space is hierarchical in nature and allows host names to be stated in absolute or relative terms. Absolute names, or Fully Qualified Domain Names (FQDNs) are defined from the root of the name space and uniquely identify a node in the hierarchy. FQDNs end with a trailing dot. Relative names are represented relative to a name in the hierarchy. For example, server.microsoft.com is a relative DNS name of a host defined from the com part of the DNS name space hierarchy, which contains domain names of commercial organizations.

If the domain name of a company is:

mycompany.com

then the following domain names:

sales.mycompany.com

and:

marketing.mycompany.com

are known as subdomains of the mycompany.com domain.

In addition to planning for domain hierarchies, DNS services use host files, which are flat text files that pair DNS domain names and IP address pairings for hosts on the local network. Host files are used by the DNS server to process and resolve name query requests forwarded by DNS clients initiating communications on the local network. In nearly all cases where DNS is used, host files must be created and updated manually for DNS service to work properly for all hosts.

Because DNS is a supported standard for all TCP/IP networks, there are typically no restrictions to using DNS services on most private networks that support TCP/IP network. Although other TCP/IP servers that are not Windows-based can be made to function as DNS servers, Windows NT Server provides the option of acting as a DNS server as well.

For more information on setting up Windows NT Server for use as a DNS Server, see your documentation for Windows NT Server. Also see Using DNS, WINS, and DHCP with Microsoft Proxy Server, earlier in this chapter.

To Top What is WINS?

Windows Internet Naming Service (WINS) is another option for resolving host names on networks that use Microsoft TCP/IP. It provides a distributed database for registering and querying dynamic computer name-to-IP address mappings in a routed network environment. WINS uses the NetBIOS computer name for any Microsoft-based network client to register each client in the WINS database on a computer running Windows NT Server.

A WINS system consists of the following:

  • WINS server Runs on a Windows NT Server and handles name registration requests from WINS clients and registers their names and IP addresses. The server also responds to name queries from WINS clients by returning the IP address of the name being queried (assuming the name is registered with the WINS server).

  • WINS client Registers its name with the WINS server when it joins or leaves the network. It also queries the WINS server for remote name resolution.

  • WINS proxy Helps resolve names on behalf of non-WINS clients. The proxy communicates with the WINS server to resolve names (rather than maintaining its own database) and then caches the names for a certain amount of time. The proxy serves as an intermediary between the WINS server and the non-WINS client, either by communicating with the WINS server or by supplying a name-to-IP address mapping from its cache. The presence of a WINS proxy in a WINS system is dictated solely by the presence of non-WINS clients.

If you are administering a routed internetwork, WINS is the best choice for NetBIOS name resolution, because it is designed to solve the problems that occur with name resolution in a complex internetwork. WINS goes beyond eliminating the need for an LMHOSTS file (a hosts file of NetBIOS names–to–IP address pairs) by reducing the use of local broadcasts for name resolution and allowing users to easily locate systems on remote networks.

Using WINS provides several benefits. In a dynamic network environment where host IP addresses can change frequently, WINS provides an excellent way to dynamically register these changes as they occur. It centralizes management of the NetBIOS names–to–IP addresses mapping database, so that there is no need to manage multiple LMHOSTS files on across several servers on a network. It also reduces IP broadcast traffic in a NetBIOS-based internetwork, while allowing the clients to locate remote systems across local or wide area networks easily. Finally, with WINS, users on a Windows NT network can browse transparently across routers (for Windows NT domains that span multiple subnets). Browsing without WINS is complicated and involves manual procedures.

For more information, see Using DNS, WINS, and DHCP with Microsoft Proxy Server, earlier in this chapter.

To Top What is DHCP?

The Dynamic Host Configuration Protocol (DHCP) was established to relieve the administrative burden of manual configuration of TCP/IP hosts on the network. DHCP provides an alternative to static IP addressing by enabling automatic configuration of the TCP/IP-related parameters when a DHCP client becomes active on the local network.

Note DHCP provides a way of passing configuration information to hosts that is based on an earlier protocol standard, known as the Bootstrap Protocol (BOOTP). BOOTP was conceived as a way to allow diskless workstations to obtain TCP/IP configuration settings and perform a network “boot.” DHCP uses some of the same concepts as BOOTP, such as a shared message format, which allows existing BOOTP clients to interoperate with DHCP Servers. However, there are further additions to DHCP that distinguish it from BOOTP and the two protocols are not identical in all respects.

DHCP provides safe, reliable, and simple TCP/IP network configuration. It ensures that address conflicts do not occur, and helps conserve the use of IP addresses by use of centralized management of address allocation. DHCP conserves addresses that are not in use by having the DHCP server reclaim an address after the address lease period has elapsed.

The system administrator controls how IP addresses are dynamically assigned by the DHCP server. To establish DHCP service, you set several parameters that are used to manage dynamic assignment of IP addresses. First, a lease period for each address is set. A lease specifies how long a computer can use an assigned IP address before having to renew the lease with the DHCP server. Another parameter that must be set for DHCP service is a scope. A scope indicates the available range of addresses that can be used within DHCP assignment. The scope provides for an available pool of addresses for the DHCP server to use when assigning and configuring clients. The scope exists only once for an entire subnetwork, but it can be further defined by excluding reserved subranges of addresses from the pool of assignable addresses allowed by the scope.

There are three major benefits to setting up a DHCP environment. First, it requires no additional address configuration for the workstation. This is useful because users do not need to know or maintain their computer’s TCP/IP address configuration. This can be useful for mobile computer users who use portable computers that are moved to different offices or subnets frequently. Second, DHCP clients can be configured with additional TCP/IP parameters, such as the DNS server address or WINS server addresses that are essential for successful name-to-IP-address resolution by a host. Third, DHCP gives you better control of IP address assignment and management. For example, if the IP address for a router in a network changes and 250 client computers have to be updated with the new address, with DHCP you do not have to visit every workstation to reconfigure the default gateway manually.

How does DHCP work?

DHCP is based on a client/server model. The DHCP server runs on a server, such as a Windows NT Server. The DHCP client runs on a network client such as a Windows 95 or Windows NT Workstation.

During system startup (the initializing state), a DHCP client computer sends a DHCP “discover” message that is broadcast on the local network and can be forwarded to all the DHCP servers on the private internetwork. Each DHCP server that receives the discover message responds with an “offer” message containing an IP address and valid configuration information for the DHCP client computer that sent the request.

The DHCP client then collects the configuration and enters a selecting state, where it chooses one of the address “offers” provided by the DHCP servers. The client selects one of the offered configurations and enters a requesting state. It then sends a “request” message to specify a request from that DHCP server. The selected DHCP server sends an “acknowledgment” message that contains the address requested, a valid lease for the address, and TCP/IP network configuration parameters for the client. The client enters a bound state after receiving the acknowledgment from the server and can now participate on the TCP/IP network.

Client computers with local disk storage save the received address for use during subsequent system startup. As the lease approaches its expiration date, the client attempts to renew its lease with the DHCP server. If the DHCP server that initially offered the lease is not available or the lease has expired, the client repeats the process and gets a new configuration from any of the DHCP servers available.

The following three types of hosts can be active in a DHCP configuration process.

  • DHCP Server Contains IP addresses, lease duration, and associated TCP/IP configuration information. The DHCP server listens for client requests and processes them.

  • DHCP Client Gets its IP address and related TCP/IP configuration parameters from the DHCP server during the initialization stage. The client also extends the lease on the IP address by renewing the lease before it expires.

  • DHCP Relay Agent A relay agent software (compliant with RFC 1542) assists in forwarding the DHCP packets between subnets in a routed internetwork. Usually, this component runs on the routers.

For more information about setting up DHCP services, see your documentation for Windows NT Server. Also see Using DNS, WINS, and DHCP with Microsoft Proxy Server, earlier in this chapter.

To Top LAT Configuration

Overview of LAT Configuration
Modifying the LAT
Replacing the LAT

Overview of LAT Configuration

During Microsoft Proxy Server installation the Setup program helps you create a list of the IP addresses that constitute your private network. The information you provide is used to create a table, called the Local Address Table (LAT), that defines your private network. IP addresses that are external to your private network are specifically excluded from this table. The server maintains the master copy of the LAT, and a copy is downloaded to client computers.

The Setup program creates the original copy of the LAT. After installation, the server’s copy of the LAT can be modified by using Internet Service Manager.

To Top Modifying the LAT

You can modify the existing LAT, adding or removing to the IP address pairs provided by the Windows NT Server internal routing tables.

To modify the LAT

  1. From Internet Service Manager, double-click the computer name next to the Web Proxy or WinSock Proxy service.

    The Service Properties window appears. Make sure the Service tab is selected.

  2. Click the Edit Local Address Table (LAT) button.

    The Local Address Table Configuration dialog box appears.

  3. Verify that the entries in the Internal IP Ranges box correctly identify your internal network. Add any needed IP address pairs until all addresses of your internal network are defined. Remove any IP address pairs that define external (Internet) addresses.

    • To add a range of IP addresses to the list, under Edit type a pair of addresses in the From and To boxes, and then click the Add button.

    • To add a single IP address to the list, under Edit type the same address in both the From and To boxes, and then click the Add button.

    • To remove an IP address or address pair from the list, select it from the Internal IP Ranges box, and then click the Remove button.

    Be sure to exclude from the LAT any IP addresses associated with Internet-connected network adapter cards on servers running Microsoft Proxy Server. These are external IP addresses and should not be included in the LAT.

  4. When the configuration is properly set, click OK, and click OK again.

  5. Stop and start the WinSock Proxy and Web Proxy services.

    The LAT changes do not take effect on the server until the services are restarted.

To Top Replacing the LAT

You can also completely replace the LAT, generating a new list of IP address pairs from internal routing tables used by Windows NT Server.

To replace the LAT and generate a new list of addresses

  1. From Internet Service Manager, double-click the computer name next to the Web Proxy or WinSock Proxy service.

    The Service Properties window appears. Make sure the Service tab is selected.

  2. Click the Edit Local Address Table (LAT) button.

    The Local Address Table Configuration dialog box appears.

  3. To completely replace the addresses shown in the Internal IP Ranges list and generate a new table of IP addresses, click the Construct Table button.

    The Construct Local Address Table dialog box appears.

  4. To add to the LAT three ranges of IP addresses defined by IANA as private address ranges that can be used in a private IP network that is not connected to the Internet, select the Add the private ranges check box.

  5. To choose the network adapter cards on the server whose IP addresses will be included in the LAT, select Load from NT Internal Routing Table and complete its options.

    • If you do not know which of the server’s network adapter cards are connected to the private network, select Load known address ranges from all IP interface cards.

    • If you know which of the server’s network adapter cards are connected to the private (internal) network and which are connected to the Internet, load only those IP addresses associated with the server’s internally connected cards. Select Load known address ranges from the following IP interface cards. Then, in the list of network adapter cards, select the check box for each of the internally connected cards, and clear the check box for each of the externally connected cards.

  6. When you have completed the Construct Local Address Table dialog box click OK.

    The Local Address Table Configuration dialog box returns. A list of IP address pairs is displayed in the Internal IP Ranges box.

  7. Verify that the entries in the Internal IP Ranges box correctly identify your internal network. Use the Add button to add any needed IP address pairs until all addresses of your internal network are defined. Use the Remove button to remove any IP address pairs that define external (Internet) addresses.

    Be sure to exclude from the LAT any IP addresses associated with Internet-connected network adapter cards on servers running Microsoft Proxy Server. These are external IP addresses and should not be included in the LAT.

  8. When the LAT configuration is properly set, click OK, and then click OK again.

  9. Stop and start the WinSock Proxy and Web Proxy services.

    The LAT changes do not take effect on the server until the services are restarted.

To Top Dial-Up Support

How Dial-Up Support Works
Using RAS with Microsoft Proxy Server
Using Microsoft Proxy Auto Dial
Restarting Services After a Dial-Up Connection

To Top How Dial-Up Support Works

For Microsoft Proxy Server, dial-up support for connecting to an Internet service provider (ISP) is managed by using the Microsoft Proxy Auto Dial utility, Adialcfg.exe.

Microsoft Proxy Auto Dial uses Remote Access Service (RAS) phone book entries to perform on-demand dial-up connections as a RAS client. Once a RAS client is installed and configured on the server computer, Dial-Up Networking can be used to create RAS phone book entries for service dialing with Microsoft Proxy Server.

For dial-up support, connections are made by Microsoft Proxy Server when the following service demands occur:

  • For the Web Proxy service, a dial-up connection is used when a requested object cannot be located and returned by the Web Proxy caching service.
  • For the WinSock Proxy service, all client requests are processed by using a dial-up connection.

To Top Using RAS with Microsoft Proxy Server

Configuring RAS Options
Creating RAS Phone Book Entries
Other RAS-Related Issues

To Top Configuring RAS Options

To configure dial-up support for Microsoft Proxy Server, first verify that RAS has been installed and configured properly. (If RAS is not currently installed, refer to your Windows NT product documentation for more information on installing and configuring RAS.) Once RAS is installed, you must configure port usage for dial-out only (to support dial-up service).

To set or verify a RAS client for dial-up support

  1. From the server’s desktop, select Settings, then select Control Panel.
  2. Select the Network icon and double-click it. The Network Properties dialog box appears.
  3. Click the Services tab, then select Remote Access Service from the list of network services.
  4. Click Properties. The Remote Access Setup dialog box appears.
  5. If necessary, select a port from the list. If only a single port has been set up for RAS use, this port will be selected by default.
  6. Click Configure. The Configure Port Usage dialog box appears.
  7. From the Port Usage options, select Dial out only, then click OK.
  8. From Remote Access Setup, click Network. The Network Configuration dialog box appears.
  9. Select TCP/IP from the list of dial-out protocols, then click OK.
  10. From Remote Access Setup, click Continue.
  11. Click Close from the Network Properties dialog box, then select Yes when prompted to restart the computer.

Note If RAS was installed and ports were configured initially as a RAS server (to receive calls) and not as a RAS client (to dial out only), port usage must be changed. For more information on changing from RAS server to RAS client settings, see Using RAS Server and Microsoft Proxy Server .

Once the RAS client is installed, you must reconfigure Remote Access Autodial Manager and Remote Access Connection Manager services to use Microsoft Proxy Auto Dial to manage dial-up support.

To reconfigure Remote Access Service for dial-up support

  1. From the server’s desktop, select Settings, then select Control Panel.
  2. Select the Services icon and double-click it. The Services Properties dialog box appears.
  3. Select Remote Access Autodial Manager from the listed services.
  4. Click Startup. The Service dialog box appears.
  5. Click Disabled from the Startup Type dialog box, then click OK.
  6. Select Remote Access Connection Manager from the listed services.
  7. Click Startup. The Service dialog box appears.
  8. Click Automatic from the Startup Type dialog box, then click OK.
  9. Click Close.

To Top Creating RAS Phone Book Entries

Once a RAS client has been configured, an initial dialing entry must be created by using the Dial-Up Networking program. This entry will be used to dial your ISP’s phone number. Before creating a dialing entry, first check with your ISP for any specific connection settings that you will need to use when creating your dialing entry.

Note When creating a RAS phone book entry for use with Microsoft Proxy Server, you must first log on by using an account with Administrator privileges.

To create a default RAS phone book entry for dial-up support

  1. From the server’s desktop, select Programs, select Accessories, then click Dial-Up Networking.
  2. If the phone book is empty, click OK to add a new entry.
  3. Enter a name for the new phone book entry, then click Next.
  4. Follow the on-screen instructions for creating a phone book entry. Click Finish when you have completed the entry.
  5. Select the new phone book entry to dial from the drop-down list box.
  6. Click More, then click Logon Preferences. The Logon Preferences dialog box appears
  7. From the Dialing tab, click the arrow next to Idle seconds before hanging up to change the default value from 0 to 1. This will ensure that RAS always disconnects after each dialing attempt.
  8. Click OK, then click Close.

To Top Other RAS-Related Issues

Using RAS Server and Microsoft Proxy Server
 Using PPTP and Microsoft Proxy Server

To Top Using RAS Server and Microsoft Proxy Server

Warning Enabling a RAS Server with Microsoft Proxy Server is not a recommended configuration. If you are considering using RAS dialup, or if you configured a RAS server during installation of RAS, read the following section carefully for more information on issues related to RAS server usage and Microsoft Proxy Server.

If you have installed RAS and configured an initial port for dial-out use after Microsoft Proxy Server was installed, check that port usage is set for Dial Out Only. If Dial Out and Receive Calls or Receive Calls Only is selected, the server is configured as a RAS server. In almost all cases, RAS should be reconfigured for RAS client use (to dial out only).

To change from a RAS server to a RAS client

  1. From the server’s desktop, select Settings, then select Control Panel.
  2. Select the Network icon and double-click it. The Network Properties dialog box appears.
  3. Click the Services tab, then select Remote Access Service from the list of network services.
  4. Click Properties. The Remote Access Setup dialog box appears.
  5. If necessary, select a port from the list. If only a single port has been set up for RAS use, this port will be selected by default.
  6. Click Configure. The Configure Port Usage dialog box appears.
  7. From the Port Usage options, select Dial Out Only, then click OK.
  8. From Remote Access Setup, click Continue.
  9. Click the Protocols tab, then select TCP/IP Protocol from the list of network protocols.
  10. Click Properties. The Microsoft TCP/IP Properties dialog box appears.
  11. Click on the Routing tab.
  12. Clear Enable IP Forwarding, then click Apply, and then click OK.
  13. Click Close from the Network Properties dialog box, then select Yes when prompted to restart the computer.

To use a RAS server with Microsoft Proxy Server

There is one exceptional case where a RAS server can be installed and used: if an additional separate port is configured to receive calls only. For example, if dial-up support is configured on the COM2 port of the server, a dial-in server could be allowed on the server’s COM1 port.

When configuring any additional ports for RAS server usage, limit dial-in clients by selecting This Computer Only and clear Entire Network access during Remote Access Service setup. (If access to the entire network is allowed, IP forwarding will be also be enabled. IP forwarding is not allowed with Microsoft Proxy Server.)

To Top Using PPTP and Microsoft Proxy Server

Point-to-Point Tunneling Protocol (PPTP) is a networking protocol that supports multiprotocol virtual private networks (VPNs), enabling secure network access over the Internet between remote computers.

Warning Using PPTP with Microsoft Proxy Server is not recommended. If PPTP is installed, read the following section carefully for information on issues related to PPTP usage with Microsoft Proxy Server.

If PPTP is installed on the same computer used for Microsoft Proxy Server, the following configuration changes must be made after installation:

  • Change PPTP-configured port usage settings in Remote Access Service setup from RAS server (to receive calls only) to a RAS client (to dial out only).

    By default, PPTP installs and enables RAS server. In most cases, RAS server will also be configured to allow IP forwarding on the server computer. For more information on changing from RAS server to RAS client settings, see     Using RAS Server and Microsoft Proxy Server .
  • Do not enable PPTP filtering.

    If PPTP filtering is selected, network adapters on the server computer are effectively disabled for all other network protocols. When filtering is applied, only PPTP packets will be sent and received.

To Top Using Microsoft Proxy Auto Dial

About Microsoft Proxy Auto Dial
Setting Credentials
Setting Dialing Hours

To Top About Microsoft Proxy Auto Dial

Microsoft Proxy Auto Dial is an additional tool that can be used to manage dial-up support for connecting Microsoft Proxy Server to your ISP. You can use the Auto Dial tool to configure the following options for any configured RAS phone book entry.

  • Credentials These can include additional logon information used when connecting, such as user name, password, and domain name credentials required for logging on to your ISP.
  • Dialing Hours Although service dialing is only performed on demand, dialing hours can be set to enable or disable dialing during selected hours of the day, or for selected days of the week.

To open Microsoft Proxy Auto Dial

  1. From the server’s desktop click Start, select Programs, and then select Microsoft Proxy Server.
  2. Select Dialup Tool.

To Top Setting Credentials

You can use the Credentials property sheet if your ISP requires additional user and password information to be entered when a dial-up connection is made. This information can be stored for use by Microsoft Proxy Auto Dial and used each time when dialing a specific phone book entry.

To set credentials to be used when dialing a RAS phone book entry

  1. Open Microsoft Proxy Auto Dial as described in the previous procedure.
  2. Make sure the Credentials property sheet is selected.
  3. Click the arrow to display the Entry Name list box. Select the name of the RAS phone book entry to be used when dialing with Microsoft Proxy Server.
  4. Under User Name, specify the user name to be used when logging on to a service provider’s dial-in server.
  5. Under Password, specify a user password (if one is required) to be used when logging on.
  6. Under Domain, specify a domain if the dial-in server requires one be provided when logging on. (This parameter is not usually required and can be left blank in most cases.)
  7. Click Apply, then OK. Credentials entered will be used each time Microsoft Proxy Server initiates a dial-up connection by using this RAS phone book entry.

To Top Setting Dialing Hours

You can use the Dialing Hours property sheet to specify selected hours or days during the week when service dialing is to be allowed. When dialing hours are selected, Microsoft Proxy Server will allow on-demand dialing to occur. When dialing hours are cleared, service dialing will not occur.

This feature can be used to prevent service dial-up connections from being made during certain selected hours during the day, or for selected days of the week. In some cases, limiting dialing to certain specified hours can be useful where Internet access is billed by connection time or where there are toll charges applied each time an ISP’s access number is dialed.

When dialing hours are set for a specific phone book entry, this information stored by Microsoft Proxy Auto Dial and used each time when dialing the entry.

To set dialing hours for use when dialing a RAS phone book entry

  1. Open Microsoft Proxy Auto Dial as described previously.
  2. Make sure the Credentials property sheet is selected.
  3. Click on the arrow to display the Entry Name list box. Select the name of the RAS phone book entry to be used when dialing with Microsoft Proxy Server.
  4. Click on the Dialing Hours property sheet.
  5. To disable service dialing during specified hours of the day or for specified days of the week, type the appropriate hours and days. By default, service dialing is set to be enabled for all hours and is not restricted.
  6. When dialing hours have been set or modified, click Apply, then OK. The dialing hours entered will be used each time Microsoft Proxy Server initiates a dial-up connection by using this RAS phone book entry.

Note Microsoft Proxy Auto Dial does not provide an option for automated dial-up connections. To automate dial-up connections, use RAS dial-out scripting options, which can be set within the designated RAS scripting file, Switch.inf. For more information on RAS scripting, see your documentation provided with Windows NT Server 4.0 or RAS online Help.

To Top Restarting Services After a Dial-Up Connection

When Microsoft Proxy Auto Dial is used to establish a dial-up connection to an ISP, the WWW, Web Proxy, and WinSock Proxy services must be restarted if:

  • Microsoft Proxy Auto Dial is being used for the first time. To initialize use with Microsoft Proxy Auto Dial, services must be restarted.

  • Settings made using Microsoft Proxy Auto Dial are later cleared. When settings are cleared, services must be restarted for new parameters to take effect.

Once Microsoft Proxy Auto Dial has been used at least once (click Apply and OK to store settings), further changes to Auto Dial settings will be used by Web Proxy and WinSock Proxy services for subsequent dial-out connections without requiring services to be stopped and started each time.

You can stop and restart all services (WWW, Web Proxy, and WinSock Proxy) by using Internet Service Manager.

Also, you can stop and start the WWW, Web Proxy, and WinSock Proxy services from the command prompt by issuing the following set of commands:

net stop w3svc
net stop wspsrv
net start w3svc
net start wspsrv

It is not necessary to issue a separate command to stop and start the Web Proxy service. Stopping and starting the WWW Service also stops and starts the Web Proxy service.

To Top Other Server Configuration Issues

Web Proxy Support for Anonymous FTP Clients
Ping and Tracert
Microsoft Exchange and Internet Mail Connector

To Top Web Proxy Support for Anonymous FTP Clients

Some FTP sites require an e-mail user name as the password to be entered for anonymous FTP client access. Where a password is required for anonymous access, the e-mail name to be sent by Web Proxy is:

proxyuser@domain

where domain is the current Internet DNS domain setting in use on for TCP/IP properties on Microsoft Proxy Server, such as mycompany.com.

To Top Ping and Tracert

Ping and Tracert are two standard utilities used to assist in troubleshooting TCP/IP-related problems on your network.

Ping is a utility that helps to verify IP-level connectivity. When troubleshooting, the Ping command is used to send an Internet Control Message Protocol (ICMP) echo request to a targeted DNS domain name or IP address. Tracert is a route-tracing utility. Tracert uses the IP TTL field and ICMP error messages to determine the route followed from one host to another through a network.

Because the Ping and Tracert utilities operate at the transport layer by using ICMP (which does not use Windows Sockets), these utilities can not be redirected by Microsoft Proxy Server. Results obtained through proxy connections using the Ping and Tracert utilities to test connections between remote and local hosts will be invalid.

To Top Microsoft Exchange and Internet Mail Connector

The Internet Mail Connector is used to provide message exchange between Microsoft Exchange Server and systems that use Simple Mail Transfer Protocol (SMTP) for Internet e-mail.

Microsoft Proxy Server cannot support proxy forwarding of SMTP-based requests when Exchange Server is installed on another server computer on the internal network. This prevents another computer running Exchange on your private network from using Internet Mail Connector to service Internet e-mail messaging.

However, Exchange Server can be installed together with Microsoft Proxy Server on the same server and communicate normally to both internal and external SMTP clients.


CHAPTER 6, Configuring the Web Proxy Service

Configuring the Web Proxy Service

Overview of Web Proxy Service Configuration
 Setting Up Web Proxy Users
 Controlling Web Proxy User Access to Internet Sites
 Setting Up Caching of Internet Objects
 Logging Web Proxy Service Activity

To Top Overview of Web Proxy Service Configuration

After you have installed Microsoft Proxy Server, you will usually perform the following steps to configure the Web Proxy service:

  • Set up permissions to determine which Windows NT groups or users are granted the ability to use each of the Internet protocols supported by the Web Proxy service.
  • Set up filtering to determine the specific Internet sites that all users of the Web Proxy service are allowed to access.
  • Set up caching to determine the way that the Web Proxy service caches Internet objects returned by client requests.
  • Set up logging to determine how Web Proxy service activity is saved in the Web Proxy service log.

These steps are described in this chapter.

To Top Setting Up Proxy Users

Selecting the Client Authentication Method
 Granting Permissions to Proxy Users

To Top Selecting the Client Authentication Method

There are three types of client authentication methods that can be used by the Web Proxy service:

  • Anonymous
  • Basic
  • Windows NT Challenge/Response

For a discussion of each of these authentication methods, see “Security.”

The client authentication method used by the Web Proxy service is actually set in the WWW service of Microsoft Internet Information Server (IIS).

To set the WWW service authentication method and the Web Proxy authentication method

  1. In Internet Service Manager, double-click the server name next to the WWW service.

    The WWW Service Properties dialog box appears. Make sure that the Service tab is selected.

  2. Under Password Authentication, select one or more authentication methods.

    • Allow Anonymous
    • Basic (clear text)

    • Windows NT Challenge/Response

  3. Click OK.

This procedure sets the authentication method for one server. If your network has more than one server running the Web Proxy service, repeat the procedure for each server.

For more information about the client authentication methods, see “Security.” Also see your documentation for Microsoft Internet Information Server.

To Top Granting Permissions to Proxy Users

When Microsoft Proxy Server is first installed, by default there are no Proxy permissions granted.

  • If you have enabled Anonymous authentication in the WWW service, all users (on the private network) will have access and you do not need to grant Proxy permissions.

  • If you have disabled Anonymous authentication in the WWW service and have enabled Basic or Windows NT Challenge/Response authentication, you must grant Proxy permissions before users can access the Internet using the Web Proxy service.

Note Users will not be able to gain access to the Msp\Clients share folder before Proxy permissions are granted.

Proxy Permissions determine which users or groups of users can access the Internet by using a particular protocol through the Web Proxy service on a server. Permissions are granted separately for each protocol. The available Web Proxy service protocols are:

  • FTP Read File Transfer Protocol. Use this protocol to download files through your browser.

  • Gopher Access through your browser to links and files on Gopher servers.

  • WWW HTTP and HTTPS (secure HTTP) protocols for the World Wide Web. Use WWW for browser access to the Web.

  • Secure Allows various Secure Socket Layer (SSL) connections. By default this includes SNEWS, but other protocols can be configured using the Windows NT registry.

Before assigning Proxy permissions, it is a good idea to use User Manager for Domains to create user groups containing the user accounts of users who need access to a particular protocol or sets of protocols. Then you can apply permissions to groups, rather than to individual users. For more information about user groups and about User Manager for Domains, see “Server Administration.” Also see your documentation for Windows NT.

To grant permission to use Proxy protocols

  1. From Internet Service Manager, double-click the server name next to the Web Proxy service.

  2. From the Web Proxy Service Properties window, click the Permissions tab.

  3. Select the Enable Access Control check box.

    When the Enable Access Control check box is selected, Web Proxy service security is enabled. When this check box is cleared, the Web Proxy service will not attempt to validate connections from clients.

    Note The authentication options used by the Web Proxy service (anonymous, basic, and Windows NT challenge/response) are set in the WWW service of Internet Information Server.

  4. Review the current permissions. Select a protocol from the Protocol box and review the users and groups granted the right to use that protocol to access the Internet through the Web Proxy service on this server.

    When you select a protocol from the Protocol list, the Grant Access To box displays the users and groups that are already granted permissions for that protocol.

  5. To grant a user or group the right to use a protocol to access the Internet through the Web Proxy service on this server, select the protocol from the list in the Protocol box, choose Add, and complete the Add Users and Groups dialog box that appears.

  6. To remove a user or group from the list of those granted the right use a protocol to access the Internet through the Web Proxy service on the server, select the protocol from the Protocol box, select the user or group from the box below, and choose Remove.

  7. When permissions are set appropriately for the selected protocol, select another protocol from the list, and grant or remove permissions as necessary.

  8. When all protocols have their permissions set appropriately, click OK.

This procedure sets permissions for one server. If your network has more than one server running the Web Proxy service, repeat the procedure for each server.

To Top Controlling Web Proxy User Access to Internet Sites

You can allow or prevent client access to specific Internet sites. This is called filtering, and it is accomplished on per-server basis. It applies to all users who access the Internet using either service (Web Proxy or WinSock Proxy) on that server.

You can allow or prevent access to a single computer, a group of computers, or an Internet domain. You can control access by IP address, subnet mask, and domain name.

To control user access to Internet sites

  1. In Internet Service Manager, open the Web Proxy Service Properties window for the server to be administered, and click the Filters tab.

  2. Select the Enable Filtering option.

  3. Select the filtering mode. You set an overall policy first, then specify exceptions to that policy.

    • To deny users access to specific Internet sites, first select Granted.

      To deny users access to specific Internet sites, add those sites to the Except to those listed below list. Users will be allowed access to all other Internet sites.

    • To allow access to specific Internet sites, first select Denied.

      To allow users access to specific Internet sites, add those sites to the Except to those listed below list. Users will be denied access to all other Internet sites.

  4. To create a new filter, click Add and complete the dialog box that appears.

    • Select Single Computer to filter a single computer. If you select this option, you must also enter that computer’s IP address in the IP Address box.

    • Select Group of Computers to filter a group of computers. If you select this option you must enter an IP address in the IP Address box, and a subnet mask in the Subnet Mask box.

    • Select Domain to filter a domain. If you select this option, enter a domain name in the Domain box.

    • When you have completed dialog box, click OK. The Filters property sheet returns, with the new filter added to the Except to those listed below list.

  5. Repeat step 4 until all needed filters are defined for this server.

  6. To alter a listed filter, select it from the list, click Edit, and modify the settings in the dialog box that appears.

  7. To remove a filter from the list, select the item and click Remove.

  8. Click OK.

Note Only the selected mode, Granted or Denied, is in effect. When you switch between modes, filters created for the deselected mode are retained, but are not in effect.

This procedure sets up filtering for one server. If your network has more than one server running Microsoft Proxy Server, repeat the procedure for each server.

To Top Setting Up Caching of Internet Objects

Basic Cache Configuration
Setting the Advanced Options for the Cache
Changing the Drives and Space Allocated to the Cache
Turning Off the Cache
Cache-Only Implementation

To Top Basic Cache Configuration

To configure the cache

  1. From Internet Service Manager, open the Web Proxy Service Properties window for the server to be administered, and click the Caching tab.

  2. Make sure the Enable Caching check box is selected.

  3. Use the Cache Expiration Policy to set the freshness of objects in the cache. Move the slider toward Always Request Updates to maintain the freshest cache data and increase the amount of Internet traffic that the server generates. Move the slider toward Fewest Internet Requests to allow objects in the cache to be used for the maximum Time-To-Live (TTL), which reduces Internet traffic.

    Freshness is a measure of how long a local copy of an object in the cache is used in place of the remote object from the original Web site. TTL is the time in seconds that an object remains in the cache before reaches its expiration. At that time the object will no longer be used in place of the original object on an Internet site (in the case of passive caching) or be updated by Microsoft Proxy Server (in the case of active caching). To generate the least number of Internet requests, move the slider all the way to the right (to Fewest Internet Requests).

  4. Set the Enable Active Caching option.

    Active caching uses the cache to proactively ensure the freshness and availability of certain HTTP data. The cache manager creates its own request for an object, without client prompting, when the TTL has expired or is near expiration. Web objects are subject to active caching on the basis of their popularity relative to their rate of change. Additionally, the active caching algorithm incorporates calculations of current server load in order to process requests to the Internet at times of low usage.

    If this option is selected, active caching is enabled. If cleared, active caching is disabled and only passive caching is performed.

  5. If you enable active caching, use the Active Caching Policy slider to specify how frequently objects in the cache are updated. Set the slider toward Most client cache hits to update the cache frequently. Set the slider toward Fewest Internet Requests to minimize the number of times Microsoft Proxy Server makes requests to Internet sites to update objects in the cache.

  6. Review the cache space allocation shown in Total Cache. To change the drives and the amount of disk space allocated to the cache, click the Change Cache Size button and complete the Microsoft Proxy Server Cache Drives dialog box. For more information, see Changing the Drives and Space Allocated to the Cache, later in this chapter.

  7. To specify a maximum size allowed for cached objects, filter cache objects, or return expired objects from the cache when the requested Internet site is unavailable and the cache does not contain an unexpired copy of the requested object, click the Advanced button and complete the Advanced Cache Policy dialog box. For more information see Setting the Advanced Options for the Cache, later in this chapter.

  8. When the cache is configured appropriately for this server, click OK.

This procedure sets up caching for one server. If your network has more than one server running the Web Proxy service, repeat the procedure for each server.

Note The cache cannot be administered during service startup. Each time the Web Proxy service starts, the cache performs an integrity check and other tests. The duration of these startup checks depends on the size of the cache, the number of objects in the cache, and other variables.

In some situations it is possible to start Internet Service Manager, open the Web Proxy Service Properties window, and select the Caching tab before the cache has finished its startup checks. When this occurs an error message will be displayed and you will be unable to administer cache parameters. You can select other Web Proxy service property sheets (such as those for the Service, Permissions, Logging, and Filters) and administer their parameters. However, to administer the cache parameters you will need to close the Web Proxy Service Properties window, return to the main Microsoft Internet Service Manager window, wait until the cache has completed its startup checks, reopen the Web Proxy Service Properties window, and click the Caching tab.

To Top Setting the Advanced Options for the Cache

You can use the advanced options to specify a maximum size allowed for cached objects, filter cache objects, or return expired objects from the cache when the requested Internet site is unavailable and the cache does not contain an unexpired copy of the requested object.

To set the advanced cache options

  1. In Internet Service Manager, open the Web Proxy Service Properties window for the server to be administered, and click the Caching tab. The Microsoft Proxy Server Cache Drives property sheet appears.

  2. Click the Advanced button. The Advanced Cache Policy dialog box appears.

  3. To limit the size of cached objects, select the Limit Size of Cached Objects to check box and type a value (in kilobytes) in the adjacent KB box. Objects larger than the specified size will not be cached.

    Note that 0 is not a valid value. If you enter 0 (or if you do not enter a value), when you click OK to exit this dialog box the Limit Size of Cached Objects to check box will be cleared.

    By default, this box is cleared and there is no limit to the size of a cached object.

  4. To specify that cached objects will be sent to the client when the object is in the cache and the Internet server is unavailable, select the Return expired objects when site is unavailable check box. Objects in the cache will be used even if they are expired. By default, this option is selected.

    If you clear this option, when the Internet server is unavailable and the object in the cache is expired, the expired cached object will not be returned to the client.

  5. Review and if necessary modify the Cache Filters list, which contains the currently configured cache filters. The URL column displays the URL that will be filtered, and the Status column shows whether that URL will always be cached or will never be cached.

    • To add an item to the Cache Filters list, click Add and complete the Cache Filters Properties dialog box.
    • To alter a listed item, select it from the Cache Filters list, click Edit, and modify the settings in the Cache Filters Properties dialog box.

    • To remove a filter, select it from the Cache Filters list and click Remove.

    For information about completing the Cache Filters Properties dialog box, see the procedure that follows.

  6. When the advanced options are set appropriately, click OK in the Advanced Cache Policy dialog box, and when the Caching property sheet reappears, click OK again.

Usually, Microsoft Proxy Server determines which Internet objects will be cached. Optionally, you can create cache filters, which specify URLs that will always be cached or will never be cached.

When a URL is configured to never be cached, its objects will not be stored in the cache. When a URL is configured to always be cached, objects from that URL will be selected for caching (subject to other caching rules). This can be useful if, for example, you want to specify a wildcard filter to deny caching of all Internet objects from a specific site, and then create another filter to re-enable caching of objects from a particular sub-tree of that site.

To administer cache filters

  1. Open the Cache Filter Properties dialog box, as described in the previous procedure.

  2. In the URL box, type the URL that will be filtered.

    For information about URL filter syntax, see the discussion following this procedure.

  3. Select Always cache or Never cache.

    • Select Always cache to always cache Internet objects returned from the URL listed in the URL box. Use this option when you have already specified a wildcard filter to deny caching of all Internet objects from a site, and want to re-enable caching of objects from a particular sub-tree of the site.

    • Select Never cache to prevent caching of Internet objects returned from the URL entered in the URL box. This is the default selection.

  4. When the filter is configured appropriately, click OK. The Advanced Cache Policy dialog box returns.

When creating a filter, type the URL using one of the following formats. Note the use of the asterisk (*) wildcard character.

  • Use the format www.domainname.com/path to specify a specific location at that domain.

    For example, www.microsoft.com/intdev specifies only the intdev page.

  • Use the format www.domainname.com/path* to specify all objects under that path at that site.

    For example, www.microsoft.com/intdev* specifies the intdev page and all pages below.

  • Use the format *.domainname.com/path to specify all sites with similar domain names.

    For example, *.mydomain.com/beta specifies www.mydomain.com/beta, ftp.mydomain.com/beta, gopher.mydomain.com/beta, and so on.

  • Use the format *.domainname.com/path* to include all sites with similar domain names and all objects under that path.

    For example, *.mydomain.com/* specifies all pages in mydomain.com.

You must include at least one forward slash (/) in the URL.

To Top Changing the Drives and Space Allocated to the Cache

The cache should always be located on one or more hard drives installed on the computer running Microsoft Proxy Server. (You cannot use network drives to store cached data.) You should choose a hard disk of sufficient size to make the cache as large as possible. Using multiple drives is a good idea, because breaking a very large cache into several smaller caches can sometimes provide faster access to objects. To help prevent a disk from filling up, it is a good idea to store the logs and the cache on different volumes.

When configuring the cache drives you must, at a minimum, allocate at least one drive and 5 MB for caching. However, the recommended minimum allocation is higher. It is suggested you allocate at least 100 MB plus 0.5 MB for each Web Proxy service client (and round up to the nearest full megabyte). For example, if a server will be servicing 79 Web Proxy service clients, it is recommended you allocate 140 MB or more to the cache. For each server the optimal cache allocation will vary depending on load and configuration, but in general, increasing the disk space allocation benefits the cache.

Allocate space from a drive to the cache in increments of 5 MB. If you assign a number to the cache that cannot be evenly divided by 5, the allocation is rounded down to the next lowest 5-MB increment. For example, if you assign 194 MB to the C: drive, 190 MB is actually allocated from that drive to the cache.

Note It is strongly recommended that you use only NTFS volumes for caching. Also, do not assign a read-only drive (for example, a CD-ROM drive) to the cache.

To change the drives and the amount of disk space allocated to the cache

  1. From Internet Service Manager, open the Web Proxy Service Properties window for the server to be administered, and click the Caching tab. The Microsoft Proxy Server Cache Drives dialog box appears.

  2. Review the existing drive and cache size configurations.

    • The list under Drive displays all the local drives installed on the server, identified by drive letter and file system type.

    • If a drive is configured to cache, the amount of allocated space is shown in the Maximum Size (MB) column. If a drive is not configured to cache, this column is empty.

    • The total disk space, in megabytes, allocated to the cache is shown at the bottom of the dialog box, in Total Cache Size for All Drives (MB). This value is the sum of all entries in the Maximum Size (MB) column.

  3. To store cached data on a drive, select the drive from the list, type a number in the Maximum Size (MB) box, and click Set.

    The number you type will become the maximum amount of space, in megabytes, that the cache can use on that drive. The number you type must be less than the value shown next to Space Available (MB).

  4. To stop storing cached data on a drive, select the drive from the list, type 0 in the Maximum Size (MB) box, and click Set.

    All cached data on that drive will be lost.

  5. To change the amount of space allocated from a drive to the cache, select the drive from the list, type a new value in the Maximum Size (MB) box, and click Set.

    • If you modify an existing cache drive and reduce the Maximum Size (MB) value, some cached data on that drive might be lost.

    • If you increase the Cache Size (MB) value, the new setting takes effect immediately. There is no effect on the data already cached on that drive.

  6. When the drives and space allocations are set appropriately, click OK in the Microsoft Proxy Server Cache Drives dialog box, and when the Caching property sheet reappears, click OK again.

To Top Turning Off the Cache

To stop caching

  1. From Internet Service Manager, open the Web Proxy Service Properties window for the server to be administered, and click the Caching tab.
  2. Clear the Enable Caching check box.
  3. Click OK.

To Top Cache-Only Implementation

Some users may be more interested in using Microsoft Proxy Server for its powerful caching features than for its security functions. Typical examples include Internet Service Providers (ISPs) and customers who already have other firewalls in place to screen HTTP traffic.

In these situations, Microsoft Proxy Server can be configured to use any or all of its network adapter cards both for requests from clients and for requests to the Internet. In this scenario, client computers would connect to Microsoft Proxy Server, Microsoft Proxy Server would connect to a router or firewall, and through it to the Internet.

To configure this scenario, the Local Address Table (LAT) for Microsoft Proxy Server must include all IP addresses and subnets that will be allowed to use the Web Proxy service cache. If inbound client requests are permitted, then the LAT should have the address range from 0.0.0.0 to 255.255.255.255.

To Top Logging Web Proxy Service Activity

Microsoft Proxy Server can log information about all Internet requests made by Web Proxy service clients. It can log to a text file or to a table in an ODBC-compliant database (such as Microsoft Access or Microsoft SQL Server).

By default, Web Proxy service information is logged to a text file. After installing Microsoft Proxy Server, you can set the configuration parameters for text file logging, or you can set up logging to an ODBC-compliant database.

To log Web Proxy service information to a text file and set the logging parameters

  1. From Internet Service Manager, open the Web Proxy Service Properties window for the server to be administered, and click the Logging tab.

  2. Make sure the Enable Logging option is selected.

  3. Select either Regular Logging or Verbose Logging.

    Regular Logging records only a subset of all available information for each Internet access. This option reduces the disk space needed for a log file. Verbose Logging records all available information for each Internet access.

  4. Make sure the Log to File option is selected.

  5. Select or clear the Automatically open new log option.

    Select this option to periodically create a new Web Proxy service log file, using the interval specified by the Daily, Weekly, Monthly, or When File Size Reaches options. When a new log file is started, the old log file is closed (and can be archived on other storage media).

    Clear this option to use the same Proxy log file continuously.

  6. If you select the Automatically open new log option, specify the interval used to open a new log file. Select Daily, Weekly, Monthly, or When File Size Reaches. If you select When File Size Reaches, also enter a value in the MB box.

  7. Review and if appropriate change the log file directory.

    To change this location, type a new path in the Log File Directory box, or click Browse and complete the dialog box that appears. It is possible to log to a local or remote drive, but in general it is recommended that you store your Proxy log file on a local disk.

    Note To help prevent the disk from filling up, it is a good idea to store the logs and the cache on different volumes.

  8. Click OK.

    The log settings are saved.

For more information about logging to a text file, including detailed information about the data that is logged and the difference between regular and verbose logging, see “Monitoring.”

The following procedure shows you the basic steps you will perform to log Web Proxy service information to an ODBC-compliant database. For detailed instructions about how to accomplish each of these steps, see “Monitoring.”

To log Web Proxy service information to an ODBC-compliant database

  1. Install the database.

    The database can be installed on the local computer or a remote computer.

  2. Create a table in the database, creating the fields necessary to support Web Proxy service log data.

    The required fields are described in detail in “Monitoring.”

  3. Install the ODBC driver for the database you are using.

  4. Create a System Data Source Name (system DSN) for the database that will receive the logging.

  5. In Internet Service Manager, open the Logging tab of the Web Proxy Service Properties window. Make sure the Enable Logging option is selected, select the Log to SQL/ODBC Database option, and configure the logging options.

    Detailed instructions are provided in “Monitoring.”

Tip Turn off Internet Information Server (IIS) logging when Web Proxy service logging is enabled. The IIS log is a subset of the information stored in the Web Proxy service log. Since the information is duplicated, you can improve performance by turning off IIS logging. To turn off IIS logging, use Internet Service Manager to open the Logging property sheet for the WWW service. Clear the Enable Logging check box.


CHAPTER 7, Configuring the WinSock Proxy Service

Configuring the WinSock Proxy Service

Overview of WinSock Proxy Service Configuration
 Configuring WinSock Proxy Protocols and Ports
 Setting Up WinSock Proxy Users
 Controlling WinSock Proxy User Access to Internet Sites
 Logging WinSock Proxy Service Activity
Setting WinSock Proxy Access Control

To Top Overview of WinSock Proxy Service Configuration

After you have installed Microsoft Proxy Server, you will usually perform the following steps to configure the WinSock Proxy service:

  • Set up protocols and ports, to determine which Windows Sockets applications are allowed to access the Internet by using the WinSock Proxy service.

  • Set up permissions, to determine which Windows NT groups or users are granted the ability to use each of the Internet protocols supported by the WinSock Proxy service.

  • Set up filtering, to determine the specific Internet sites that all users of the WinSock Proxy service are allowed to access.

  • Set up logging, to determine how WinSock Proxy service activity information is saved in the WinSock Proxy service log.

These steps are described in this chapter.

Note If the WinSock Proxy service is stopped, you can use Internet Service Manager to change its configuration settings but the changes will not take effect until you restart the service.

To Top Configuring WinSock Proxy Protocols and Ports

Setting Up Protocol Configurations
 About the Predefined Protocol Configurations

To Top Setting Up Protocol Configurations

Protocol configurations determine which Windows Sockets applications can be used to access the Internet through the WinSock Proxy service on a server, and for each protocol configuration, which ports can be used for outbound and inbound connections. You create, modify, and delete protocol configurations by using the Protocols property sheet in the WinSock Proxy Service Properties window.

When Microsoft Proxy Server is installed, some default protocol configurations are created by the Setup program. These are described in Default Protocol Configurations, later in this chapter.

To set up protocol configurations

  1. From Internet Service Manager, open the WinSock Proxy Service Properties window for the server to be administered, and click the Protocols tab.

  2. To create a protocol configuration and add it to the list of protocols that can be used to access the Internet through the WinSock Proxy service on the server, click Add and complete the Protocol Definition dialog box.

    See the next procedure for instructions on how to complete the Protocol Definition dialog box.

    When the Protocol Definition dialog is completed and you click OK, the WinSock Proxy Protocols property sheet returns and the protocol is added to the Protocol Definitions list.

  3. To modify the settings for a configured protocol, select a protocol from the Protocol Definitions list, click Edit, and modify the settings in the Protocol Definition dialog box.

  4. To delete a protocol configuration, select it from the Protocol Definitions list and click Remove.

  5. Repeat steps 2-4 until all protocol configurations are defined appropriately for the WinSock Proxy service on this server.

  6. Click OK to save the settings.

The preceding procedure sets protocol configurations for one server. If your network has more than one server running the WinSock Proxy service, repeat the procedure for each server.

To define a protocol in the Protocol Definition dialog box

  1. From the WinSock Proxy Protocols property sheet, open the Protocol Definition dialog box as described in the preceding procedure.

  2. In the Protocol Name box, type a name for this protocol configuration.

    This name will appear in lists of protocol configurations, in the WinSock Proxy Protocols and Permissions property sheets when this server is administered.

  3. In the Port box, type the number of the port on the server that will be used for the initial connection.

    For a discussion of ports, see “Server Administration.”

  4. Under Type, specify the protocol type used for initial connections. Select TCP (for Transmission Control Protocol) or UDP (for User Datagram Protocol).

  5. Under Direction, specify whether the initial connection port will be configured for Outbound or Inbound.

    • If you selected TCP as the Type, select Outbound to allow clients to initiate connections to external sites through this port. Select Inbound to allow external sites to initiate connections to clients through the port.

    • If you selected UDP as the Type, select Outbound to allow the port to pass packets sent from a client to an external site. Select Inbound to allow the port to pass packets sent from an external site to a client.

  6. Use the Port Ranges for Subsequent Connections options to define how to handle connections or packets that originate as a result of requests or packets sent on the initial connection’s port number. The list under Port Ranges for Subsequent Connections displays the port, packet type, and direction for each subsequent connection configuration (if any exist). There can be one or more configurations for subsequent connections in this list.

    Note A port range setting of 0 for inbound connections indicates Port_Any, which allows the server to select the port from the range 1024-5000.

    • To specify a port or port range that will be used for subsequent connections, click Add, and complete the Port Range Definition dialog box. See the next procedure for instructions on how to complete the Port Range Definition dialog box.

    • To modify the settings for a port range for a subsequent connection, select the port range from the Port Ranges for Subsequent Connections list, click Edit, and complete the Port Range Definition dialog box.

    • To remove a port or port range from the list of those that will be used for subsequent connections, select the port range from the Port Ranges for Subsequent Connections list and click Remove.

  7. Click OK. The WinSock Proxy Protocols property sheet returns. The new or modified protocol configuration appears in the Protocol Definitions list.

Subsequent connections are those that originate as a result of requests or packets sent on the initial connection’s port number. The subsequent connection parameters include the port number or range, the protocol type, and the direction.

To define parameters for subsequent connections

  1. From the Protocol Definition dialog box open the Port Range Definition dialog box, as described in the preceding procedure.

  2. In the Port or Range boxes, type a single port or a range of port numbers to use to receive connections or packets that originate as a result of requests or packets sent on the initial connection’s port number. Note that you can type 0 to indicate Any, which allows connections to ports 1024-5000.

    For a discussion of ports, see “Server Administration.”

  3. Under Type, specify the protocol type that will be used for subsequent connections. Select TCP (for Transmission Control Protocol) or UDP (for User Datagram Protocol).

  4. Under Direction, specify whether the subsequent connection ports will be configured for Inbound or Outbound.

    • If you selected TCP as the Type, select Inbound to allow external sites to initiate connections to clients through the ports. Select Outbound to allow clients to initiate connections to external sites through the port.

    • If you selected UDP as the Type, select Outbound to allow the ports to pass packets sent from a client to an external site. Select Inbound to allow the ports to pass packets sent from an external site to a client.

  5. Click OK. The Protocol Definition dialog box returns. The new or modified subsequent connection configuration appears in the Port Ranges for Subsequent Connections list.

When a new protocol configuration is created it does not have any permissions granted. To allow users to use the protocol to access the Internet, permissions must be granted as described in Setting Up WinSock Proxy Users, later in this chapter.

To Top About the Predefined Protocol Configurations

Microsoft Proxy Server Setup installs a default set of predefined WinSock Proxy protocol configurations on the server. These appear in the Protocols lists in the WinSock Proxy Protocols and Permissions properties sheets. You are not limited to these predefined protocol configurations, nor are you restricted to Windows Sockets applications that work with these predefined protocol configurations. Use the WinSock Proxy Protocols property sheet to add additional protocol configurations that support additional Windows Sockets applications.

To review the default parameters set for a predefined protocol configuration

  1. Select a protocol from the list in the WinSock Proxy Protocols property sheet.
  2. Click Edit.

To Top Setting Up WinSock Proxy Users

WinSock Proxy permissions determine which users or groups of users can access the Internet by using a particular protocol configuration through the WinSock Proxy service on a server. Permissions are granted separately for each protocol configuration.

When Microsoft Proxy Server is installed, by default there are no WinSock Proxy permissions granted. You must grant permissions before users can access the Internet by using the WinSock Proxy service.

Before assigning WinSock Proxy permissions it is a good idea to use User Manager for Domains to create user groups containing the user accounts of users who need access to a particular protocol or sets of protocols. Then you can apply permissions to groups, rather than to individual users. For more information about user groups and about User Manager for Domains, see “Server Administration.” Also see your documentation for Windows NT.

To set permissions to use protocols

  1. From Internet Service Manager, open the WinSock Proxy Service Properties window for the server to be administered, and click the Permissions tab.

  2. To grant a user or group the right to use a protocol to access the Internet through the WinSock Proxy service on this server, select the protocol from the list in the Protocol box, choose Add, and complete the Add Users and Groups dialog box that appears.

    • A special selection in the Protocol list, Unlimited Access, allows access to all protocols and all ports of this server. This includes ports not defined in any protocol configuration. Also, users granted Unlimited Access are not affected by WinSock Proxy domain filtering. Grant permission to Unlimited Access only to users who should have such access.

    • When you select a protocol from the list, the Grant Access To box lists the users and groups that are already granted permissions for that protocol.

  3. To remove a user or group from the list of those granted the right to use a protocol to access the Internet through the WinSock Proxy service on the server, select the protocol from the Protocol box, select the user or group from the Grant Access To list, and choose Remove.

  4. When permissions are set appropriately for the selected protocol, select another protocol from the list, and grant or remove permissions as necessary.

  5. When all protocols have their permissions set appropriately, click OK.

This procedure sets permissions for one server. If your network has more than one server running the WinSock Proxy service, repeat the procedure for each server.

For convenience, you can copy user permissions from one protocol to one or more other protocols. You can also remove user permissions from several protocols at once.

To modify several protocols at once

  1. From Internet Service Manager, open the WinSock Proxy Service Properties window for the server to be administered, and click the Permissions tab.

  2. Select a protocol from the Protocol list, then select one more users and groups from Grant Access To list.

  3. Choose either Copy To or Remove From.

    • To grant those users and groups permissions to use several protocols, click Copy To and complete the Protocol Selection dialog box that appears.

    • To remove permissions for those users and groups to use several protocols, click Remove From, and complete the Protocol Selection dialog box that appears.

  4. When permissions are set appropriately for the users of the selected protocol, repeat steps 2 and 3 as necessary.

  5. When all protocols and users have their permissions set appropriately, click OK.

The protocol configurations that appear in the Protocol list in the Permissions property sheet are added, removed, and modified by using the Protocols property sheet, as described in Configuring WinSock Proxy Protocols and Ports, earlier in this chapter.

To Top Controlling WinSock Proxy User Access to Internet Sites

You can allow or prevent client access to specific Internet sites. This is called filtering, and is accomplished on per-server basis. It applies to all users who access the Internet by using either service (Web Proxy or WinSock Proxy) on that server.

You can allow or prevent access to a single computer, a group of computers, or an Internet domain. You can control access by IP address, subnet mask, and domain name.

Note that for the WinSock Proxy service, filtering by domain name does not affect Internet requests where the client application accesses a site by using an IP address. To effectively filter a site you may find it useful to create filters both on the domain name and the IP address.

To control user access to Internet sites

  1. From Internet Service Manager, open the WinSock Proxy Service Properties window for the server to be administered, and click the Filters tab.

  2. Select the Enable Filtering option.

  3. Select the filtering mode. Set an overall policy first, then specify exceptions to that policy.

    • To deny access to specific Internet sites, select Granted.

      Users will be denied access to those Internet sites that appear in the Except to those listed below list, and will be allowed access to all other Internet sites.

    • Select Denied to allow access to specific Internet sites.

      Users will be allowed access to specific Internet sites that appear in the Except to those listed below list, and will be denied access to all other Internet sites.

  4. To create a filter, click Add and complete the dialog box that appears.

    • Select Single Computer to filter a single computer. If you select this option, you must also enter that computer’s IP address in the IP Address box.

    • Select Group of Computers to filter a group of computers. If you select this option you must enter an IP address in the IP Address box, and a subnet mask in the Subnet Mask box.

    • Select Domain to filter a domain. If you select this option, enter a domain name in the Domain box.

    • When you have completed the dialog box, click OK. The Filters tab returns, with the new filter added to the Except to those listed below list.

  5. Repeat step 4 until all needed filters are defined for this server.

  6. To alter a listed filter, select it from the list, click Edit, and modify the settings in the dialog box that appears.

  7. To remove a filter from the list, select the item and click Remove.

  8. Click OK.

Note Only the selected mode, Granted or Denied, is in effect. If you switch between modes, filters created for the deselected mode are retained, but are not in effect.

This procedure sets up filtering for one server. If your network has more than one server running Microsoft Proxy Server, repeat the procedure for each server.

To Top Logging WinSock Proxy Service Activity

Microsoft Proxy Server can log information about all Internet requests made by WinSock Proxy service clients. It can log to a text file or to a table in an ODBC-compliant database (such as Microsoft Access or Microsoft SQL Server).

By default, WinSock Proxy service information is logged to a text file. After installing Microsoft Proxy Server, you can set the configuration parameters for text file logging, or you can set up logging to an ODBC-compliant database.

To log WinSock Proxy service information to a text file and set the logging parameters

  1. From Internet Service Manager, open the WinSock Proxy Service Properties window for the server to be administered, and click the Logging tab.

  2. Make sure the Enable Logging option is selected.

  3. Select either Regular Logging or Verbose Logging.

    Regular Logging records only a subset of all available information for each Internet access. This option reduces the disk space needed for a log file. Verbose Logging records all available information for each Internet access.

  4. Make sure the Log to File option is selected.

  5. Select or clear the Automatically open new log option.

    Select this option to periodically create a new WinSock Proxy service log file, using the interval specified by the Daily, Weekly, Monthly, or When File Size Reaches options. When a new log file is started, the old log file is closed (and can optionally be archived on other storage media).

    Clear this option to use the same WinSock Proxy log file continuously.

  6. If you select the Automatically open new log option, specify the interval used to open a new log file. Select Daily, Weekly, Monthly, or When File Size Reaches. If you select When File Size Reaches, also enter a value in the MB box.

  7. Review and if appropriate change the log file directory.

    To change this location, type a new path in the Log File Directory box, or click Browse and complete the dialog box that appears. It is possible to log to a local or remote drive, but in general it is recommended that you store your WinSock Proxy log file on a local disk.

    Note To help prevent the disk filling up, it is a good idea to store the logs and the Web Proxy service cache on different volumes.

  8. Click OK.

    The log settings are saved.

For more information about logging to a text file, including detailed information about the data that is logged and the difference between regular and verbose logging, see “Monitoring.”

The following procedure shows you the basic steps you will perform to log WinSock Proxy service information to an ODBC-compliant database. For detailed instructions about how to accomplish each of these steps, see “Monitoring.”

To log WinSock Proxy service information to an ODBC-compliant database

  1. Install the database. The database can be installed on the local computer or a remote computer.

  2. Create a table in the database, creating the fields necessary to support WinSock Proxy service log data. The required fields are described in detail in “Monitoring.”

  3. Install the ODBC driver for the database you are using.

  4. Create a System Data Source Name (system DSN) for the database that will receive the log data.

  5. In Internet Service Manager, click the Logging tab of the WinSock Proxy Service Properties window. Make sure the Enable Logging option is selected, select the Log to SQL/ODBC Database option, and configure the logging options.

    Detailed instructions are provided in “Monitoring.”

To Top Setting WinSock Proxy Access Control

When Microsoft Proxy Server is installed the Setup program presents an option to enable or disable access control for the WinSock Proxy service. If access control is enabled, only users who are granted WinSock Proxy permissions can use WinSock Proxy protocols to access the Internet through the WinSock Proxy service. If access control is disabled, any client can access the Internet through the WinSock Proxy service; this is the WinSock Proxy equivalent of Anonymous access.

To change the WinSock Proxy access control setting

  1. From Internet Service Manager, open the WinSock Proxy Service Properties window for the server to be administered, and click the Permissions tab.

  2. To enable access control, select the Enable Access Control check box. To disable access control, clear the check box.


CHAPTER 8, Setting Up Clients

Setting Up Clients

Configuring the Client Setup Program
Installing Clients
Removing Clients
 Reviewing the Client Setup Log
Web Proxy Clients
WinSock Proxy Clients
Using the WSP Client Application
Creating a Local LAT File
Editing the Mspclnt.ini File
Configuring Windows Sockets Applications

To Top Configuring the Client Setup Program

During Microsoft Proxy Server setup, you are asked to complete a Client Configuration dialog box. The options in this dialog box are used to create an Mspclnt.ini file, which is installed on the server, along with a client Setup program. Later, when a client connects to the server and runs the client Setup program, the Mspclnt.ini file is copied to the client, and determines its client configuration parameters. For information about using the Microsoft Proxy Server Setup program and completing the Client Configuration dialog box, see “Server Installation.”

If you need to change the server’s copy of the Mspclnt.ini file after a server has been installed, you can:

  • Use a text editor to modify the server’s Mspclnt.ini file, which is installed into the Msp\Clients folder on the server. (See Editing the Mspclnt.ini File, later in this chapter.)

  • Run Microsoft Proxy Server Setup and reinstall the server, specifying the new information in the Client Configuration dialog box.

If you need to change a client’s copy of the Mspclnt.ini file after a client has been installed, you can:

  • Refresh the client’s copy of the file by downloading the current version from the server, as described in Using the WSP Client Control Panel Application, later in this chapter.

  • Use a text editor to modify the client’s copy of the Mspclnt.ini file, as described in Editing the Mspclnt.ini File, later in this chapter.

To Top Installing Clients

Running Client Setup
 Reinstalling a Client
Installing on a Dual-Boot Client
 Running Client Setup from the Command Line

For information about upgrading a client from a preliminary release of Microsoft Proxy Server, see the Readme.txt file provided on the Microsoft Proxy Server compact disc.

To Top Running Client Setup

You can set up a client computer by using either the Setup program or a Web browser.

To set up a client computer using the Setup program

  1. From the client computer, connect to the server’s Mspclnt share.

    For example, for the server Wolfhound, you would connect to \\Wolfhound\Mspclnt.

  2. From the Mspclnt share, run Setup and follow the on-screen instructions.

    The client components will be installed, and the client computer will be configured according to the settings of the Mspclnt.ini file.

To set up a client computer using the client’s Web browser

  1. From a browser on the client computer, connect to the server's installation page by typing the URL http://servername/Msproxy, where servername is the name of the server.

    For example, for the server Delaney, you would type http://Delaney/Msproxy.

  2. Once the client installation Web page is loaded, follow the on-screen instructions to run Setup and install client components.

If the browser proxy settings configured by client Setup are not appropriate for a particular client, or if a client’s Web browser is not Microsoft Internet Explorer or Netscape Navigator, then you must use the Web browser’s own configuration interface to specify the name of the computer running Microsoft Proxy Server and the protocol port number. For more information see Web Proxy Clients, later in this chapter.

To Top Reinstalling a Client

After installing a client, if you need to reinstall you can rerun Setup.

To use Setup to reinstall a client

  1. At the client computer, open the Microsoft Proxy Client program group, and click Setup.

    –Or–

    Connect to the Mspclnt share on the server and rerun client Setup from there, as described in Running Client Setup.

  2. When the Client Setup dialog box appears, select Reinstall and follow the on-screen instructions.

For computers running Windows 95 or Windows NT 4.0, you can also reinstall client software by using Control Panel.

To use Control Panel to reinstall a client

  1. At the client computer, open Control Panel and click Add/Remove Programs.
  2. The Add/Remove Programs Properties dialog box appears.
  3. Make sure the Install/Uninstall tab is selected.
  4. Select Microsoft Proxy Client, click Add/Remove, and follow the on-screen instructions.

To Top Installing on a Dual-Boot Client

It is possible to run client Setup and install the WinSock Proxy client software on a dual-boot computer. Client Setup should be run twice (once for each operating system). After the first installation, you must specify a different client directory. For example, install client software on the Windows NT operating system, then install client software on the Windows 95 operating system in a different directory.

To Top Running Client Setup from the Command Line

Optionally, you can run client Setup from the command line and take advantage of the command-line options. The client Setup syntax is as follows:

Syntax

setup [/r] [/u] [/q[1,t]]

where

/r

Reinstalls the client.

Note The /r switch cannot be used with 16-bit clients (computers running Microsoft Windows 3.1 or Microsoft Windows for Workgroups).

/u

Removes the client application but leaves shared components.

Note The /u switch cannot be used with 16-bit clients (computers running Microsoft Windows 3.1 or Microsoft Windows for Workgroups).

/q

Runs client Setup in “quiet” setup mode. The screen displays progress windows and a Setup completion dialog box, but does not prompt the user to approve or modify installation settings. Quiet setup will always install the client software into the default directory (Mspclnt).

Note You can only use quiet mode for an initial setup. If a client is already installed, you cannot reinstall or remove it by using the /q option.

/q1

Same as /q, but also hides the Setup completion dialog box.

/qt
Same as /q, but also hides the progress windows and completion dialog box. (After installation completes, the client computer will be restarted if a restart is required by the Setup program.)

To Top Removing Clients

To remove the client software from a computer

  1. From the Microsoft Proxy Client program group, click Uninstall.

    The Uninstall Proxy Client dialog box appears.

  2. Click Yes.

    All installed client components are removed from the computer.

You can also remove the client software by using the Setup program, but you must be connected to the Mspclnt share on the server.

To use the Setup program to remove a client

  1. From the Microsoft Proxy Client program group, click Setup.

    –Or–

    Connect to the Mspclnt share on the server and run client Setup from there, as described in Running Setup.

  2. Click Remove All and follow the on-screen instructions.

You can also remove client software by using Control Panel.

To use Control Panel to remove a client

  1. From the client, open Control Panel and click Add/Remove Programs.
  2. The Add/Remove Programs Properties dialog box appears.
  3. Make sure the Install/Uninstall tab is selected.
  4. Select Microsoft Proxy Client, click Add/Remove, and follow the on-screen instructions.

To Top Reviewing the Client Setup Log

During client installation, the client Setup program creates a log, Mpcsetup.log, and places it in the root directory of the drive where the client is installed. (This location is C:\Mpcsetup.log.) If you encounter problems with client Setup, review this log by using any text editor (such as Microsoft WordPad or Microsoft Notepad).

To Top Web Proxy Clients

About Web Proxy Clients
Configuring the Internet Application in Control Panel
 Configuring Microsoft Internet Explorer 3.0 Clients
Configuring Microsoft Internet Explorer 1.5 Clients
Configuring Netscape Navigator Clients
Configuring Apple Macintosh Clients
Configuring UNIX Clients
 Configuring the Server’s Browser
 Web Proxy Client Considerations

To Top About Web Proxy Clients

The term Web Proxy client refers to a client computer whose Web browser is configured to use the Web Proxy service on a Microsoft Proxy Server. Usually, this is accomplished by running the client Setup program, as described in Installing Clients earlier in this chapter.

If the browser proxy settings configured by client Setup are not appropriate for a particular client, you can reconfigure that client’s Web browser (by using the Web browser’s own configuration interface) after installing the client software. Also, if a client’s Web browser is not Microsoft Internet Explorer or Netscape Navigator, or if client Setup does not successfully configure a client’s Web browser to use the Web Proxy service, then you must use the Web browser’s own configuration interface to specify the name of the appropriate Microsoft Proxy Server and the protocol port number (usually 80).

Each browser is configured through its own user interface. Typically, an application’s relevant settings are found in menu items called “Options,” “Preferences,” or “Settings.” You can configure Internet Explorer by using the Internet application in Control Panel.

To Top Configuring the Internet Application in Control Panel

When you run client Setup, it will configure Microsoft Internet Explorer 2.0 as a client of Microsoft Proxy Server. However, you can also use the Internet application in Control Panel to specify the name of the Microsoft Proxy Server and the protocol port number. Internet Explorer 2.0 uses the settings from the Internet application, but other client applications may have their own property sheets or dialog boxes for their proxy service settings.

To configure the Internet application with a Microsoft Proxy Server name and protocol port number

  1. Open Control Panel and click the Internet icon.

  2. Select the Advanced tab.

  3. Select the Use Proxy Server check box.

  4. In the Proxy Server box, type the protocol, proxy server name, and port number (for example, http://myproxy:80.)

  5. Optionally, in the Bypass Proxy On box, type the name of computers, domains, and ports through which client applications can request objects without going through the Web Proxy service. For example, type domainname.com:80 to gain access to computers inside domainname and to services running on port 80 without using the Web Proxy service.

    This option is useful if you want to access Internet servers within your private network.

To Top Configuring Microsoft Internet Explorer 3.0 Clients

When you run the client Setup program, it will configure Microsoft Internet Explorer 3.0 as a client of Microsoft Proxy Server. However, you can also use the browser’s own configuration interface to set this up.

To configure Internet Explorer 3.0 as a Microsoft Proxy Server client

  1. Obtain the proxy system address from the network administrator.
  2. From the Windows desktop, right-click the Internet icon.
  3. Select Properties from the drop-down menu that appears.
  4. Click the Connection tab.
  5. In the Proxy Server area, select the Connect Through A Proxy Server check box, then click the Settings box.
  6. In the protocol Type box, type the appropriate proxy system address or addresses, then type the connection port number (usually 80) in the adjacent Port box.

You can also configure the browser while it is running

To configure Internet Explorer 3.0 while it is running

  1. Start Internet Explorer 3.0.
  2. Obtain the proxy system address from the network administrator.
  3. In the View menu, click Options.
  4. Click the Connection tab.
  5. In the Proxy Server area, select the Connect Through a Proxy Server check box, then click the Settings box.
  6. In the protocol Type box, type the appropriate proxy system address or addresses, then type the connection port number (usually 80) in the adjacent Port box.

To Top Configuring Microsoft Internet Explorer 1.5 Clients

Internet Explorer 1.5 is available for computers running the Windows NT 3.51 and Windows 3.x operating systems.

To configure Internet Explorer 1.5 as a Web Proxy client

  1. Start Internet Explorer, click the Tools menu, and click Set Proxy Server.

    The Set Proxy Server dialog box appears.

  2. Select the Use Proxy Server check box.

  3. In the Proxy Server box, type the name of the server.

  4. In the box after the colon, type the protocol port number (for example, 80).

  5. Optionally, in the Bypass Proxy On box, type the IP addresses of sites that should be accessed without using Microsoft Proxy Server. These can be Internet or private network sites running HTTP, FTP, or Gopher.

To Top Configuring Netscape Navigator Clients

When you run the client Setup program, it will configure Netscape Navigator as a client of Microsoft Proxy Server. However, you can also use the browser’s own configuration interface to set this up.

In Netscape Navigator 2.01 for Windows NT and for Windows 95, you define the name of the computer running Microsoft Proxy Server and the port number for each protocol.

To configure Netscape Navigator 2.01 to use Web Proxy service for HTTP protocol requests

  1. Open Netscape Navigator.
  2. Select the Options menu.
  3. In the Proxies property sheet, select Network Preferences.
  4. Select Manual Proxy Configuration.
  5. Click View.
  6. In HTTP Proxy, type the name of the computer running Microsoft Proxy Server.
  7. In the Port box adjacent to HTTP Proxy, type the port number used on the Microsoft Proxy Server for HTTP protocol requests.

For each protocol you use with the Web Proxy service, you define a Microsoft Proxy Server name and port number in the Proxies property sheet.

To Top Configuring Apple Macintosh Clients

To configure an Apple Macintosh client application running under UNIX, you need to specify the name of the computer running Web Proxy service and the Microsoft Proxy Server port number for the client protocol.

To Top Configuring UNIX Clients

To configure a UNIX client application running under UNIX, you need to specify the name of the computer running Web Proxy service and the Microsoft Proxy Server port number for the client protocol.

To Top Configuring the Server’s Browser

If you use a browser from the server computer that is running Microsoft Proxy Server, and if that browser is configured as a client, you must configure that browser to use as its proxy the IP address of the server’s network adapter card that is connected to the private network. Do not use the server’s computer name or DNS name.

If you configure the server’s browser to use the computer or DNS name, this name can be resolved to the IP address of a network adapter card connected to the Internet. When this occurs, requests from that browser will be filtered (because the LAT should not contain that IP address) and an “Access is denied” error will be returned.

To Top Web Proxy Client Considerations

Following are some considerations about Web Proxy clients:

  • Do not configure Helper applications (such as RealAudio clients) as Web Proxy clients.

    Do not configure Helper applications to use the Web Proxy service. For example, the RealAudio player is used with the WinSock Proxy service. Do not configure the RealAudio client to use Microsoft Proxy Server. When configuring the RealAudio player, in the Proxy tab of the Preferences dialog box, specify no proxy.

  • Proxy Configuration on IPX-only Clients

    The Web browser of a client running only IPX (not running TCP) will not be able to connect to the Web Proxy service on Microsoft Proxy Server if Microsoft Proxy Server is defined in the browser by using a domain or computer name. This can be remedied by editing the client’s Web browser configuration to specify an IP address (not a computer or domain name) for the proxy.

    –Or–

    When installing Microsoft Proxy Server, in the server Setup program’s Client Installation/Configuration dialog box, for Web Proxy Client type an IP address instead of a computer or domain name.

    Then, when a client computer runs client Setup from the server’s share, if the client browser is Microsoft Internet Explorer or Netscape Navigator, client Setup attempts to configure that browser to use the IP address of the specified Microsoft Proxy Server.

    Note that when assigning multiple computers running Microsoft Proxy Server to clients in this manner, balance the load between Microsoft Proxy Servers by appropriately adjusting the number of IPX-only clients assigned to each computer running Microsoft Proxy Server.

  • Logons with 16-bit client software

    A Domain Credentials dialog box may appear when you attempt to establish a connection using 16-bit client software from computers running the Microsoft Windows 95 or Microsoft Windows for Workgroups operating systems. To complete this dialog box and complete the connection request, supply a valid domain name, user name and password.

  • Gopher and Gopher Plus

    When a client sends a Gopher request, if the Gopher server supports Gopher Plus, then Gopher Plus tags are returned to the client by the Web Proxy service.

To Top WinSock Proxy Clients

About WinSock Proxy Clients
 WinSock Proxy Client Considerations

To Top About WinSock Proxy Clients

The term WinSock Proxy client refers to a client computer that is configured to use the Web Proxy service on a Microsoft Proxy Server. The WinSock Proxy client components are installed by running the client Setup program, as described in Installing Clients earlier in this chapter. The client Setup program does not configure individual Windows Sockets applications. Instead, the client computer is configured to use the WinSock Proxy service on a server. All Windows Sockets applications on that computer access the Internet through the WinSock Proxy service on Microsoft Proxy Server.

The WinSock Proxy service supports Windows Sockets version 1.1 applications. Before a Windows Sockets application can access the Internet through Microsoft Proxy Server, the server must be configured to permit access for the required protocol on the required outbound and inbound ports. For details on configuring server support for particular Windows Sockets client applications, see “Configuring the WinSock Proxy Service.”

In a private network with multiple Microsoft Proxy Server gateways, install an equal number of WinSock Proxy clients from each gateway to balance Internet traffic across all the gateways. For information about configuring multiple Microsoft Proxy Server gateways, see “Server Administration.”

To Top WinSock Proxy Client Considerations

Following are some considerations for WinSock Proxy client computers:

  • Do not set Windows Sockets client applications to use Microsoft Proxy Server

    Even if the configuration parameters for the application allow it, do not set a Windows Sockets application on a computer configured as a WinSock Proxy client to use Microsoft Proxy Server.

  • Do not install Microsoft Exchange Server on WinSock Proxy clients

    Microsoft Exchange client software and WinSock Proxy client software can be installed on the same computer. However, do not install Microsoft Exchange Server software and WinSock Proxy client software on the same computer.

  • Logon procedure with 16-bit client software

    A Domain Credentials dialog box may appear when you attempt to establish a connection by using 16-bit client software from computers running the Microsoft Windows 95 or Microsoft Windows for Workgroups operating systems. To complete this dialog box and complete the connection request, supply a valid domain name, user name, and password.

  • Upgrading the operating system on Windows NT clients

    If the Microsoft Proxy Server client software is installed on a computer that runs the Windows NT operating system, and the operating system is later upgraded, the WinSock Proxy client software will be disabled. To re-enable the computer as an WinSock Proxy client, reinstall the client software by running the client Setup program as described in Installing Clients, earlier in this chapter.

    This could occur, for example, if you install the Microsoft Proxy Server client software on a computer running the Windows NT Workstation 3.51 operating system, and then upgrade that computer to Windows NT Workstation version 4.0.

To Top Using the WSP Client Application

Use the WSP Client application in Control Panel to enable or disable the WinSock Proxy client software, change the server from which client configuration files are downloaded, and download fresh copies of the WinSock Proxy client configuration files from that server.

Turning the WinSock Proxy Client On or Off
 Changing the Server Used to Download Client Configuration Files
 Updating the WinSock Proxy Client Configuration Files

To Top Turning the WinSock Proxy Client On or Off

After a computer has the WinSock Proxy client software installed, it is able to use Windows Sockets applications to access Internet sites through Microsoft Proxy Server on the corporate network. However, unless the WinSock Proxy client is turned off, the computer will be unable to use Windows Sockets applications to access any Internet sites through a dial-up connection to a private Internet service provider (ISP). This might occur, for example, if a user has a home computer that is sometimes used to connect to the corporate network, and other times to a private ISP. You can turn the WinSock Proxy client on and off by using the WSP Client application in the Control Panel.

To turn the WinSock Proxy client on or off

  1. From the client computer, open Control Panel and double-click the WSP Client icon.

    The Microsoft WinSock Proxy Client dialog box appears.

  2. Select or clear the Enable WinSock Proxy Client check box.

    • To turn on the WinSock Proxy client software and use Windows Sockets applications with Microsoft Proxy Server, select the Enable WinSock Proxy Client check box.

    • To turn off the WinSock Proxy client software and use Windows Sockets applications with a private ISP, clear the Enable WinSock Proxy Client check box.

  3. Click OK, then reboot the computer.

To Top Changing the Server Used to Download Client Configuration Files

The WSP Client application can be used to change the server from which a computer downloads client configuration files. (Note that this is not necessarily the same server that the computer uses to access the Internet. That server is defined in the downloaded Mspclnt.ini file.)

To change the WinSock Proxy Server from which a client downloads client configuration files

  1. At the client computer, open Control Panel and double-click the WSP Client icon.

    The Microsoft WinSock Proxy Client dialog box appears.

  2. Type a server name in the Configuration Location box.

    Note The entry in the Configuration Location box must be a computer name. It cannot be a DNS name that resolves to multiple IP addresses.

  3. Click OK, then reboot the computer.

    The client is set to use the new server as the source of its client configuration files, and those files are downloaded to the client.

To Top Updating the WinSock Proxy Client Configuration Files

To update client configuration files, you can force an immediate download of client configuration files from the server to the client.

To update the client configuration files

  1. At the client computer, open Control Panel and double-click the WSP Client icon.

    The Microsoft WinSock Proxy Client dialog box appears.

  2. Click Update Now.

    Fresh copies of the client configuration files are downloaded from the server to the client.

To Top Creating a Local LAT File

When the client Setup program runs, it installs a file named Msplat.txt into the Mspclnt directory on the client computer. The Msplat.txt file contains the Local Address Table (LAT), which defines the IP addresses of the private network.

In some situations the LAT table downloaded by the server may not completely define some addresses that a particular client needs to access in the private network. To correct this condition, you can edit the LAT on the server (which would propagate the updated LAT to all its clients) or you can create a local LAT for a particular client. You might create a local LAT, for example, to allow client access to a private subnet inside a private network.

To create a custom LAT table for a particular client, do not edit the client’s copy of the Msplat.txt file, because each client’s Msplat.txt file is overwritten at regular intervals by a fresh version downloaded from the server. Any changes you make locally are lost each time the server updates the file.

Instead, to create a custom LAT file for a client, use a text editor to create a file named Locallat.txt, and place it in the client’s Mspclnt directory. In this way you can add additional IP address ranges that the client recognizes as part of the private network. The client will use both the Msplat.txt and Locallat.txt files to determine which IP addresses are part of the private network (and can be directly communicated with) and which IP addresses are on the Internet (and must be communicated with through Microsoft Proxy Server).

When creating a Locallat.txt table, enter IP address pairs in the file. Each address pair defines either a range of IP addresses (from the first, lower-number address to the second, higher-number address), or a single IP address (if both addresses of the pair are identical). The following is an example of a Locallat.txt file that has two entries. The first entry is an IP address range, and the second is a single IP address.

10.51.0.0 | 10.51.255.255
10.52.144.103 | 10.52.144.103

Note that the second entry is an IP address (not a subnet mask).

To Top Editing the Mspclnt.ini File

The Mspclnt.ini file contains client configuration information. The master copy of the Mspclnt.ini file is created by the Microsoft Proxy Server Setup program and is stored in the Msp\Clients folder on the server. Each instance of client software that is installed from a server receives a copy of the Mspclnt.ini file, which is stored in the Mspclnt folder on the client. The Mspclnt.ini file can be modified by using a text editor (such as Microsoft WordPad).

The following is a sample Mspclnt.ini file.

[Master Config]
Path1=\\COLLIE2\Mspclnt\
[Servers Ip Addresses]
Name=COLLIE
[Servers Ipx Addresses]
Addr1=00002610-0080d830525f
[Common]
Port=1745
Configuration Refresh Time (Hours)=6
Set Browsers to use Proxy=1
WWW-Proxy=COLLIE
WebProxyPort=80

The following table describes the entries in the Mspclnt.ini file.

Section | Entry | Description
[Master Config] | Path1 | A UNC path to the shared network directory on the server, containing the master copy of the client configuration files.
[Servers IP addresses] | Name | The computer or DNS name for the WinSock Proxy server used by the client. (This entry will not appear if an IP address is used.)
[Servers IP addresses] | Addr1 | The IP address of the WinSock Proxy server used by the client. (This entry will not appear if a computer or DNS name is used.) Additional entries are shown as Addr2, Addr3, and so on.
[Servers Ipx Addresses] | Addr1 | The IPX address of the WinSock Proxy server. Additional entries are shown as Addr2, Addr3, and so on.
[Common] | Port | The port Microsoft Proxy Server uses for the control channel. This value will rarely be changed. It should be changed by the administrator on the server’s master copy of the Mspclnt.ini file only if there is a conflict with another service on the server. This value should never be edited in the client’s copy of the Mspclnt.ini file.
[Common] | Configuration Refresh Time (Hours) | At this interval, specified in hours, the client will ask the server to download a fresh copy of the Local Address Table (Msplat.txt).
[Common] | Set Browsers to use Proxy | In the server’s file, set this value to 1 to have the client Setup program configure the client computer’s browser to use the proxy server defined in the WWW Proxy field. Set the value to 0 to prevent the client Setup program from configuring clients to use a proxy server. This field has no effect on the client’s version of the file.
[Common] | LocalDomains | A list of suffixes for names that will be resolved locally, separated by commas (,). Domain names that end in the listed strings are resolved at the client.
[Common] | WWW-Proxy | In the server’s file, if Set Browsers to Use Proxy is set to 1, the client Setup program will configure client browsers to use the proxy server named here. This field has no effect on the client’s version of the file.
[Common] | WebProxyPort | The listen-on port used by the Web Proxy service. In the server’s file, if Set Browsers to Use Proxy is set to 1, the client Setup program will configure client browsers to use the port named in that box. This should be the same port number that is set for the WWW service of Internet Information Server.

To Top Configuring Windows Sockets Applications

Advanced options for configuring individual Windows Sockets applications are not required for most applications to work with the WinSock Proxy service. In most cases, the default WinSock Proxy configuration will work with no need for further modification. However, in some situations the advanced options discussed in this section may be necessary.

Configuration information can be set for all WinSock Proxy applications in two ways:

  • Global configuration These settings are stored by adding a new section in the Mspclnt.ini file. Settings made in this way will be used for all applications if no further settings information is available.
  • Application-specific configuration These settings are individualized for each specific Windows Sockets application and are stored by creating an additional file named Wspcfg.ini for each application that uses specific settings information. This file should be located in the same file directory that the application is installed in. Having this file in the application directory allows support of multiple applications with same name (for example, different versions of the same application).

WinSock Proxy service will first look for an Wspcfg.ini file in a client Windows Sockets application directory. If one is not found, WinSock Proxy service will use the settings found in the Mspclnt.ini file under the [Wsp client] section. The settings used for a particular Windows Sockets application are taken from one of these two files only.

The following is a sample [Wsp client] section in an Mspclnt.ini file. Keep in mind that where shared settings exist in both a Wspcfg.ini file and the Mspclnt.ini file located in the WinSock Proxy Client directory (C:\Mspclnt), application-specific settings made in Wspcfg.ini will override global settings in Mspclnt.ini.

[Wsp client]
Disable=0
NameResolution=R
LocalBindTcpPorts=7777
LocalBindUdpPorts=7000-7022, 7100-7170
RemoteBindTcpPorts=30
RemoteBindUdpPorts=3000-3050
MultipleAccessTcpPorts=100-300
MultipleAccessUdpPorts=500-900, 1000-2000
ProxyBindIp=80:10.52.144.103, 82:10.51.0.0

The following table describes the possible entries that can be placed in a configuration file.

Entry | Description
Disable | Disables WinSock Proxy service functionality; all functions are directly forwarded to the system. Note if the Disable value is set to 0, all following file entries are ignored.
NameResolution | By default, resolution for all dot-convention names is redirected. Forces name resolution to local (L) or redirected (R), as specified.
LocalBindTcpPorts | Specifies a TCP port, list, or range that will be bound locally.
LocalBindUdpPorts | Specifies a UDP port, list, or range that will be bound locally.
RemoteBindTcpPorts | Specifies a TCP port, list, or range that will be bound remotely.
RemoteBindUdpPorts | Specifies a UDP port, list, or range that will be bound remotely. By default, this is set to 6970-7170 to support client computers running RealAudio player version 2.1 or newer. If this entry does not appear in the Mspclnt.ini file, when RealAudio player version 2.1 or newer is used with Microsoft Proxy Server it will display “Buffering 18” in the status bar, and will not play sound. To resolve this condition, click the Stop button, and then click the Play button.
MultipleAccessTcpPorts | Specifies a TCP port, list, or range used by a server application, so an accept operation on these ports is intended to serve clients both locally and on the Internet. By default, the socket is considered of client process with one connection, so the listening socket is reused. Requires that the port will be available both on the client and Microsoft Proxy Server.
MultipleAccessUdpPorts | Specifies a UDP port, list, or range used by a server application, so an accept operation on these ports is intended to serve clients both locally and on the Internet. By default, the socket is considered of client process with one connection, so the listening socket is reused. Requires that the port will be available both on the client and Microsoft Proxy Server.
ProxyBindIp | Specifies an IP address or list that will be used when binding with a corresponding port. Used by multiple servers that use the same port and need to bind to different ports on Microsoft Proxy Server.

Note A port can appear in only one of the entries, either as Local, Remote (redirected), or MultipleAccess. There is no provision for client applications that require connections both on the private network and on the Internet. For such applications, incoming connections from the private network will be directed through Microsoft Proxy Server as well.


CHAPTER 9, Security

Security

Security Overview
Web Proxy Security
WinSock Proxy Security
Securing Your Network

To Top Security Overview

Microsoft Proxy Server provides a secure gateway between your private network and the Internet. As a network administrator, you can use the default configuration to set up Microsoft Proxy Server quickly. Once the server is installed, you can enable Windows-based clients on your private network to access Internet services without risking the security of your private network. You can closely administer Microsoft Proxy Server services to grant or deny access to users, services, ports, or domains you that you specify.

When Microsoft Proxy Server is first installed, Internet users are prevented from connecting to your private network by:

  • Disabling IP forwarding on the server IP forwarding (IP routing) normally allows packets to be forwarded on the internal network. By disabling this feature for the server, all connections must be placed remotely by using the Microsoft Proxy Server.

  • Denying listening on inbound service ports This prevents Internet users from initiating connections on any service ports you do not specifically enable inbound access to.

To Top Web Proxy Security

About Web Proxy Security
Setting Access Control for the Web Proxy Service
How Anonymous Logon Works
How Basic Authentication Works
How Windows NT Challenge/Response Authentication Works

To Top About Web Proxy Security

The Web Proxy service uses the same password authentication options for client requests as those allowed by the WWW service of Internet Information Server (IIS).

A client logon request occurs whenever a client request is forwarded to a Server using IIS or Microsoft Proxy Server. The logon process is used to determine if the client is allowed or denied access to a resource on the server requested by the client. An authentication is a server mechanism used to validate users when processing logon requests. An authentication can be as simple as assigning and encoding a password for the user or it can involve several secure and encrypted process communications between the client and server.

In addition to the options for authenticating users, Web Proxy offers the option to enable or disable access control. For simplified management of the Web Proxy service, you can disable access control. This is useful if anonymous user access is all that is needed for users on your network. For management of individual users on your network, access control can be enabled so that you can fully administer individual security for each user on your network.

When access control is enabled, Web Proxy clients on your network are verified by using a combination of Web Proxy service permissions and the password authentication settings applied for IIS services. The password authentication options for IIS users include the following:

  • Anonymous Logon This is a standard way to provide a single guest user account that is assigned reading and browsing privileges only. This account allows shared access for all users who request published documents on an Internet server.

  • Basic Authentication This is a standard way to validate HTTP users by using encoded clear-text passwords and user names. This type of authentication is specified in HTTP standards established by the World Wide Web Consortium (W3C) and the Conseil Europeen pour la Recherche Nucleair (CERN).

  • Challenge/Response Authentication This is a secure standard for validating clients that Microsoft has developed. This type of authentication is very secure and uses encryption to transmit security information. It can be enabled for client browsers that support this level of authentication, such as Internet Explorer 3.0.

Authentication is set within the Service property sheet of the WWW service of IIS. The option to enable or disable access control for Web Proxy is set within the Permissions property sheet of the Web Proxy service. Both of these services are configured by using Internet Service Manager.

To Top Setting Access Control for the Web Proxy Service

You can use Web Proxy access control to select whether to administer service permissions individually by user, or allow all users to use the Web Proxy service. When access control is enabled, verification is done on each Web Proxy request to determine if the user has appropriate permissions assigned for the type of service being requested. When access control is disabled, the Web Proxy service ignores user permission settings, and all requests are accepted. For more information on how to set access control for Web Proxy, see “Configuring the Web Proxy Service.”

To Top How Anonymous Logon Works

Anonymous logon is a method that uses a standard logon account to provide guest access to resources on the Internet. To establish anonymous logon, a user account is first created and assigned limited privileges on a server. In standard TCP/IP, the user name for this account is “anonymous.” “Anonymous” is entered at a server logon prompt. The server will then prompt for an e-mail name be entered as a logon password. Once the user has completed the “anonymous” logon, rights granted are typically read-only access to limited sets of files and directories.

When Server is first installed with Internet Information Server (IIS), IIS creates a default anonymous user account named IUSR_computername, where computername is the NetBIOS name for the server. This account is allowed permissions by default to the Web Proxy service. This user does not need to be assigned further user permissions in the Web Proxy service properties to enable anonymous logon for proxy users.

The IIS WWW service provides three authentication check boxes: Allow Anonymous, Basic (Clear-Text), and Challenge/Response. If you select Allow Anonymous without also selecting one of the other types of authentication, the following occurs:

  • The Web Proxy service services all user requests
  • All included items on the Permissions property sheet are disabled; Web Proxy service ignores these settings.

Warning If anonymous logon is allowed, all client applications use it. To force proxy users to log on with an account and password, disable anonymous logon. You can still grant unrestricted access to the Web Proxy service by disabling access control in the Permissions property sheet.

To enable anonymous logon to Microsoft Proxy Server

  1. From Internet Service Manager, double-click the computer name next to the WWW service.

    The WWW Service Properties window is displayed.

  2. Click the Allow Anonymous check box in the Password Authentication section to select it.

  3. Click Apply, and then click OK.

To Top How Basic Authentication Works

What is Basic Authentication?
Enabling Basic Authentication

To Top What is Basic Authentication?

Basic authentication is a standard HTTP mechanism that sends and receives user information as clear text. (The term clear text indicates data is transmitted as clearly readable text characters rather than binary bit-streamed information, which is not text-formatted.) Passwords and user names are encoded but not encrypted in this type of authentication.

Basic authentication is used by Web Proxy service when:

  • The Basic (Clear Text) check box is selected on the Service property sheet in WWW service properties.
  • The server and client are both enabled to use Challenge/Response authentication.
  • The client request could not be processed by using anonymous logon account.
  • The Enable Access Control check box on the Permissions property sheet for the Web Proxy service properties is selected.

In basic authentication, the client is responsible for prompting the user for user name and password credentials. The credentials are then encoded and sent to the server. The user name must be an account on the computer running IIS or in a trusted domain of that computer. When using a trusted domain account, the user name must contain the domain name in the following format.

username=domain\account

Warning User credentials can be decoded easily by using widely available utilities (such as UUdecode). For some client types, such as UNIX-based Web clients, basic authentication is the only available means of establishing password-required access to Web published document files. If you allow access from the Internet to Microsoft Proxy Server or another Windows NT-based server on your private network, HTTP basic authentication offers poor security.

If you need to support other client types that are not Windows-based, you should consider a supplementary encryption method. If your network supports only Windows-based clients, you should use a more secure authentication mechanism that supports link encryption, such as Challenge/Response authentication.

To Top Enabling Basic Authentication

To enable basic authentication, create a local group and grant it permission to use a Web Proxy protocol (FTP, Gopher, or HTTP, or Secure). Users are then granted access by assigning each user membership in this local group. To create and modify groups and user accounts, use User Manager for Domains. For more information, see your documentation for .

To enable basic authentication for use with Microsoft Proxy Server

There are two ways to enable basic authentication. Use the following simple procedure to require basic authentication for all users. You can also use the complex procedure to allow anonymous logon for specific users and require basic authentication for all other users.

Simple:

  1. From Internet Service Manager, double-click the computer name next to the WWW service.

  2. Select the Basic (Clear Text) check box in the Password Authentication section.

  3. Clear the Challenge/Response check box.

  4. Clear the Allow Anonymous check box.

  5. Click Apply, then click OK.

  6. Double-click the computer name next to the Web Proxy service.

  7. Click the Permissions tab.

  8. Set access control for users.

    To allow all users rights to all Web Proxy services (FTP, Gopher, WWW, Secure), clear the Enable Access Control check box.

    To set limited user access to Web Proxy services, select the Enable Access Control check box. If you enable access control, you will need to assign user permissions for access rights to each service. For information about assigning permissions, see “Configuring the Web Proxy Service.”

  9. Click Apply, and then click OK.

Complex:

  1. From Internet Service Manager, double-click the computer name next to the WWW service.

  2. Select the Basic (Clear Text) check box in the Password Authentication section.

  3. Clear the Challenge/Response check box.

  4. Select the Allow Anonymous check box.

  5. Click Apply, and then click OK.

  6. Double-click the computer name next to the Web Proxy service.

  7. Click the Permissions tab.

  8. Select the Enable Access Control check box.

  9. Add users to permissions lists for Web Proxy services (FTP Read, Gopher, WWW, Secure).

    For information about assigning permissions, see “Configuring the Web Proxy Service.”

  10. Add the IUSR_computername user to permissions lists for Web Proxy services that will allow anonymous use.

  11. Click Apply, and then click OK.

To Top How Challenge/Response Authentication Works

What is Challenge/Response Authentication?
Enabling Challenge/Response Authentication

To Top What is Challenge/Response Authentication?

Challenge/Response authentication is a security mechanism. Unlike basic authentication, which forwards user names and passwords as clear-text from client to server, Challenge/Response authentication follows a more complex process that requires multiple communications between the client and server. Microsoft Internet Explorer 3.0 supports Challenge/Response authentication with Microsoft Proxy Server.

Challenge/Response authentication works within the security model to provide a transparent logon procedure for clients. In a challenge-and-response sequence, the client computer uses its established user logon information to identify itself to the server. The user is not prompted to enter these user credentials. Instead, the information is available after the user first logs on to a Windows NT-based computer.

Challenge/Response authentication only works where the client and server computers are located in the same or trusted domains.

To Top Enabling Challenge/Response Authentication

To enable Challenge/Response authentication for Web Proxy

There are two ways to enable Challenge/Response authentication.Use the following simple procedure to require Challenge/Response authentication for all users. You can also use the complex procedure to allow anonymous logon for specific users and require Challenge/Response authentication for all other users.

Simple:

  1. From Internet Service Manager, double-click the computer name next to the WWW service.

  2. Select the Challenge/Response check box in the Password Authentication section.

  3. Clear the Allow Anonymous check box.

  4. Click Apply, and then click OK.

  5. Double-click the computer name next to the Web Proxy service.

  6. Click the Permissions tab.

  7. Set access control for users.

    To allow all users access to Web Proxy services (FTP, Gopher, WWW, Secure), clear the Enable Access Control check box.

    To set limited user access to Web Proxy services, select the Enable Access Control check box. If you enable access control, you need to assign user permissions for access rights to each service. For information about assigning permissions, see “Configuring the Web Proxy Service.”

  8. Click Apply, and then click OK.
Complex:

  1. From Internet Service Manager, double-click the computer name next to the WWW service.

  2. Select the Challenge/Response check box in the Password Authentication section.

  3. Clear the Basic (Clear Text) check box.

  4. Select the Allow Anonymous check box.

  5. Click Apply, and then click OK.

  6. Double-click the computer name next to the Web Proxy service.

  7. Click the Permissions tab.

  8. Select the Enable Access Control check box.

  9. Add users to permissions lists for Web Proxy services (FTP Read, Gopher, WWW, Secure).

    For information about assigning permissions, see “Configuring the Web Proxy Service.”

  10. Add the IUSR_computername user name to permissions lists for Web Proxy services that will allow anonymous use.

  11. Click Apply, and then click OK.

For Challenge/Response authentication to be used, the Web browser for each client must support it. Currently, Microsoft Internet Explorer 3.0 is the only browser that supports this option with Microsoft Proxy Server. For more information, on enabling Web Proxy service for clients using Internet Explorer 2.0 or later, see “Setting Up Clients.”

To Top WinSock Proxy Security

How WinSock Proxy Security Works
Setting Access Control for WinSock Proxy
Assigning Permissions for WinSock Proxy Users
Considerations for WinSock Proxy Security

To Top How WinSock Proxy Security Works

The WinSock Proxy service provides secure communication between your network and remote Internet computers that support Windows Sockets applications. It uses Challenge/Response authentication to authenticate all users (when access control is enabled).

Also, to enhance security you can use WinSock Proxy as an IP application gateway for IPX networks. This allows IPX/SPX clients on an internal network to access TCP/IP resources on an external network. An application level proxy uses two separate service connections: an IPX connection on the internal network between the WinSock Proxy server and client, and an IP connection between the WinSock Proxy server and a remote server on the Internet. Because separate connections and different routing protocols are used on the internal and external networks, the risk of outside intrusion is reduced. Only the computer running Microsoft Proxy Server is visible to other Internet servers.

Note WinSock Proxy and Multi-Protocol Routing (MPR), a routing service provided with Server 4.0, use different methods for handling network communications and establishing IPX-to-IP connectivity.

The WinSock Proxy service uses application-level proxy over two separate virtual circuits. MPR uses protocol conversion processes where multiple routing protocols are in use (also known as tunneling) to communicate over a single virtual circuit.

To Top Setting Access Control for WinSock Proxy

You can use WinSock Proxy access control to select whether to administer service permissions individually by user, or allow all users to use the WinSock Proxy service.

  • When access control is enabled, verification is done on each WinSock Proxy request to determine if each user has appropriate permissions assigned for the type of protocol service being requested. You can control which application ports can be used and who can use them. Protocol port access for inbound and outbound connections and the ability to set user permissions by protocol allow you to restrict use of Windows Sockets applications between your network and the Internet. WinSock services, such as RealAudio, VDOLive, and Enliven protocols, can be administered to allow only specific users access through WinSock Proxy.

  • When access control is disabled, the WinSock Proxy service does not verify users. In this case, any user permissions have no effect, and user permission settings are ignored. Access to all WinSock Proxy server ports and protocols is possible for valid users on the server computer.

For more information on setting access control for the WinSock Proxy service, see “Configuring the WinSock Proxy Service.”

To Top Assigning Permissions for WinSock Proxy Users

Use the Permissions property sheet of the WinSock Proxy Service Properties window in Internet Service Manager to set permissions for WinSock Proxy users. For more information, see “Configuring the WinSock Proxy Service.”

To Top Considerations for WinSock Proxy Security

When Modifying the Local Address Table
 When Setting Port Protocol Permissions
When Setting TCP/IP Properties for Network Adapter Cards
When Running Microsoft Proxy Server in a Workgroup

To Top When Modifying the Local Address Table

For security reasons, consider the following carefully when you are modifying the LAT:

  • Do not add IP addresses for any devices connected to the same physical cabling segment used by the external network adapter card.

    This prevents possible connection leaks between the external and internal network, and requires all interconnection between external and internal clients to be established active security settings configured on the computer running Microsoft Proxy Server.

  • Check that IP addresses for the server’s adapter cards are correctly stated for the LAT.

    If two or more network adapter cards are installed for the Microsoft Proxy Server, only IP addresses for cards connected to the internal network segment should be listed or included in the LAT. All cards used for connecting to the external segment should not be present in the LAT.

For more information on the LAT or how to modify it, see “Server Administration.”

To Top When Setting Port Protocol Permissions

Ports serviced by WinSock Proxy are used by various TCP/IP applications for inbound or outbound connections. By default, inbound access is disabled for protocols that provide administrative access, such as Telnet or FTP.

Warning Some TCP/IP applications that use TCP to transport data, such as Telnet and FTP, use clear text to send and receive user and password information. This information can be seen by others on the Internet. If you intend to use the Internet to pass discrete information between your network and other networks, you should implement further levels of encryption for your data.

If you choose to allow inbound access for these types of applications to your network from the Internet, be careful to:

  • Set remote account restrictions in User Manager for Domains carefully.
  • Enable access control for WinSock Proxy to specify and limit user permissions to the WinSock Proxy service.
  • Do not use the Unlimited Access option to grant remote users permissions to WinSock Proxy service.

In most cases, remote Internet users should use restricted accounts that assign guest logon access or read-only file access on the server. Also, by enabling access control, permissions that are set for each defined WinSock Proxy protocol are applied to all users.

Warning Do not provide Internet users the Unlimited Access option. When assigned, this option allows a user full control to use any protocols or ports with WinSock Proxy service, including those that are not defined. For this reason, be cautious in assigning this permissions option to users.

To Top When Setting TCP/IP Properties for Network Adapter Cards

Server 4.0 provides additional advanced options for securing TCP/IP networking, which can be used to provide further security for your network. Because WinSock Proxy service port options are set at a higher level (the application layer) and TCP/IP networking properties are set at a lower level (the network and transport layer), settings for TCP/IP Protocol Properties take precedence when enabling port access.

For more information on how to configure advanced security options for TCP/IP networking with Microsoft Proxy Server, see “Server Administration.”

To Top When Running Microsoft Proxy Server in a Workgroup

When the server running Microsoft Proxy Server is installed as part of a workgroup and is not part of a domain, the following considerations are in effect for configuring WinSock Proxy service access control:

  • If the server is running the WinSock Proxy service with access control enabled, use User Manager to create an account on the server for each user who will be accessing the Internet through that server. Use User Manager to place those users in user groups, and then use Internet Service Manager to grant appropriate WinSock Proxy permissions to each group.

  • If the server is running the WinSock Proxy service with access control disabled, users can access the server by using the server’s special Everyone account.

To Top Securing Your Network

Restricting Inbound Access From the Internet
Restricting Outbound Access From Your Network

Microsoft Proxy Server offers default security that is probably sufficient to protect your network from outside intruders. In some installations, you may want more security to further protect your network from an anticipated intrusion.

The following sections discuss further considerations when restricting access to your local network from users on the Internet, and also from users located on other separate networks within your organization.

To Top Restricting Inbound Access From the Internet

About Default Inbound Security From the Internet
Domain Planning Considerations

To Top About Default Inbound Security From the Internet

When Microsoft Proxy Server is first installed, your network is secured from external users on the Internet in two ways: by disabling IP forwarding on the server and by disabling listening on inbound service ports.

IP forwarding is a TCP/IP routing feature of Server. If IP forwarding is enabled, Microsoft Proxy Server forwards all IP connection requests received on any of the server network ports. To prevent default forwarding of all IP requests, IP forwarding must be disabled.

With IP forwarding disabled, Microsoft Proxy Server sets network boundaries and controls IP traffic between the two server network ports. This configuration forces all connections between both network ports to be managed through either the Web Proxy service or WinSock Proxy service.

By disabling listening on inbound service ports, Internet users are prevented from initiating connections on any application service ports you do not specifically grant users permissions to use.

To Top Domain Planning Considerations

In many cases, the preferred way to install Microsoft Proxy Server is to make it a stand-alone server in your current domain. However, if you have multiple domain servers within a larger private network, you can also consider setting up Microsoft Proxy Server as a Primary Domain Controller (PDC) within its own domain.

To install a new domain for Microsoft Proxy Server, set a single one-way trust relationship to another domain on your private network. In this relationship, the domain used for Microsoft Proxy Server is the trusting domain and another internal domain is specified as the trusted domain.

If there is an intrusion, having a separate domain limits access to the Microsoft Proxy Server. This is because no internal Windows NT-based servers trust the domain used for Microsoft Proxy Server. If other proxy servers are added, they can be included within the domain created for use with Microsoft Proxy Server.

For more information on setting trust relationships and understanding domains, see your documentation for Server.

To Top Restricting Outbound Access From Your Network

Overview of Outbound Access Security Options
Filtering Access By DNS Domain Name
Filtering Access By IP Address
Using Groups to Assign Internal User Permissions

To Top Overview of Outbound Access Security Options

This section covers considerations for securing access from your private network to other networks. Whether you are setting restrictions to the Internet or other networks in your organization, the same options are useful. These include setting domain filters and assigning user permissions to limit access by users on your network to another network.

When setting domain filters, both the Web Proxy and WinSock Proxy services can be set to have a default policy that grants or denies access to specific Domain Naming System (DNS) domains or IP addresses. You can then list exceptions to the policy.

Filters that are set for either service are applied for both the Web Proxy and WinSock Proxy services. Filtering can be set using the service properties for either service.

For user permissions, settings are specific to each service, and permissions must be set separately for the Web Proxy and WinSock Proxy services.

To Top Filtering Access By DNS Domain Name

For both Web Proxy and WinSock Proxy services, outbound access can be restricted to Internet sites by setting filtering options for this purpose. Filtering can be applied to exclude access to a single computer, a group of computers, or entire DNS domain names that are reachable on the Internet by users on your network.

In most cases when establishing filtered access to remote Internet sites, applying filtering based on DNS domain names for specific sites will provide the best option for several reasons.

First, filtering by specified IP addresses may not work effectively because there may be several IP addresses answering to a given domain name. If you pick one address, you will miss the other addresses that mirror the same server content. Also, in some networks, IP addresses may be dynamically assigned by using Bootstrap Protocol (BOOTP) or dynamic host configuration protocol (DHCP) services. Where this occurs, the remote server’s IP address may change.

To Top Filtering Access By IP Address

If you are managing a large private network that uses TCP/IP but does not connect to the Internet, you may find it more convenient to precisely filter access by entering specific IP addresses.

Although DNS filtering is simpler to manage and generally preferred where available, listing individual IP addresses for filtering is a valid option where DNS naming services are not managed on your network, and your private network uses static IP addressing.

To Top Using Groups to Assign Internal User Permissions

When assigning permissions for the WinSock Proxy and Web Proxy services, it is recommended that you first use User Manager to create user groups for each common set of permissions that will be needed by users on your network. For most networks, this will greatly reduce the amount of time spent administering individual user permissions.

Groups can be created to manage and authorize Internet access for users selectively. Permissions by service for Web Proxy clients can include permission rights to use FTP, Gopher, HTTP, and Secure Sockets Layer (SSL) connections. To better understand how groups can be used in this way, it is useful to look at some examples of managing permissions with user groups.

For example, if you need to simplify assigning service permissions for each user to FTP, Gopher, and WWW services, you could create a group named Proxies and add this group to the permission rights listing for each of these three services using the Web Proxy service property sheet in Internet Service Manager. In the future, to provide individual users proxy access for all of these Internet protocol services, you would then only need to add each user once as a member to the Proxies group using the User Manager for Domains.

The same concept could apply for other service permissions by user that you want to create. Suppose you have a group of users that need to use SSL connections for access to the World Wide Web (WWW). For security reasons, these connections are not to use the default HTTP service port, port 80. By creating a group named Secure Proxies and adding this group permission rights to the Secure service in Internet Service Manager, you could add each user as a member to the Secure Proxies group.

For WinSock Proxy service users, protocol permissions can be managed by using the same strategy. If, for example, you wanted to assign a small group of users on your network access to real-time audio and video transmission, you could create a group AV Enabled and assign this group permission rights for RealAudio and VDOLive protocols by using the Permissions property sheet for WinSock Proxy service properties. Each multimedia user could then be provided access simply by being added to the AV Enabled group.


CHAPTER 10, Monitoring

Monitoring

Setup Logs
 Microsoft Proxy Server Logs
Windows NT Logs
Performance Monitor Counters
SNMP MIBs

To Top Setup Logs

The Server Setup Log
The Client Setup Log

To Top The Server Setup Log

The Microsoft Proxy Server Setup program creates a log file, C:\Mpssetup.log. Customers calling Microsoft for assistance should have this file available when calling. It contains valuable information beyond any error messages that are displayed to the user.

The Setup log is overwritten each time Microsoft Proxy Server is installed.

Following is an example of a Microsoft Proxy Server Setup log:

Microsoft Proxy Server Setup Log
--------------------------------

MSP Setup: VerifyServerCondition camf=0 ois=0 or=1110 DstDir=NULL
MSP Setup: NT build 1381
MSP Setup: open file C:\WINNT\System32\w3pmon.dll returned 2
MSP Setup: VerifyServerCondition returnd OK!!! camf=0 ois=0 or=1110 DstDir=NULL
MSP Setup: FindVirtualRoot camf=10 ois=0 or=1120 DstDir=NULL
MSP Setup: FindVirtualRoot returnd OK!!! camf=10 ois=0 or=1120 DstDir=C:\InetPub\scripts\
MSP Setup: FindGibraltarDir camf=10 ois=0 or=4010 DstDir=NULL
MSP Setup: FindGibraltarDir returnd OK!!! camf=10 ois=0 or=4010 DstDir=C:\WINNT\System32\inetsrv\
MSP Setup: FindVirtualRoot camf=10 ois=0 or=1120 DstDir=C:\InetPub\scripts\
MSP Setup: FindVirtualRoot returnd OK!!! camf=10 ois=0 or=1120 DstDir=C:\InetPub\scripts\
MSP Setup: FindGibraltarDir camf=10 ois=0 or=4010 DstDir=C:\WINNT\System32\inetsrv\
MSP Setup: FindGibraltarDir returnd OK!!! camf=10 ois=0 or=4010 DstDir=C:\WINNT\System32\inetsrv\
MSP Setup: NetStop camf=15 ois=4 or=1130 DstDir=C:\msp\
MSP Setup: NetStoping wspsrv
MSP Setup: NetStop returnd OK!!! camf=15 ois=4 or=1130 DstDir=C:\msp\
MSP Setup: NetStop camf=15 ois=4 or=1140 DstDir=C:\msp\
MSP Setup: NetStoping w3svc
MSP Setup: NetStop returnd OK!!! camf=15 ois=4 or=1140 DstDir=C:\msp\
MSP Setup: NetStop camf=15 ois=4 or=1150 DstDir=C:\msp\
MSP Setup: NetStoping mspadmin
MSP Setup: NetStop returnd OK!!! camf=15 ois=4 or=1150 DstDir=C:\msp\
MSP Setup: NetStop camf=15 ois=4 or=1160 DstDir=C:\msp\
MSP Setup: NetStoping snmp
MSP Setup: NetStop returnd OK!!! camf=15 ois=4 or=1160 DstDir=C:\msp\
MSP Setup: SetCacheDir camf=15 ois=4 or=1170 DstDir=C:\msp\
MSP Setup: SetCacheDir returnd OK!!! camf=15 ois=4 or=1170 DstDir=C:\msp\
MSP Setup: SetNetConfig camf=15 ois=4 or=1180 DstDir=C:\msp\
MSP Setup: SetNetConfig returnd OK!!! camf=15 ois=4 or=1180 DstDir=C:\msp\
MSP Setup: NetShare camf=15 ois=4 or=1250 DstDir=C:\msp\
MSP Setup: Net stop Sharing mspclnt
MSP Setup: NetShare returnd OK!!! camf=15 ois=4 or=1250 DstDir=C:\msp\
MSP Setup: SetNetConfig camf=22 ois=4 or=1180 DstDir=C:\msp\
MSP Setup: SetNetConfig returnd OK!!! camf=22 ois=4 or=1180 DstDir=C:\msp\
MSP Setup: CreateLink camf=22 ois=4 or=1400 DstDir=C:\msp\
MSP Setup: CreateLink - szData is msp.pmc
MSP Setup: CreateLink returnd OK!!! camf=22 ois=4 or=1400 DstDir=C:\msp\
MSP Setup: CreateLink camf=22 ois=4 or=4050 DstDir=C:\WINNT\System32\inetsrv\
MSP Setup: CreateLink - szData is inetmgr.exe
MSP Setup: CreateLink returnd OK!!! camf=22 ois=4 or=4050 DstDir=C:\WINNT\System32\inetsrv\
MSP Setup: CreateLink camf=22 ois=4 or=5020 DstDir=C:\msp\docs\
MSP Setup: CreateLink - szData is toc_msp.htm
MSP Setup: CreateLink returnd OK!!! camf=22 ois=4 or=5020 DstDir=C:\msp\docs\
MSP Setup: AddVirtualIISRoot camf=22 ois=4 or=5030 DstDir=C:\msp\docs\
MSP Setup: AddInetmgrHelpAddOn camf=22 ois=4 or=5040 DstDir=C:\msp\docs\
MSP Setup: SetMspRegistry camf=24 ois=4 or=1230 DstDir=C:\msp\
MSP Setup: did not find snmp root registry
MSP Setup: InstallWspService returnd OK!!! camf=24 ois=4 or=1230 DstDir=C:\msp\
MSP Setup: NetShare camf=24 ois=4 or=1250 DstDir=C:\msp\
MSP Setup: NetShare returnd OK!!! camf=24 ois=4 or=1250 DstDir=C:\msp\
MSP Setup: InstallWspService camf=24 ois=4 or=1260 DstDir=C:\msp\
MSP Setup: InstallWspService returnd OK!!! camf=24 ois=4 or=1260 DstDir=C:\msp\
MSP Setup: NetStart camf=24 ois=4 or=1270 DstDir=C:\msp\
MSP Setup: NetStarting w3svc
MSP Setup: NetStart returnd OK!!! camf=24 ois=4 or=1270 DstDir=C:\msp\
MSP Setup: NetStart camf=24 ois=4 or=1280 DstDir=C:\msp\
MSP Setup: NetStarting wspsrv
MSP Setup: NetStart returnd OK!!! camf=24 ois=4 or=1280 DstDir=C:\msp\
MSP Setup: NetStart camf=24 ois=4 or=1290 DstDir=C:\msp\
MSP Setup: NetStarting mspadmin
MSP Setup: NetStart returnd OK!!! camf=24 ois=4 or=1290 DstDir=C:\msp\
MSP Setup: NetStart camf=24 ois=4 or=1300 DstDir=C:\msp\
MSP Setup: NetStarting snmp
MSP Setup: NetStart returnd OK!!! camf=24 ois=4 or=1300 DstDir=C:\msp\
MSP Setup: InstPerfmon camf=24 ois=4 or=3221 DstDir=C:\msp\
MSP Setup: InstPerfmon returnd OK!!! camf=24 ois=4 or=3221 DstDir=C:\msp\

To Top The Client Setup Log

The client Setup program creates a log file, Mpcsetup.log, and places it in the root directory of the client computer’s hard disk. Customers calling Microsoft for assistance should have this file available when calling. It contains valuable information beyond any error messages that are displayed to the user.

The client Setup log is overwritten each time the client software is installed. Following is an example of a client Setup log:

Microsoft Proxy Server Setup Log
--------------------------------

MSP Setup: IsWinsockInWinDir camf=1 ois=0 or=90 DstDir=NULL
MSP Setup: winsock found in windir=1 in sysdir=0
MSP Setup: IsWinsockInWinDir returned DEFAULT!!! camf=1 ois=0 or=90 DstDir=NULL
MSP Setup: CheckFixInconsistency camf=0 ois=0 or=600 DstDir=NULL
MSP Setup: cleaning temp files
MSP Setup: IsCurrentDllRwsWin95_16 returned 1 result=1
MSP Setup: cleaning temp files
MSP Setup: wsock32.dll - Description: Microsoft Remote Windows Socket 32-Bit DLL
MSP Setup: wsock32.dll IsCurrentDllRws = yes
MSP Setup: CheckFixInconsistency returnd OK!!! camf=0 ois=0 or=600 DstDir=NULL
MSP Setup: IsWinsockInWinDir camf=13 ois=0 or=90 DstDir=NULL
MSP Setup: IsWinsockInWinDir returnd OK!!! camf=13 ois=2 or=90 DstDir=NULL
MSP Setup: IsWinsockInWinDir camf=13 ois=2 or=90 DstDir=NULL
MSP Setup: IsWinsockInWinDir returnd OK!!! camf=13 ois=4 or=90 DstDir=NULL
MSP Setup: IsWinsockInWinDir camf=5 ois=4 or=90 DstDir=NULL
MSP Setup: IsWinsockInWinDir returnd OK!!! camf=5 ois=4 or=90 DstDir=NULL
MSP Setup: CheckWinsockApps camf=15 ois=4 or=700 DstDir=C:\mspclnt\
MSP Setup: CheckWinsockApps returned DEFAULT!!! camf=15 ois=4 or=700 DstDir=C:\mspclnt\
MSP Setup: CheckFixInconsistency camf=24 ois=4 or=600 DstDir=C:\mspclnt\
MSP Setup: warning - RemoveBeta2Wsock Delete file returned 2
MSP Setup: CheckFixInconsistency returned DEFAULT!!! camf=24 ois=4 or=600 DstDir=C:\mspclnt\
MSP Setup: SetReg camf=24 ois=4 or=800 DstDir=C:\mspclnt\
MSP Setup: SetReg returnd OK!!! camf=24 ois=4 or=800 DstDir=C:\mspclnt\
MSP Setup: SwithWsockdll camf=24 ois=4 or=1000 DstDir=C:\mspclnt\
MSP Setup: wsock32.dll - Description: Microsoft Remote Windows Socket 32-Bit DLL
MSP Setup: wsock32.dll IsCurrentDllRws = yes
MSP Setup: rws32.dll Version=1.0.163.2
MSP Setup: wsock32.dll Version=1.0.157.2
MSP Setup: HigherVersion rws32.dll = yes
MSP Setup: call _mktemp with __XXXXXX
MSP Setup: Added for post-reboot list : rename wsock32.dll to __a53287.tmp
MSP Setup: Added for post-reboot list : rename rws32.dll to wsock32.dll
MSP Setup: IsWinsock16Loaded_w95 returned 1 result=0
MSP Setup: LazyRename=0
MSP Setup: IsCurrentDllRwsWin95_16 returned 1 result=1
MSP Setup: rws.dll Version=1.0.163.2
MSP Setup: winsock.dll Version=1.0.157.2
MSP Setup: HigherVersion rws.dll = yes
MSP Setup: call _mktemp with __XXXXXX
MSP Setup: succeeded - rename winsock.dll To __a53287.tmp
MSP Setup: succeeded - rename rws.dll To winsock.dll
MSP Setup: SwitchWsockDll returnd OK!!! camf=24 ois=4 or=1000 DstDir=C:\mspclnt\

To Top Microsoft Proxy Server Logs

Logging Overview
 Logging to a File
 Logging to a Database
Log Fields
Logging Issues

To Top Logging Overview

Microsoft Proxy Server supports logging for the Web Proxy and WinSock Proxy services. You can log to:

  • A comma-delimited text file.
  • A table in an ODBC-compliant database, such as Microsoft SQL Server version 6.5 or Microsoft Access 7.0.

Logging can be configured separately for each of the two service logs, which are:

  • WinSock Proxy service log This file contains connection-specific log information for redirected Windows Sockets-based connections.

    Note     Entries to the WinSock Proxy service log appear under the source name of WinSockProxyLog in the Windows NT system log.

  • Web Proxy service log This file contains connection-specific log information for proxy connections between the Microsoft Proxy Server and its Web Proxy clients.

    Note     Entries to the Web Proxy service log appear under the source name of WebProxyLog in the Windows NT system log.

Note See Windows NT Logs later in this chapter for source names of all event types that can be logged.

The available logging options for each service include support for two log formats:

  • Regular Logging For smaller log sizes, this format supports a reduced number of information fields for log entries. Fields not supported are denoted with a hyphen (-).

  • Verbose Logging For a fuller level of detail in logging, all available information for each service is logged. Selecting this format increases the size of log files and requires more disk space for logging.

If you are uncertain about which format to use, you can use the following general guidelines:

  • If available disk space is limited on the volume assigned for logging, consider using the regular logging format.
  • If disk space is not limited or is not an issue, or you are planning to log service information to a database for further analysis, consider using the verbose logging format for the full reporting.

Tip Turn off Internet Information Server (IIS) logging when Web Proxy service logging is enabled. The IIS log is a subset of the information stored in the Web Proxy service log, so you can improve performance by turning off IIS logging. To turn off IIS logging, use Internet Service Manager to open the Logging property sheet for the WWW service. Clear the Enable Logging check box.

To Top Logging to a File

Microsoft Proxy Server can log to comma-delimited text files (ASCII files), or to a table in an ODBC-compliant database (such as Microsoft SQL Server or Microsoft Access). This section discusses the location and other format conventions used for text file logs.

When logging to a text file, log fields are separated by the use of a single comma (,). If you are using a parsing tool to parse text file logs into database format, each comma in a log file entry should be used to force a field break to occur.

The default locations when logging to a text file are:

  • C:\Winnt\System32\W3plogs\Filename.log for Web Proxy service
  • C:\Winnt\System32\Wsplogs\Filename.log for WinSock Proxy service

The name given to text-file logs depends on how logging is configured. Logging can be configured to create a new log each day, week, month, or when the current log file reaches a specified size.

The Web Proxy service text file logs take the following form:

  • Daily logs are named W3yymmdd.log
  • Weekly logs are named W3Wyymmw.log
  • Monthly logs are named W3Myymm.log
  • Logs based on file size are named W3Bnnnn.log

The WinSock Proxy service text file logs take the following form:

  • Daily logs are named WSyymmdd.log
  • Weekly logs are named WSWyymmw.log
  • Monthly logs are named WSMyymm.log
  • Logs based on file size are named WSBnnnn.log

Where:

  • yy is a number between 00 and 99 indicating the year.
  • mm is a number between 01 and 12 indicating the month.
  • dd is a number between 01 and 31 indicating the day of the month.
  • w is a number between 1 and 5 indicating the week of the month.
  • nnnn is a number that increments with each new log that is opened.

To log to a text file and set the logging parameters

  1. From Internet Service Manager, double-click the computer name next to the WinSock Proxy or Web Proxy service, and then click the Logging tab.

  2. Make sure the Enable Logging option is selected.

  3. Select either Regular Logging or Verbose Logging.

    Regular logging records only a subset of all available information for each Internet access. This option reduces the disk space needed for a log file. Verbose logging records all available information for each Internet access.

  4. Make sure the Log to File option is selected.

  5. Select or clear the Automatically open new log option.

    Select this option to periodically create a new log file, using the interval specified by the Daily, Weekly, Monthly, or When File Size Reaches options. When a new log file is started, the old log file is closed (and can optionally be archived on other storage media).

    Clear this option to use the same log file continuously.

  6. If you select the Automatically Open New Log option, specify the interval used to determine when to open a new log file. Select Daily, Weekly, Monthly, or When File Size Reaches. If you select When File Size Reaches, also enter a value for maximum allowed file size in the MB box.

  7. Review, and if appropriate, change the log file directory.

    To change this location, type a new path in the Log File Directory box, or click Browse and complete the dialog box that appears. It is possible to log to a local or remote drive, but in general it is recommended that you store your log file on a local disk.

    Note To help prevent the disk from filling up, it is a good idea to store the logs and the Web Proxy cache on different volumes.

  8. Click OK.

    The log settings are saved.

To Top Logging to a Database

Database Logging Overview
Installing ODBC Drivers
Defining a System Data Source Name
Setting Up Database Tables
Configuring the Service to Log to a Database

To Top Database Logging Overview

When you install Microsoft Proxy Server, logging to a file is the default logging method. If you prefer to save logs in a database, you can configure the Web Proxy and WinSock Proxy services to do so.

Logging to any Open Database Connectivity (ODBC) version 2.5-compliant database, such as Microsoft SQL Server version 6.5 or Microsoft Access 7.0, is possible with Microsoft Proxy Server. ODBC is a standard API used for generic cross-platform connectivity across Windows-based database platforms. It is designed to be a general-purpose Call-Level Interface (CLI) for any database, including nonrelational Database Management Systems (DBMS). Microsoft Proxy Server supports ODBC for logging service information to databases.

Database logging increases the amount of time and resources needed by Microsoft Proxy Server to service Internet requests. Therefore, if your site has heavy Internet traffic, you should consider logging to a file to maximize performance.

The following procedure describes the basic steps for setting up logging to an ODBC-compliant database.

To prepare a SQL/ODBC database for Microsoft Proxy Server service logging

  1. Install the database.

    If you are using either Microsoft SQL Server or Microsoft Access for your preferred database, refer to your product documentation for more information on installation procedures.

  2. Install the ODBC driver for the database you are using.

    For more information, see Installing ODBC Drivers, later in this chapter.

  3. Create a system Data Source Name (system DSN) for the database.

    For more information, see Defining a System Data Source Name, later in this chapter.

  4. Create a table in your database application with the necessary fields. Table elements, such as data types and field names, must be defined appropriately for the database application you are using.

    For more information on specific database table formats for Microsoft SQL or Microsoft Access databases and tools for creating a table for service logging, see Setting Up Database Tables, later in this chapter.

  5. Enable database logging using Internet Service Manager for each Microsoft Proxy Server service that will be using database logging. For more information on enabling service logging, see Configuring the Service to Log to a Database, later in this chapter.

Note Before configuring a server to log to a Microsoft Access database, be sure to check the latest information posted on the Microsoft Proxy Server home page on the Internet, at http://www.microsoft.com/proxy/ . This site provides important information you need to know in order to configure Microsoft Proxy Server to log to a Microsoft Access database.

To Top Installing ODBC Drivers

An ODBC driver must be installed before using ODBC logging options with Microsoft Proxy Server. ODBC drivers must be ODBC version 2.5 components. This version of ODBC supports system Data Source Names (DSNs), which allows Windows NT services to use ODBC.

To install the ODBC drivers

  1. If an ODBC Driver is not already installed, run Internet Information Server Setup again from the Microsoft Internet Server program group. You will need to have access to the Windows NT Server compact disc, or to a network installation directory containing the complete contents of the compact disc.
  2. Click the OK button.
  3. Click the Add/Remove button.
  4. Click the OK button.
  5. Select the ODBC Drivers and Administration option.
  6. Click the OK button. The Install Drivers dialog box appears.
  7. To install the SQL Server driver, select the SQL Server driver from the Available ODBC Drivers list box.

  8. Click the OK button. Setup will complete copying the necessary files.

Note Use Microsoft Access to install the Microsoft Access ODBC driver. To log to an Access database, Microsoft Proxy Server requires the 32-bit ODBC drivers shipped with Microsoft® Office95 and Microsoft® Access95. The ODBC driver for Microsoft Access 2.0 will not work with Microsoft Proxy Server.

Once ODBC drivers have been installed, you can use them to create and set system DSNs. For more information, see Defining a System Data Source Name later in this chapter.

To Top Defining a System Data Source Name

The system DSN is a logical name used by ODBC to refer to the driver and any other information required to access the data, such as the name of the server where the database is located. Once the ODBC driver for your database is installed, a system DSN must be added for database logging.

When adding a DSN for your database, choose a unique name that is not likely to be repeated elsewhere in configuring the database. Avoid any types of names that could be repeated or assigned for database users. You may also use the default DSN, “Proxy Server SQL.” Also, the DSN you decide to use will need to match the DSN setting in the SQL or Access database to be used for logging.

For Microsoft SQL Server, the server name, network address, and network library displayed in this dialog box are specific to your installation. You must enter a server name, but if you do not know what to enter in the network address and network library fields you can accept the defaults.

To set a system Data Source Name

  1. From the desktop of the server, click the Start button. Select Settings and click Control Panel.

  2. Double-click the ODBC icon.

    The ODBC Data Sources dialog box appears.

  3. Click the System DSN button.

    Important Be sure to click the System DSN button. Logging to a database will only work with system DSNs.

    The System Data Sources dialog box appears.

  4. Click the Add button.

    The Add Data Source dialog box appears. The installed ODBC drivers are listed.

  5. Select an ODBC driver and click OK. A dialog box specific to your driver appears.

  6. Enter the Data Source Name and configure the DSN parameters.

    Use a unique name for the DSN. For Microsoft SQL Server, the server name, network address, and network library displayed in this dialog box are specific to your installation. You must enter a server name, but if you do not know what to enter in the network address and network library fields you can accept the defaults. For Microsoft Access, the system DSN is the file name of the database. For example, if the Microsoft Access database you are logging to is named Proxylog.mdb, the system DSN would be Proxylog.

  7. Click the Option button and specify a database name in the Database Name field.

  8. Click OK.

    The System Data Sources dialog box returns, with the new system data source name added.

  9. Click Close, then click Close again.

    The System Data Sources dialog box returns.

  10. Click Close.

To Top Setting Up Database Tables

Using the SQL Logging Table Tool
Microsoft SQL Server Table Format
Microsoft Access Table Format

To Top Using the SQL Logging Table Tool

When installed, Microsoft Proxy Server provides an additional form-based tool that can be used to generate a single Microsoft SQL table with the required field names, data type, and field length settings (as described in Microsoft SQL Server Table Format below).

Note The same table format is used for regular and verbose logging formats. When regular logging format is selected, some fields are not used and will remain empty.

The SQL logging table tool, Mkplog.exe, should be executed as a URL from within a Web browser application on the same computer used for Microsoft SQL Server. Mkplog.exe is located in the IIS scripts directory (C:\Inetpub\Scripts\Tools) on the computer running Microsoft Proxy Server.

To create a table for logging with Microsoft Proxy Server by using Mkplog.exe

  1. Open the Web browser application, such as Internet Explorer, on the computer running Microsoft SQL Server. This computer must be located on the same internal network segment as the computer running Microsoft Proxy Server.

  2. Enter the correct URL to retrieve and load the form-based tool page in your browser. For example, if the server name for your Microsoft Proxy Server computer were Myproxyserver, you would type the URL as http://myproxyserver/scripts/tools/mkplog.exe.

  3. Follow the on-screen instructions.

Note Mkplog.exe will work only for Microsoft SQL Server databases. Microsoft® Access tables must be created manually for use with logging.

To Top Microsoft SQL Server Table Format

For a Microsoft SQL Server database table to be used for the WinSock Proxy or Web Proxy service log, refer to the following table when defining the required fields and data types.

SQL Table Structure

Field name | Data type | Length
ClientIP | varchar | 50
ClientUserName | varchar | 50
ClientAgent | varchar | 100
ClientAuthenticate | char | 5
logTime | datetime | —
service | varchar | 25
servername | varchar | 50
referredserver | varchar | 100
DestHost | varchar | 255
DestHostIP | varchar | 50
DestHostPort | int | —
processingtime | int | —
bytessent | int | —
bytesrecvd | int | —
protocol | varchar | 25
transport | varchar | 25
operation | varchar | 255
uri | varchar | 255
mimetype | varchar | 25
objectsource | varchar | 25
resultcode | int | —

To Top Microsoft Access Table Format

For a Microsoft Access database table to be used for the WinSock Proxy or Web Proxy service log, refer to the following table when defining the required fields and data types.

Microsoft Access Table Structure

Field name | Data type | Length
ClientIP | text | 50
ClientUserName | text | 50
ClientAgent | text | 100
ClientAuthenticate | text | 5
logTime | datetime | —
service | text | 25
servername | text | 50
referredserver | text | 100
DestHost | text | 255
DestHostIP | text | 50
DestHostPort | Long Integer | —
processingtime | Long Integer | —
bytessent | Long Integer | —
bytesrecvd | Long Integer | —
protocol | text | 25
transport | text | 25
operation | text | 255
uri | text | 255
mimetype | text | 25
objectsource | text | 25
resultcode | Long Integer | —

To Top Configuring the Service to Log to a Database

To enable the service to log to a database

  1. From Internet Service Manager, double-click the computer name next to the WinSock Proxy or Web Proxy service, then click the Logging tab.

  2. Select the Enable Logging check box.

  3. Select either Regular Logging (to record only a subset of the available information) or Verbose Logging (to record all available information).

  4. Select Log to SQL/ODBC Database.

  5. In the ODBC Data Source Name (DSN) box, type the exact system DSN that you created for the database that you will be logging to.

  6. In the Table field, type the name of the table that you will be logging to.

  7. In the User Name and Password fields, type a user name and password that is valid for that database and table.

  8. Click Apply, then click OK.

For more information about the Web Proxy and WinSock Proxy service logs, see “Configuring the Web Proxy service,” and “Configuring the WinSock Proxy Service.” For more information about Event Viewer and the Application and System logs, see your documentation for Windows NT.

To Top Log Fields

Log Field Summary
 Client Information Fields
 Server Information Fields
 Connection Information Fields
 Object Information Fields

To Top Log Field Summary

The Web Proxy and WinSock Proxy service logs contain information related to the following areas:

  • Client Information
  • Server Information
  • Connection Information
  • Object Information

When verbose logging is selected, the following fields appear in log entries:

  • Client Computer Name
  • Client User Name
  • Client Agent
  • Client Platform
  • Authentication Status
  • Log Date
  • Log Time
  • Service Name
  • Proxy Name
  • Referring Server Name
  • Destination Name
  • Destination Address
  • Destination Port
  • Processing Time
  • Bytes Sent
  • Bytes Received
  • Protocol Name
  • Transport
  • Operation
  • Object Name
  • Object MIME
  • Object Source
  • Result Code

When regular logging is selected, only the following elements appear in log entries:

  • Client Computer Name
  • Client User Name
  • Authentication Status
  • Log Date
  • Log Time
  • Service Name
  • Destination Name
  • Destination Port
  • Protocol Name
  • Object Name
  • Object Source
  • Result Code

To Top Client Information Fields

Client Computer Name

Typically, this is the network IP address for the client computer initiating a Web Proxy or WinSock Proxy request. In cases where active caching is occurring, this field is the IP address for the computer running Microsoft Proxy Server.

Client User Name

The Windows NT logon account name for the current user on the client computer initiating the Web Proxy or WinSock Proxy request.

Client Agent

  • For the Web Proxy service, indicates specialized header information from the client browser to use when processing the proxy request.
  • For the WinSock Proxy service, indicates the name of the client application that is generating the Windows Socket process request.

Client Platform

  • For the Web Proxy service, this field is not used.
  • For the WinSock Proxy service, indicates the client operating system, as shown in the following table:
Field Entry | Client Operating System
0:3.1 | Windows 3.1
0:3.11 | Windows for Workgroups
0:3.95 | Windows 95 (16-bit)
1:3.11 | Win32s
2:4.0 | Windows 95 (32-bit)
3:3.51 | Windows NT 3.51
3:4.0 | Windows NT 4.0

Authentication Status

This indicates whether or not the Web Proxy or WinSock Proxy request is using an authenticated connection to the Microsoft Proxy Server.

To Top Server Information Fields

Log Date

The date on Microsoft Proxy Server when the logged event occurred.

Log Time

The time on Microsoft Proxy Server when the logged event occurred.

Service Name

The name of the active service being logged. In verbose logging, “W3Proxy” indicates Web Proxy service logging, or “WSProxy” indicates WinSock Proxy service logging.

In regular logging, this field uses numbers. A value of “1” indicates Web Proxy service logging; a value of “2” indicates WinSock Proxy service logging.

Proxy Name

The name of the computer running Microsoft Proxy Server. This is the name assigned in Windows NT 4.0 Server for the computer.

Referring Server Name

The name of a downstream Microsoft Proxy Server that referred the proxy request to the current Microsoft Proxy Server. This field is not used in the current version of Microsoft Proxy Server and is reserved for later versions which will include support for cascading (multiple) proxy servers.

To Top Connection Information Fields

Destination Name

The domain name for the remote computer servicing the current Web Proxy or WinSock Proxy connection. For Web Proxy service, a hyphen (-) in this field may indicate that an object was sourced from the Web Proxy Server cache and not from the destination. (One exception is negative caching. In that case, this field will indicate a destination name for which a negative cached object was returned.)

Destination Address

The network IP address for the remote computer servicing the current Web Proxy or WinSock Proxy connection. For Web Proxy service, a hyphen (-) in this field may indicate that an object was sourced from the Web Proxy Server cache and not from the destination. (One exception is negative caching. In that case, this field will indicate a destination IP address for which a negative cached object was returned.)

Destination Port

The reserved port number on the remote computer servicing the current Web Proxy or WinSock Proxy connection. This is used by the client application initiating the request.

Processing Time

This indicates the total time in milliseconds needed by Microsoft Proxy Server to process the current Web Proxy or WinSock Proxy connection. It measures elapsed server time from when the server first received the request to the time when final processing occurred on the server (results were returned to client and connection closed).

Note For cache requests processed through the Web Proxy service, processing time measures the elapsed server time needed to fully process a client request and return an object from the server’s cache to the client.

Bytes Sent

For the Web Proxy service, the number of bytes sent to the remote computer during the current connection. The use of a hyphen (-) or the use of a zero or negative number in this field indicates that this information was not provided by the remote computer, or that no bytes were sent to the remote computer.

The WinSock Proxy service does not enter data in this field.

Bytes Received

For the Web Proxy service, the number of bytes received from the remote computer during the current connection. The use of a hyphen (-) or the use of a zero or negative number in this field indicates that this information was not provided by the remote computer, or that no bytes were received from the remote computer.

The WinSock Proxy service does not enter data in this field.

Protocol Name

  • For the Web Proxy service, specifies the protocol used for transfer (such as HTTP, FTP, or Gopher).
  • For the WinSock Proxy service, specifies a well-known destination port number for the socketed application (such as port 1070 for RealAudio).

Transport

  • For the Web Proxy Service, specifies the transport protocol. For the Web Proxy service, this is always TCP.
  • For the WinSock Proxy service, specifies the transport protocol. For the WinSock Proxy service, this can be TCP, UDP, or IPX/SPX.

Operation

  • For the Web Proxy service, specifies the current HTTP method used. Possible values can include GET, PUT, POST, and HEAD.
  • For the WinSock Proxy service, specifies the current socket API call in use. Possible values can include Connect, Accept, SendTo, RecvFrom, GetHostByName.

To Top Object Information Fields

Object Name

  • For the Web Proxy service, this field shows the contents of the URL request.
  • For the WinSock Proxy service, this field is not used.

Object MIME

  • For the Web Proxy service, the Multi-purpose Internet Mail Extensions (MIME) type for the current object. The following table provides a partial listing of MIME types supported by most Web browsers. This field may also be filled with a hyphen (-) to indicate that this field is not used, or that a valid MIME type was not defined or supported by the remote computer.
MIME Type | Description
application/x-msdownload | Application (executable).
image/gif | GIF image file.
image/jpeg | JPEG image file.
multipart/x-zip | PKZIP archive file.
text/plain | Plain text file.
  • For the WinSock Proxy service, this field is not used.

Object Source

  • For the Web Proxy service, indicates the source used to retrieve the current object, as shown in the following table:
Source Values | Source
Unknown | No source information available.
Cache | Source is cache. Object returned from cache.
RCache | Source is Internet. Object added to cache.
VCache | Source is cache. Object was verified to source and passed.
NVCache | Source is cache. Object could not be verified to source.
VFInet | Source is Internet. Cached object was verified to source and failed.
PragNoCacheInet | Source is Internet. HTTP header field indicated “Do not cache.”
Inet | Source is Internet. Object not cached.
  • For the WinSock Proxy service, this field is not used.

Result Code

For the Web Proxy service, this field can be used to indicate either a Windows error code (for values less than 100), an HTTP status code (values between 100 and 1000), or a Wininet or WinSock error code value (for values over 10000). A partial listing of some of the supported values for this field is listed below. For more information on other values, contact your technical support provider or see Microsoft TechNet for more information on specific values not listed here.

Values | Description
200 | Successful connection
10060 | Connection timed out.
10061 | Connection refused by destination.
10065 | Host unreachable.
11001 | Host not found.

For the WinSock Proxy service, this field indicates status information about the connection as shown in the following table:

Source Values | Source
0 | Successful connection.
1 | Server failure.
2 | Rejection by proxy (filtering).
3 | Network unreachable (no DNS service available).
4 | Host unreachable (no DNS entry for host).
5 | Connection refused by destination.
6 | Unsupported client request.
7 | Unsupported address type.

To Top Logging Issues

In most cases, normal event logging for Web Proxy or WinSock Proxy services will not cause serious problems for Microsoft Proxy Server service performance.

Problems that can result from logging are most likely to be caused by filling up a disk drive that is being used for both logging and caching. For this reason, it is recommended that you monitor available disk space and service-log file size on a regular basis. This is particularly important if you are using a single disk drive for storing cache files and log files.

If a hard disk on the server becomes full, the Web Proxy and WinSock Proxy services will continue to operate, but logging may be affected for both services, and caching may be affected for the Web Proxy service. If all disks configured to store the logs are full, the services will continue to run but no new log entries will be saved.

Important Running Microsoft Proxy Server without logging should be considered a nonsecure condition.

If all disks configured to store the cache become full, the Web Proxy service can stop functioning, and will return error 112 (disk full) for many queries. To help prevent the disk from filling up, it is a good idea to store the logs and the cache on different volumes.

To Top Windows NT Logs

Microsoft Proxy Server uses the Windows NT system log to register events for active services. When a service event is logged, each log entry lists a source name to indicate the service that logged the event to the system log. This information can be useful when monitoring server performance or troubleshooting problems with the server.

The following table lists event log source names and the services that correspond to each source name.

Source Name | Description
WebProxyServer | Web Proxy service events
WebProxyLog | Web Proxy logging events
WebProxyCache | Web Proxy caching events
WinSockProxy | WinSock Proxy service events
WinSockProxyLog | WinSock Proxy logging events
MSProxyAdmin | Microsoft Proxy Server administrative events

To view event messages from Event Viewer

  1. From the Start menu, select Programs. Then, select Administrative Tools and click Event Viewer.

  2. From the Log menu, select System for the current view.

  3. To view source details about a message or a description of the message, select a message from the event listing and double-click it.

    The Event Detail window for the selected message appears.

For information about individual messages logged to the Windows NT system log, see Appendix H, “Setup Messages,” Appendix I, “Web Proxy Messages,” and Appendix J, “WinSock Proxy Messages.” For more information about using Event Viewer, see your documentation provided for Windows NT Server or refer to the online Help.

To Top Performance Monitor Counters

Using Performance Monitor
Microsoft Proxy Server Counters

To Top Using Performance Monitor

Windows NT includes a tool called Performance Monitor for tracking computer performance. When you monitor a system, you actually monitor the behavior of its parts. A set of counters exists for the processor, memory, cache, hard disk, processes, and other parts that produce statistical information. Certain counters are standard; others are configured or added with the installation of new software.

When Microsoft Proxy Server is installed on a new installation of Windows NT Server, three additional Performance Monitor objects are created.

  • Web Proxy Server Cache This object type includes counters specific to URL caching performed by the Web Proxy service.

  • Web Proxy Server Service This object type includes counters specific to the Web Proxy Server service.

  • WinSock Proxy Server This object type includes counters specific to the WinSock Proxy Server service.

You do not need special privileges to open Performance Monitor. However, you do need to be logged on as a member of the Administrators group to use the diskperf command. For performance monitoring of Microsoft Proxy Server, you can select counters directly in Performance Monitor. There is also a Start menu option for quick access to WinSock Proxy performance monitoring.

Note Activating object counters for performance monitoring can increase disk access time.

To monitor Microsoft Proxy Server performance

  1. From the desktop, click Start.

  2. Select Programs, and then select the Microsoft Proxy Server program group.

  3. Click Monitor Microsoft Proxy Server Performance.

    Performance Monitor starts, and loads a set of Microsoft Proxy Server counters.

To start Performance Monitor without loading Proxy Server counters

  1. From the desktop, click Start.
  2. Select Programs, then select the Administrative Tools program group.
  3. Click Performance Monitor.

To view counters

  1. From the File menu, click New Chart.

  2. From the Edit menu, click Add to Chart.

    The Add to Chart dialog box appears.

  3. Select an object from the Object list. For example, you might select WinSock Proxy Server.

    The counters for that object appear in the Counter list.

  4. Select a counter from the Counter list.

  5. Click Add.

  6. Repeat steps 3, 4, and 5 to add additional counters.

  7. When all counters have been added, click Done.

    The Performance Monitor window returns. Information from the selected counters is displayed.

For more information about using Performance Monitor, see its online Help. Also see your documentation for Windows NT.

The diskperf command turns the counters for disk activity on and off. Diskperf works for a local or a remote computer. After restarting the computer, you can use Performance Monitor to view disk performance data.

To activate the physical and logical disk counters

  1. Log on as a member of the Administrators group.

  2. At the command prompt, type diskperf to view Help information on how to turn diskperf on and off and how to specify a remote computer’s name.

  3. Follow the instructions to turn diskperf on or off.

  4. To activate the disk performance counters, reboot the server.

To Top Microsoft Proxy Server Counters

About the Microsoft Proxy Server Objects
Web Proxy Server Cache Counters
Web Proxy Server Service Counters
WinSock Proxy Server Counters

To Top About the Microsoft Proxy Server Objects

When Microsoft Proxy Server is installed, the following objects are installed into Performance Monitor: Web Proxy Server Cache, Web Proxy Server Service, and WinSock Proxy Server. These three Performance Monitor objects contain all additional performance counters that are added for monitoring Microsoft Proxy Server.

Statistics from each Microsoft Proxy Server counters can be displayed in the Performance Monitor window and added to charts, logs, or reports created for service monitoring.

Also, you can set system alerts for any specific counters. By setting alerts, you can choose to have any of the following responses occur when a counter reaches a predefined limit.

  • The active monitoring view for Performance Monitor changes to the Alert view and the Alert window displays information about the reason for the alert.
  • The event that caused the alert status is logged in the Application log of the Event Viewer.
  • An alert message is broadcast over the network by the server.

Note When the Web Proxy or WinSock Proxy services are stopped and restarted, most counter values are reset and previous counter data is cleared. Some Web Proxy Server Cache counter values for URLs or bytes stored in the cache are recalculated according to the persistent cache contents.

To Top Web Proxy Server Cache Counters

The counters in the Web Proxy Server Cache object include counters specific to URL caching performed by the Web Proxy service. The following list describes those counters.

  • Active Refresh Bytes Rate The number of bytes of data per second retrieved from the Internet to proactively refresh popular URLs in the URL cache.

  • Active URL Refresh Rate The number of popular URLs per second that are preemptively refreshed in the URL cache from remote URL sources on the Internet.

  • Bytes Committed Rate The number of bytes of data per second committed to disk storage in the URL cache

  • Bytes in Cache The total number of bytes currently contained in the URL cache (stored on disk).

  • Bytes Retrieved Rate The number of bytes of data per second retrieved from disk storage in the URL cache.

  • Max Bytes Cached The maximum number of bytes that have been stored in the URL cache.

  • Max URLs Cached The maximum number of URLs that have been stored in the URL cache.

  • Total Actively Refreshed URLs The cumulative number of popular URLs in the URL cache that have been preemptively refreshed from the Internet.

  • Total Bytes Actively Refreshed The cumulative number of bytes retrieved from the Internet to preemptively refresh popular URLs in the URL cache.

  • Total Bytes Cached The cumulative number of bytes that have been stored in the URL cache.

  • Total Bytes Retrieved The cumulative number of bytes that have been retrieved from the URL cache.

  • Total URLs Cached The cumulative number of URLs that have been stored in the URL cache.

  • Total URLs Retrieved The cumulative number of URLs that have been retrieved from the URL cache.

  • URL Commit Rate The number of URLs per second committed to the URL cache.

  • URL Retrieve Rate The number of URLs per second retrieved from the URL cache.

  • URLs in Cache The current number of URLs in the URL cache.

To Top Web Proxy Server Service Counters

The counters in the Web Proxy Server Service object include counters specific to the Web Proxy service. The following list describes those counters.

  • Cache Hit Ratio (%) The percentage of requests that have been served by using cached data, out of the total number of requests to Web Proxy Server.

  • Client Bytes Received/sec The rate at which data bytes are received by Web Proxy Server from Web Proxy clients.

  • Client Bytes Sent/sec The rate at which data bytes are sent by Web Proxy Server to the Web Proxy clients.

  • Client Bytes Total/sec The sum of Client Bytes Sent/sec and Client Bytes Received/sec. This is the total rate of all bytes transferred between Web Proxy Server and Web Proxy clients.

  • Current Users The number of users currently connected to Web Proxy Server.

  • DNS Cache Entries The current number of DNS domain name entries cached by Web Proxy Server.

  • DNS Cache Flushes The total number of times that the DNS domain name cache has been flushed or cleared by Web Proxy Server.

  • DNS Cache Hits The total number of times a DNS domain name was found within the DNS cache.

  • DNS Cache Hits (%) The percentage of DNS domain names served by the Web Proxy Server cache, out of the total of all DNS entries that have been retrieved by Web Proxy Server.

  • DNS Cache Retrievals The total number of DNS domain names that have been retrieved by Web Proxy Server.

  • FTP Requests The number of FTP requests that have been made to Web Proxy Server.

  • Gopher Requests The number of Gopher requests that have been made to Web Proxy Server.

  • HTTP Requests The number of HTTP requests that have been made to Web Proxy Server.

  • HTTPS sessions The total number of secure HTTP sessions serviced by the Secure Sockets Layer (SSL) tunnel.

  • Inet Bytes Received/sec The rate at which data bytes are received by Web Proxy Server from remote servers on the Internet.

  • Inet Bytes Sent/sec The rate at which data bytes are sent by Web Proxy Server to remote servers on the Internet.

  • Inet Bytes Total/sec The sum of Inet Bytes Sent/sec and Inet Bytes Received/sec. This is the total rate for all bytes transferred between Web Proxy Server and servers on the Internet.

  • Maximum Users The maximum number of users that have connected to Web Proxy Server simultaneously.

  • Sites Denied The total number of Internet sites to which Web Proxy Server has denied access.

  • Sites Granted The total number of Internet sites to which Web Proxy Server has granted access.

  • SNEWS Sessions The total number of SNEWS sessions serviced by the Secure Sockets Layer (SSL) tunnel.

  • SSL Client Bytes Received/sec The rate at which that Secure Sockets Layer (SSL) data bytes are received by Web Proxy Server from secured Web Proxy clients.

  • SSL Client Bytes Sent/sec The rate at which Secure Sockets Layer (SSL) data bytes are sent by Proxy Server to secured Web Proxy clients.

  • SSL Client Bytes Total/sec The sum of SSL Client Bytes Sent/sec and SSL Client Bytes Received/sec. This is the total rate for all bytes transferred between Web Proxy Server and secured Web Proxy clients.

  • SSL Sessions Scavenged The number of Secure Sockets Layer (SSL) sessions closed because of idle timeout and excessive SSL demand.

  • Thread Pool Active Sessions The number of sessions being actively serviced by thread pool threads.

  • Thread Pool Failures The number of requests rejected because the thread pool was overcommitted.

  • Thread Pool Size The number of threads in the thread pool.

  • Total Cache Fetches The total number of requests that have been served by using cached data from Web Proxy Server cache.

  • Total Failing Requests The total number of Internet service requests that have failed to be processed by Web Proxy Server due to errors. Errors can be the result of Web Proxy Server failing to locate a requested server URL on the Internet, or because of the client being denied access to the requested URL.

  • Total Internet Fetches The total number of requests that have been served by using data retrieved from servers on the Internet.

  • Total Requests The total number of Internet requests that have ever been made to Web Proxy Server.

  • Total SSL Sessions The total number of Secure Sockets Layer (SSL) sessions serviced by the SSL tunnel.

  • Total Successful Requests The total number of Internet requests that have been successfully processed by Web Proxy Server.

  • Total Users The total number of users that have ever connected to Web Proxy Server.

  • Unknown SSL Sessions The total number of unknown Secure Sockets Layer (SSL) sessions serviced by the SSL tunnel.

To Top WinSock Proxy Server Counters

The counters in the WinSock Proxy Server object provide statistics about the WinSock Proxy service. The following list describes those counters.

  • Accepting TCP Connections The number of connection objects that wait for TCP connection from the client after a successful remote connection.

  • Active Sessions The number of active sessions.

  • Active TCP Connections The number of active TCP connections.

  • Active UDP Connections Total number of active UDP connections.

  • Available Control Worker Threads The number of control channel worker threads that are available or waiting in the completion port queue.

  • Available Data Worker Threads The number of data-pump worker threads that are available or waiting in the completion port queue.

  • Back-Connecting TCP Connections Total number of connections that are waiting for an inbound connect () call to finish. These are connections from the WinSock Proxy service to a client after the WinSock Proxy service accepted a connection from the Internet on a listening socket.

  • Bytes Read/sec Number of bytes read by the data-pump per second.

  • Bytes Written/sec Number of bytes written by the data-pump per second.

  • Connecting TCP Connections Total number of connections that are waiting for a remote connect() call to finish.

  • Control Worker Threads The number of control channel worker threads that are alive.

  • Data Worker Threads The number of data-pump worker threads that are alive.

  • Failed GetXByY Number of calls to gethostname/gethostbyaddr that have failed.

  • Listening TCP Connections Number of connection objects that wait for TCP connections from the Internet (after a successful listen).

  • Non-connected UDP mappings The number of mappings for UDP connections.

  • Pending GetXByY Number of calls to gethostname/gethostbyaddr that have not yet returned

  • Successful GetXByY Number of calls to gethostname/gethostbyaddr that have returned successfully.

To Top SNMP MIBs

If you monitor your network using Simple Network Management Protocol (SNMP) software, you can use the SNMP Management Information Base (MIB) files provided with Microsoft Proxy server to enable SNMP monitoring of the Web Proxy and WinSock Proxy services.

The MIB file for Web Proxy service monitoring is W3p.mib. The MIB file for WinSock Proxy Service monitoring is Wsp.mib. These files are not installed on the server by the Setup program. They are on the Microsoft Proxy Server compact disc, and can be copied from the Perfctrs directory in the appropriate processor architecture directory (Alpha\Perfctrs for Alpha AXP, I386\Perfctrs for Intel, Mips\Perfctrs for MIPS, and Ppc\Perfctrs for PowerPC). Be sure to use the correct MIB file for the server’s processor architecture.

To use these MIB files with the Windows NT SNMP service, you must first compile them by using the MIB compiler that comes with your SNMP software. If you are using the Microsoft Software Development Kit (SDK), you can use the MIB compiler tool, Mibcc.exe, which is included to compile MIB files. For more information on compiling MIB files with this tool, see your Microsoft SDK documentation. For other MIB compiling tools, see the documentation for the product.

The SNMP service uses Object Identifiers (OIDs) for MIB processing. The OID for the W3p.mib is 11. The OID for the Wsp.mib is 12.

In addition to compiling the MIB files, you must also start the Web Proxy service and the WinSock Proxy service before configuring and starting the Windows NT SNMP service on the computer running Microsoft Proxy Server. Once the SNMP service has been started on both the remote SNMP monitoring computer and the local Microsoft Proxy Server computer, you can use your SNMP monitoring software to monitor Microsoft Proxy Server services.

Note Using SNMP on a gateway that is not secure can expose network routing information to unauthorized users.


Topic Not Found

No matching topic was found. Some possible reasons and remedies are as follows:

  • The file (.chm) that contains the destination topic is not in the expected location.

    Remedy: Rerun the MSDN Library Setup.

  • The file (.chm) that contains the current topic or destination topic is out-of-date and the link is no longer valid.

    Remedy: Install the latest version of the MSDN Library.

  • The MSDN Library CD is not in the CD-ROM drive.

    Remedy: Insert the MSDN Library CD into the CD-ROM drive.


Appendix A, Registry Entries

Appendix A

Registry Entries

Registry Editor
Reading Hexadecimal Key Values
Microsoft Proxy Server Registry Entries

Microsoft Proxy Server services are configured using the Microsoft Proxy Server Setup program and Internet Service Manager.

All configuration values for Windows NT are stored in a database known as the registry. You can optionally use the Registry Editor (Regedt32.exe) to view, modify, or change these values directly.

Warning Do not use Regedt32.exe as a substitute for Internet Service Manager. Values changed with Regedt32.exe will not be updated directly. You must stop and start the service to have them take effect. Changes made by using Internet Service Manager take effect immediately.

To Top Registry Editor

The Registry Editor is an advanced tool that you can use to change settings in your system registry, which contains information about how your computer runs.

In most cases, the default settings for Microsoft Proxy Server registry values that are made during setup will be acceptable for most installations. Where a value can be modified, a recommended range of values has been offered. In some cases, you may be able to specify a value beyond what is recommended, but such attempts should be undertaken with caution.

If you decide to change registry values for any of the following registry keys, try to observe good administrative practices for doing so. Use the following guidelines to help in implementing your changes:

  • Use Internet Service Manager if possible.

    Use the administrative tools in Internet Service Manager whenever possible. Edit registry values directly by using the Registry Editor only when it is not possible to set a value by using the Internet Service Manager.

  • Limit the number of changes made at one time.

    When you make changes to some values in the registry, the effects can be dynamic. In some cases, a single value can interact with other values to create a larger total effect on service performance. If you are not certain about the effects of a specific value you are changing, be conservative in altering the current value. If you alter values beyond the recommended ranges, you should restart the service and monitor the effects closely before making any further changes.

Warning You should not edit your registry unless it is absolutely necessary. Generally, it is best to use Windows controls to change your system settings. If you introduce an error in your registry, your computer may become nonfunctional.

To start the registry editor

  1. Open an MS-DOS® command-prompt window.
  2. Type regedt32.

The registry is organized as a directory tree. Registry entries are called keys and can contain values. Keys can be added, modified, or deleted by applications. Each value has a class, or data type.

For more information about editing the registry, see the online Help for Registry Editor, or see your documentation for Windows NT.

If you make changes to the registry that cause your computer to stop working properly, you can restore the registry settings to the last working configuration.

To restore the registry

  1. Use the Start button to shut down your computer.

  2. Restart in MS-DOS mode.

  3. Change to your Windows NT directory system directory, Winnt.

  4. Type the following commands:

    attrib -h -r -s system.dat
    attrib -h -r -s system.da0
    copy system.da0 system.dat
    attrib -h -r -s user.dat
    attrib -h -r -s user.da0
    copy user.da0 user.dat

  5. Restart your computer.

To Top Reading Hexadecimal Key Values

Numeric values and ranges listed in the following tables are expressed exactly as they appear in the registry. For some values that use the REG_DWORD data type, values can be expressed in either hexadecimal or binary form. For cases where the defined value represents a hexadecimal numeric, (h) is used to indicate that these are stated as hexadecimal values.

The following table shows an example of a default value and range of values expressed in hexadecimal notation:

Default | Range
384(h) | 384-E10(h)

Converting these same numbers to decimal equivalent values would indicate the following values :

Default | Range
900 | 900-3600

Its important to keep these differences in mind when you apply changes. To assist you in applying changes to hexadecimal-stated key entries or interpreting the current values, you can use a scientific calculator, such as the Calculator application (Calc.exe) to make conversions between hexadecimal and decimal values where appropriate.

If you use Calculator, you will need to select View and click Scientific so that you can enter numbers in either hexadecimal or decimal format and then click the button to convert the numbers to either of these formats.

You can also select DWORD from the Edit menu in Registry Editor and click the buttons to change your view of a specific key value to binary, hexadecimal, or decimal notation. This can be useful when you are directly editing key values in the registry.

To Top Microsoft Proxy Server Registry Entries

Domain Filtering Keys
Web Proxy Service Keys
Cache Keys
 WinSock Proxy Service Keys
Other Keys Added for Microsoft Proxy Server

All default values are set during installation. Entries for Microsoft Proxy Server services are located in the following tree branches:

To Top Domain Filtering Keys

The Microsoft Proxy Server domain filtering registry values are located in:

HKEY_LOCAL_MACHINE
  SYSTEM
     \CurrentControlSet
        \Services
            \W3Proxy
               \Parameters
                  \DoFilter

These filters apply to both WinSock Proxy and Web Proxy. The following values are available:

FilterType
NumDenySites
NumGrantSites

FilterType
DataType: REG_DWORD
Range: 0-2
Default: 0
Description: 0=Domain filtering is not enabled.
1=Denied mode. Internet access is granted to all sites except to those in the domain filter list.
2=Granted mode. Internet access is denied to all sites except to those in the domain filter list.
NumDenySites
DataType: REG_DWORD
Range: No limit to value.
Default: 0
Description: The total number of Web sites to which Microsoft Proxy Server users have been denied entry.
NumGrantSites
DataType: REG_DWORD
Range: No limit to value.
Default: 0
Description: The total number of Web sites to which Microsoft Proxy Server users have been granted entry.

Examples of Domain Filtering

Domain filtering can be applied to either grant or deny access to all Internet sites by default, with specified site exceptions added individually.

Denying Access to Specified Sites

As an example, suppose you want to use Internet Service Manager to set a filter to deny access to two sites. The sites are Website1, whose domain is www.website1.com, and Website2, whose domain is www.website2.com.

You would first set the Filters property to Enable Filtering and the default access to Granted. For each site, you select Add and enter each site (www.website1.com, for example) you want to restrict access to by using the Deny Access To dialog box.

The registry would then be reconfigured as follows: FilterType is set to 1, the NumDenySites is set to 2, and a new subkey is created called DenySites. DenySites would be set to www.website1.com www.website2.com.

Granting Access for Specified Sites

In this example, suppose you want to use Internet Service Manager to set a filter to grant access only to a single specified site. The site is Website3, whose domain is www.website3.com.

You would first set the Filters property to Enable Filtering and the default access to Denied. This will deny access to all Internet sites except those sites which you choose to specifically allow access to. You can then grant Internet access to a single site, Website3, by clicking Add and typing www.website3.com in the Grant Access To dialog box.

The registry would then be reconfigured as follows: Filter Type is set to 2, the NumGrantSites is set to 1, and a new subkey called GrantSites is created. GrantSites would be set to www.website3.com.

To Top Web Proxy Service Keys

The Web Proxy service registry values are located in:

HKEY_LOCAL_MACHINE
  SYSTEM
     \CurrentControlSet
        \Services
            \W3Proxy
               \Parameters

The following values are available:

AllowInternetHttpRequests | LogFileDirectory | MaxFtpThreadsFactor
ConnectCacheSize | LogFilePeriod | RequestTimeoutSecs
ConnectCacheTimeoutInSecs | LogFileTruncateSize | RpcBindings
DebugFlags | LogFileType | ServerComment
DnsCacheSize | LogSqlDataSources | SmallLogFormat
DnsTTLInSecs | LogSqlPassword | SocketIoTimeoutSecs
EnableAccessControl | LogSqlTableName | SSLPortListInclusion
EnableDiskCache | LogSqlUserName | SSLPortListMembers
EnableSvcLoc | LogType |
AllowInternetHttpRequests
DataType: REG_DWORD
Range: 0,1
Default: 0
Description: Determines whether an HTTP request from the Internet to Microsoft Proxy Server is allowed. A value of 0 indicates that requests are not allowed. A value of 1 will allow HTTP requests from the Internet.
ConnectCacheSize
DataType: REG_DWORD
Range: 1-500(h)
Default: 20(h)
Description: Specifies the number of allowable connections that can be cached at the same time.
ConnectCacheTimeoutInSecs
DataType: REG_DWORD
Range: 384-E10(h)
Default: 384(h)
Description: Specifies the number of seconds a connection object will be cached. The default is for 900 seconds (15 minutes).
DebugFlags
DataType: REG_DWORD
Range: Predefined values
Default: 0
Description: Sets the level of detail for debug reporting. Default is for minimal detail in reporting.
DnsCacheSize
DataType: REG_DWORD
Range: 12c-7530(h)
Default: bb8(h)
Description: Sets the size in bytes to reserve for DNS domain name caching. The default is equal to 3000 bytes.
DnsTTLInSecs
DataType: REG_DWORD
Range: e10-8ca0(h)
Default: 5460(h)
Description: Sets the default TTL value in seconds for expiration of cached DNS domain names. The default is equal to 21,600 seconds (or 24 hours).
EnableAccessControl
DataType: REG_DWORD
Range: 0,1
Default: 1
Description: 0 = Disables Web Proxy permission checking.
1 = Enables Web Proxy permission checking (subject to the WWW service of Microsoft Internet Information Server being set to allow basic or Windows NT Challenge/Response authentication).
EnableDiskCache
DataType: REG_DWORD
Range: 0,1
Default: 1
Description: 0 = Disables disk caching.
1 = Enables disk caching.
EnableSvcLoc
DataType: REG_DWORD
Range: 0,1
Default: 1
Description: Specifies whether to enable a service location (a remote computer running Microsoft Proxy Server) for administration through Internet Service Manager on the current server.
0 = Disables service.
1 = Enables service.
LogFileDirectory
DataType: REG_SZ
Range: text
Default: C:\Winnt\system32\w3plogs
Description: Specifies the installed directory path to be used for Web Proxy logging.
LogFilePeriod
DataType: REG_DWORD
Range: 0-3
Default: 1
Description: 0 = Do not open new logs.
1 = Open new log files daily.
2 = Open new log files weekly.
3 = Open new log files monthly.
LogFileTruncateSize
DataType: REG_DWORD
Range: 1-ffffffff(h)
Default: ffffffff(h)
Description: Specifies the maximum file length (in megabytes) for log file retention. The default is set to 4,000 megabytes (4 gigabytes).
LogFileType
DataType: REG_DWORD
Range: 1,2
Default: 2
Description: 1 = Log to a text file.
2 = Log to an SQL/ODBC database file.
LogSqlDataSources
DataType: REG_SZ
Range: text
Default: Proxy Server SQL
Description: Specifies the data source name to be used when logging Microsoft Proxy Server error messages to an SQL database.
LogSqlPassword
DataType: REG_SZ
Range: text
Default: (none)
Description: Specifies the password to use when accessing an SQL database for Microsoft Proxy Server error message logging.
LogSqlTableName
DataType: REG_SZ
Range: text
Default: MspSrvLog
Description: Specifies the name of the table to be used for Microsoft Proxy Server error message logging to an SQL database.
LogSqlUserName
DataType: REG_SZ
Range: text
Default: sa
Description: Specifies the user name to use when accessing an SQL database for Microsoft Proxy Server error message logging.
LogType
DataType: REG_DWORD
Range: 0,1
Default: 1
Description: 0 = Logging is disabled.
1 = Logging is enabled.
MaxFtpThreadsFactor
DataType: REG_DWORD
Range: 8-24(h)
Default: 8(h)
Description: Sets a proposed maximum number of threads to be used for handling FTP requests. The actual maximum number of threads will depend on various hardware-related factors (memory size, number of CPUs, and so on).
RequestTimeoutSecs
DataType: REG_DWORD
Range: 10-1000(h)
Default: 3c(h)
Description: The number of seconds after which a client request times out. The default is 60 seconds.
RpcBindings
DataType: REG_DWORD
Range: 0-7
Default: 7
Description: Sets protocol bindings for remote procedure calls. For specific instructions on setting this value, see Setting RPC Bindings .
ServerComment
DataType: REG_SZ
Range: text
Default: (none)
Description: This entry contains remarks added in the Comment field for Web Proxy Service properties.
SmallLogFormat
DataType:
Range: 0,1
Default: 1
Description: 0 = Use verbose logging.
1 = Use small log format.
SocketIoTimeoutSecs
DataType: REG_DWORD
Range: 0-78(h)
Default: 78(h)
Description: The number of seconds after which pending network accesses time out. The default is 120 seconds.
SSLPortListInclusion
DataType: REG_DWORD
Range: 0,1
Default: 1
Description: Indicates whether the member listing of Secure Sockets Layer (SSL) ports is to be an inclusive listing or an exclusive listing. A value of 1 indicates member ports defined are to be included for service. A value of 0 indicates that member ports defined are to be excluded for service.
SSLPortListMembers
DataType: REG_MULTI_SZ
Range: Must indicate two pairs of port numbers—a low pair and a high pair—to include or exclude from member port list.
Default: 443 443 563 563
Description: In the default settings, there are two ranges: 443 to 443, and 563 to 563. The first pair is the low port-number range that can be included or excluded for Secure Sockets Layer (SSL) service. The second pair is the high port-number range that can be included or excluded.

To Top Setting RPC Bindings

The RpcBindings value uses a 3-bit submasking method to determine Remote Procedure Call (RPC) bindings for three supported protocols: TCP/IP, IPX/SPX, and NetBIOS. The use of a bit value 1 indicates that the protocol will be bound. The use of a bit value of 0 indicates the protocol will not be bound.

The following table shows corresponding decimal values for removing and adding bindings for each of the three supported protocols.

Registry Value | Protocol Bindings
0x0 | None
0x1 | TCP/IP only
0x2 | IPX/SPX only
0x3 | TCP/IP, IPX
0x4 | NetBIOS only
0x5 | TCP/IP, NetBIOS
0x6 | IPX, NetBIOS
0x7 | TCP/IP, IPX/SPX, NetBIOS

To Top Cache Keys

Cache Parameters
 Cache Path
 Cache Filters

To Top Cache Parameters

The Web Proxy Service cache registry values are located in:

HKEY_LOCAL_MACHINE
   SYSTEM
      \CurrentControlSet
          \Services
              \W3PCache
                 \Parameters

The following cache values are available:

ActiveRefreshAggressiveness | DebugFlag | Max Interval Value
Age Factor (%) | Enable Protect | Max. Protection Time (minutes)
CacheByDefault | Enable TTL | MaxObjectSize
CleanupFactor | EnableActiveCache | Min Interval (minutes)
CleanupInterval | FreshnessInterval | Persistent
CleanupTime | Max Interval Units | Protection Factor (%)
ActiveRefreshAggressiveness
DataType: REG_DWORD
Range: 0-12(h)
Default: 2(h)
Description: A larger number will refresh more items in the cache more often. This feature is enabled by default.
Age Factor (%)
DataType: REG_DWORD
Range: 0-64(h)
Default: 14(h)
Description: The percentage of life extension for a non-modified object. The default is 20 percent.
CacheByDefault
DataType: REG_DWORD
Range: 0,1
Default: 1
Description: When set to 0, can disable caching for all URLs except for those explicitly marked as cacheable in the URL Data section.
CleanupFactor
DataType: REG_DWORD
Range: 0-64(h)
Default: 19(h)
Description: The percentage of data to be cleaned up in each cache cleanup process. The default is 25 percent.
CleanupInterval
DataType: REG_DWORD
Range: 0-93a40(h)
Default: 15180(h)
Description: The interval size in seconds between each cache cleanup. The default setting is for every 86,400 seconds (24 hours).
CleanupTime
DataType: REG_DWORD
Range: 0-23
Default: 0
Description: Sets the hour of the day that cache cleanup is scheduled to occur. The default is to set cleanup to occur at 12:00 A.M.
DebugFlag
DataType: REG_DWORD
Range: predefined values
Default: 0
Description: Sets the level of detail for debug reporting. The default is for no debug reporting.
Enable Protect
DataType: REG_DWORD
Range: 0,1
Default: 1
Description: Enables or disables unavailable-server protection, allowing expired objects to be returned from the cache when the requested Internet server is unavailable.
Enable TTL
DataType: REG_DWORD
Range: 0,1
Default: 1
Description: Enables the TTL (Time-to-Live) mechanism.
EnableActiveCache
DataType: REG_DWORD
Range: 0,1
Default: 1
Description: Enables active caching.
FreshnessInterval
DataType: REG_DWORD
Range: 0-93a40(h)
Default: 15180(h)
Description: The number of seconds that an object is kept in the cache before being updated. The default setting is for every 86,400 seconds (24 hours).
Max Interval Units
DataType: REG_DWORD
Range: 0-4
Default: 4
Description: 0 = seconds.
1 = minutes.
2 = hours.
3 = day.
4 = week.
Max Interval Value
DataType: REG_DWORD
Range: 0-4096(h)
Default: 1(h)
Description: Establishes the maximum number of Max Interval Units an object will be cached.
Max. Protection Time (minutes)
DataType: REG_DWORD
Range: 0-2760(h)
Default: 3c(h)
Description: The maximum time in minutes to shadow a URL (serve the cached copy of an object obtained earlier from a currently unavailable server). The default is for 60 minutes.
MaxObjectSize
DataType: REG_DWORD
Range: 0-4096
Default: 0
Description: When set to 0, size is unlimited. For any other values, specifies maximum size in kilobytes for cache objects.
Min Interval (minutes)
DataType: REG_DWORD
Range: 0-5a0(h)
Default: f(h)
Description: The minimum number of minutes to wait before validating a cached URL to its source. The default is 15 minutes.
Persistent
DataType: REG_DWORD
Range: 0,1
Default: 1
Description: Determines whether cache contents will persist after Web Proxy service is stopped. A value of 0 will cause the cache to be cleared when the service is stopped.
Protection Factor (%)
DataType: REG_DWORD
Range: 0-64(h)
Default: 32(h)
Description: A factor for setting TTL to shadow an unavailable server. The default setting is for 50 percent.

To Top Cache Path

The registry entries for cache path are located in:

HKEY_LOCAL_MACHINE
   SYSTEM
      \CurrentControlSet
          \Services
              \W3PCache
                 \Parameters
                    \Paths

Under that path are keys for each cache directory. The default keys are Path1 through Path5 (for a volume). Within each cache directory key are the following values:

CacheLimit
CachePath

CacheLimit
DataType: REG_DWORD
Range: 0-4096(h)
Default: 14(h)
Description: Sets the size limit in megabytes for the cache folder path specified in CachePath. The default is for 20 megabytes.
CachePath
DataType: REG_SZ
Range: text
Default: C:\Urlcache\Dir1 (through Dir5)
Description: Specifies the installed cache folder path to be used on a designated cache drive.

To Top Cache Filters

The Web Proxy Service cache filtering entries are located in:

HKEY_LOCAL_MACHINE
   SYSTEM
      \CurrentControlSet
          \Services
              \W3PCache
                 \UrlData

There can be zero, one, or more values in this key, depending on whether cache filters have been configured (by either creating a registry entry or by using the Web Proxy property sheets in Internet Service Manager). Registry values entered in the UrlData key take the form:

URL:REG_SZ:x,y

where

URL is the URL that is filtered.

x is either 0 or 1. An entry of 0 indicates that the URL will not be cached, and 1 indicates that the URL will be cached.

y is a number setting the TTL. This is an optional value that can only be set by editing the registry.

For details on cache filtering and URL cache filter syntax, see “Configuring the Web Proxy Service.”

To Top WinSock Proxy Service Keys

The WinSock Proxy service registry values are located in:

HKEY_LOCAL_MACHINE
  SYSTEM
     \CurrentControlSet
        \Services
            \WSPSrv
               \Parameters

The following values are available:

Authentication | LogFileType | MappingQuota
ConnectionQuota | LogSqlDataSources | RoutingTable
InstallRoot | LogSqlPassword | SmallLogFormat
LogFileDirectory | LogSqlTableName | TcpBufferSize
LogFilePeriod | LogSqlUserName | UdpBufferSize
LogFileTruncateSize | LogType |
Authentication
DataType: REG_DWORD
Range: 0,1
Default: 1
Description: 0 = No authentication is used (everyone has unlimited access).
1 = Enables Windows NT Challenge/Response authentication.
ConnectionQuota
DataType: REG_DWORD
Range: 0-100(h)
Default: 28(h)
Description: The maximum number of connections per application that are supported at the same time by the service. The default is 40.
InstallRoot
DataType: REG_SZ
Range: text
Default: C:\Msp
Description: Specifies the installed share path for Microsoft Proxy Server.
LogFileDirectory
DataType: REG_SZ
Range: text
Default: C:\Winnt\System32\Wsplogs
Description: Specifies the installed directory path where WinSock Proxy logs will be stored.
LogFilePeriod
DataType: REG_DWORD
Range: 0-4
Default: 0
Description: 0 = Do not open new logs.
1 = Open a new log file daily.
2 = Open a new log file weekly.
3 = Open a new log file monthly.
4 = Open a new log file yearly.
LogFileTruncateSize
DataType: REG_DWORD
Range: 0-ffffffff(h)
Default: ffffffff(h)
Description: Specifies the maximum length (in megabytes) for log-file retention. The default is set to 4,000 megabytes (4 gigabytes).
LogFileType
DataType: REG_DWORD
Range: 1,2
Default: 2
Description: 1 = Log to a text file.
2 = Log to an SQL/ODBC database file.
LogSqlDataSources
DataType: REG_SZ
Range: text
Default: Proxy Server SQL
Description: Specifies the data source name to be used when logging WinSock Proxy messages to an SQL database.
LogSqlPassword
DataType: REG_SZ
Range: text
Default: (none)
Description: Specifies the password to use when accessing an SQL database for WinSock Proxy message logging.
LogSqlTableName
DataType: REG_SZ
Range: text
Default: MspSrvLog
Description: Specifies the name of the table to be used for WinSock Proxy message logging to an SQL database.
LogSqlUserName
DataType: REG_SZ
Range: text
Default: sa
Description: Specifies the user name to use when accessing an SQL database for WinSock Proxy message logging.
LogType
DataType: REG_DWORD
Range: 0,1
Default: 1
Description: 0 = Logging is disabled.
1 = Logging is enabled.
MappingQuota
DataType: REG_DWORD
Range: 0-100(h)
Default: 28(h)
Description: The maximum number of mappings available for each active connection. The default is 40.
RoutingTable
DataType: REG_SZ
Range: text
Default: C:\Msp\Clients\Msplat.txt
Description: Specifies the installed share path and file name to the Local Address Table (LAT) file on the server.
SmallLogFormat
DataType: REG_DWORD
Range: 0,1
Default: 1
Description: 0 = Specifies to use verbose log format.
1 = Specifies to use regular log format.
TcpBufferSize
DataType: REG_DWORD
Range: 600(h) or higher
Default: 800(h)
Description: Sets the number of bytes allocated for buffering of TCP packets for each connection.
UdpBufferSize
DataType: REG_DWORD
Range: 600-ffff(h)
Default: 1000(h)
Description: Sets the number of bytes allocated for buffering of UDP packets for each connection. This number limits the maximum size of UDP packets that can be transferred by use of the WinSock Proxy service.

To Top Other Keys Added for Microsoft Proxy Server

The following keys are added for use with Microsoft Proxy Server:

Current Version
 SNMP

To Top Current Version

This key indicates a path to where the Web Proxy Service Management Information Database (MIB) dynamic-link library (DLL) is installed. It is located in:

HKEY_LOCAL_MACHINE
  SOFTWARE
     \Microsoft
        \W3Proxy
           \CurrentVersion

The following value is available:

Pathname

Pathname
DataType: REG_EXPAND_SZ
Range: text
Default: %SystemRoot%\System32\W3pmib.dll
Description: Specifies the installed path to the Web Proxy service MIB DLL.

To Top SNMP

This key indicates a path to where the Winsock Proxy Service Management Information Database (MIB) DLL is installed. It is located in:

HKEY_LOCAL_MACHINE
  SYSTEM
     \CurrentControlSet
        \WSPSrv
           \SNMP

The following value is available:

Pathname

Pathname
DataType: REG_EXPAND_SZ
Range: text
Default: %SystemRoot%\System32\Wspmib.dll
Description: Specifies the installed path to the Winsock Proxy service MIB DLL.


Appendix B, Network Considerations

Appendix B

Network Considerations

Overview of Network Considerations with Microsoft Proxy Server
Considerations for Setting Up Your Private Network
Considerations for Connecting to the Internet

To Top Overview of Network Considerations with Microsoft Proxy Server

Whether your network currently uses TCP/IP or not, you will need to decide how Microsoft Proxy Server operates with TCP/IP services used on the Internet, and possibly with TCP/IP services already installed on your network. Your decisions will be influenced by a number of factors:

  • Network size If you have a small Microsoft-based network of fewer than 50 users, the use of NetBIOS machine broadcasts may be acceptable for resolving host-to-computer name addresses on your network. If your network is large, or is subdivided, consider a more advanced service option, such as Domain Naming System (DNS) or Windows Internet Naming Service (WINS), which can be used to manage name resolution.

  • Network protocols Microsoft Proxy Server uses TCP/IP or IPX/SPX protocols to communicate on your network with clients. If you have one of these protocols installed already for all clients on your network, your network is ready for Microsoft Proxy Server. If you have a small network that is currently using NetBEUI only, you need to enable one of these other protocols for your network clients to have proxy access.

  • Network connection type Depending on the type of connection hardware you use, some additional considerations can apply. Connection hardware options can include network adapter cards, modems, or ISDN adapters.

This appendix outlines some of the options you have available when planning and implementing TCP/IP services on the Internet with Microsoft Proxy Server on your network.

To Top Considerations for Setting Up Your Private Network

Using Broadcasts to Resolve Host Names
Using WINS Service
Using DNS with WINS and DHCP
Using Multiple DNS Servers

To Top Using Broadcasts to Resolve Host Names

If your network is small and limited to a single network segment or a single subnet, broadcast name resolution through NetBIOS is an acceptable solution. NetBIOS can be used with any of the network transport protocols supported by Windows NT Server (NetBEUI, IPX/SPX, and TCP/IP).

The advantage to using NetBIOS broadcast resolution is that it requires no additional administration once a basic network configuration has been set. However, broadcast resolution using NetBIOS is not as effective for larger intranets or in cases where routers are used to subdivide your intranet. Also, the use of broadcasts increases traffic on your network and can have negative effects for network performance as your network increases in size.

For larger networks, an improved solution is needed. Both WINS and DNS are examples of services designed to accommodate the problems and demands associated with larger networks. DNS was developed for larger TCP/IP networks and is used throughout the Internet. WINS was developed by Microsoft and is recommended for use in medium-sized and large TCP/IP networks using Windows NT Server.

To Top Using WINS Service

WINS was developed by Microsoft and is recommended for use in medium and large networks using Windows NT Server with TCP/IP. When installing a WINS server on the same computer used for Microsoft Proxy Server, it is important to:

  1. Manually specify a permanent IP address in the TCP/IP properties for the server’s internal network adapter.
  2. Use this same IP address (not the server’s computer name) when using WINS Manager to add a WINS server for your internal network.

For more information on considerations for using Microsoft Proxy Server as either a WINS client or WINS server, see “Server Administration.” For more information on installing or configuring WINS services, see your product documentation provided with Windows NT Server 4.0.

To Top Using DNS with WINS and DHCP

Windows NT Server 4.0 provides a significantly enhanced DNS Server from previous versions of Windows NT. This version supports integration with WINS and DHCP services to provide a complete solution for resolving host names to network addresses.

In addition to performing standard DNS service, the Windows NT DNS Server can further check a WINS names database for host names not resolved by DNS. Also, because WINS can manage dynamic updating of host-to-address information, the use of WINS and DNS together can greatly reduce the need to manually administer DNS information for your network.

An additional possibility with WINS and DNS is the use of DHCP. With DHCP, users in a large organization with Windows NT or Windows 95 clients can easily migrate to other locations within your private network. Consistent access to network resources is maintained through the use of friendly names, and the assignment of IP addresses is effectively automated. For network administrators, DHCP provides the best option for reducing the burden of carefully managing IP address assignments for all network clients.

For more information on considerations when enabling DNS, WINS, and DHCP services with Microsoft Proxy Server, see “Server Administration.” For more information on installing and configuring DNS, WINS, and DHCP services, see the documentation provided with Windows NT Server.

To Top Using Multiple DNS Servers

If you are using Microsoft DNS on your intranet and also have external DNS servers, you will need to change the configuration of the Microsoft DNS server to turn off recursive forwarding for DNS searches. To turn off recursive forwarding on the Windows NT DNS server provided with Windows NT Server 4.0, add the following entry to the registry on the DNS server computer:

HKEY_LOCAL_MACHINE
  SYSTEM
    CurrentControlSet
      Services
        DNS
          Parameters
            NoRecursion:REG_DWORD:0x1

To add this registry entry to the server, run regedt32 and open the following key:

HKEY_LOCAL_MACHINE
  SYSTEM
    CurrentControlSet
      Services
        DNS
          Parameters

In the Parameters key add the following value:

NoRecursion:REG_DWORD:0x1

The preceding registry entry prevents your local DNS server from blocking further attempts to resolve a request for host name resolution. This allows DNS searches to continue in trying other secondary DNS servers specified in the search list.

If your local DNS server uses a platform other than Windows NT Server 4.0, such as a Unix-based DNS server that uses the BIND service, refer to your server’s documentation on how to turn off recursive forwarding.

Note If you are using dial-up support with Microsoft Proxy Server, do not use RAS settings to set DNS search lists.

To Top Considerations for Connecting to the Internet

Considerations When Using a Direct Link
Considerations When Using a Dial-Up Link
 Managing Your Own Internet Domain
 Where to Put DNS Servers on Your Network

To Top Considerations When Using a Direct Link

If you are using a continuous ongoing link to the Internet through a dedicated leased line or T1 line option, you will need to specify DNS servers for use in resolving Internet domain host names to IP addresses.

One simple option is to specify the IP addresses for DNS servers provided by your Internet service provider (ISP). For this option, you will need to obtain IP addresses for DNS servers from your ISP. These addresses can then be entered in the DNS Service Search Order dialog box on the DNS property sheet for TCP/IP properties on the external server adapter that connects Microsoft Proxy Server to your ISP.

Another option for some networks is registering and managing your own Internet domain. For more information on considerations for Microsoft Proxy Server when using this option, see Managing Your Own Internet Domain and Where to Put DNS Servers on Your Network , later in this appendix.

To Top Considerations When Using A Dial-Up Link

Note If you are using dial-up support with Microsoft Proxy Server, do not use RAS settings to set DNS search lists.

For more information on issues concerning the use of multiple DNS servers with Microsoft DNS and Microsoft Proxy Server, see Using Multiple DNS Servers.

To Top Managing Your Own Internet Domain

Although you can use Microsoft Proxy Server to connect to the Internet whether or not you have a registered domain name, many people or organizations prefer to have one for representing themselves on the Internet.

If you have registered an Internet domain name, you may decide to have your ISP handle the details of how to administer your domain for use by others on the Internet. For small organizations, this solution is preferred because Internet domain administration is somewhat complex to implement.

If you do decide to register and manage your own domain, consider the following options for setting up DNS services for your network and for outside users on the Internet:

  • Install a single DNS server on your network that manages DNS services for both your private network and for Internet users. This computer is multi-homed, which means that it uses separate network interfaces to connect to both your private network and the Internet.

  • Install a single DNS server on Microsoft Proxy Server that manages DNS services for both your private network and for Internet users. For small organizations, combining DNS service with Microsoft Proxy Server on a single server computer may be preferred, although this configuration may reduce performance for proxy service.

  • Install two or more DNS servers on your private network with one for internal usage only and the other for managing your Internet domain for outside users on the Internet.

To Top Where to Put DNS Servers on Your Network

To administer DNS service locally on your network, first determine the preferred physical location for any DNS servers on your network.

The location you choose will depend on whether DNS service is needed for Internet connections, or if DNS services are needed on your private network only.

If you want to provide DNS services for Internet connections only

  • Install a separate DNS server on the network segment that connects Microsoft Proxy Server to your ISP. This is a preferred solution for larger networks.

  • As an option, install and configure a DNS server on the computer running Microsoft Proxy Server. For this configuration, make sure that DNS services are installed on the external adapter only, and not on the internal adapter. This solution is not preferred, but is an option for smaller networks, where the cost of an additional server would be an issue.

If you want to provide DNS services for your private network only

  • Install a separate DNS server on the network segment that connects Microsoft Proxy Server to your internal network.

  • Install and configure a DNS Server on the computer running Microsoft Proxy Server. For this configuration, make sure that DNS services are installed on the internal adapter only, and not on the external adapter.


Appendix C, Troubleshooting

Appendix C

Troubleshooting

Web Proxy Service Troubleshooting
WinSock Proxy Service Troubleshooting
 Performance Troubleshooting
 RAS Troubleshooting

To Top Web Proxy Service Troubleshooting

Web Proxy Server Problems
Web Proxy Client Problems

To Top Web Proxy Server Problems

HTTP/1.0 500 Server Error (An attempt has been made to operate on an impersonation token by a thread that is not currently impersonating a client.)

This error occurs when changes are made to the home directory properties for the WWW service and Web Proxy service is also in use. If the home directory setting is changed to specify a remote UNC path name (i.e. \\servername\sharename) and not a currently mapped local drive path (such as D:\InetPub\Wwwroot), all requests that are made through the Web Proxy service will fail.

To correct the problem, stop and restart the WWW and Web Proxy services using Internet Service Manager. As an alternative, create a virtual directory entry instead of altering the default local drive path for the home directory when adding directory names that use remote UNC path names.

HTTP/1.0 500 Server Error (-number)

This error occurs when Windows NT Challenge/Response authentication is used on Microsoft Proxy Server to validate proxy clients. Microsoft Proxy Server uses the password authentication specified in the WWW service properties to validate Web Proxy clients. Examine the form of password authentication in use for WWW services by using Internet Service Manager. As a temporary alternative, select basic (clear-text) authentication and report the error to your support provider.

HTTP/1.0 500 Server Error (The specified module could not be found.)

This error occurs when certain proxy binaries are not installed in the correct directory for proxy scripts. Verify the location of your IIS scripts directory. Make sure there is a Proxy subdirectory under this directory location.

To Top Web Proxy Client Problems

RealAudio does not work when set to use a proxy.

The WinSock Proxy service included with Microsoft Proxy Server handles all Windows Sockets-based applications transparently. Therefore, it is not necessary to configure RealAudio to use a proxy. Disable the proxy option in RealAudio’s View|Preferences dialog box.

FTP using Netscape Navigator shows all files as plain text when attempting to download.

This problem occurs for some versions of Netscape Navigator configured to use the Web Proxy service of Microsoft Proxy Server. When Netscape navigator sees the HTTP document-type header, it attempts to display the FTP contents on screen without examining it. To work around this problem, hold the SHIFT key when clicking a link to download a file.

HTTP error 5 occurred.

Connection was refused for a proxy-configured client browser. If anonymous logon is allowed for IIS, then the IUSR_computername account will be used by Microsoft Proxy Server to authenticate clients. Microsoft Proxy Server will check that proxy client users have access to a requested service. Check that the IUSR_computername account is listed on the Web Proxy service Permissions property sheet for the requested service (FTP, HTTP and so on) that is being affected.

HTTP error 18 occurred.

This error can occur when attempting to use a browser configured for the Web Proxy service for FPT service. It is caused by the FTP directory on the remote computer being empty. (Note: WinSock Proxy FTP does not return this error if the directory is empty.)

HTTP error 12 occurred.

If the private network is running TCP/IP, the Local Address Table (LAT) is configured to specify that the server’s internal IP address is located on the local network. Check that the IP address assigned for the server’s internal network adapter is included in the LAT.

HTTP error 10060 occurred.

This error indicates a time out occurred in attempting to reach the URL targeted server . The most common reasons for this are:

  • The destination host is too busy.
  • The destination host (on the Internet) is currently not available.
  • A network link in the path to the destination host is not available.

To Top WinSock Proxy Service Troubleshooting

WinSock Proxy Diagnostic Utility
WinSock Proxy Server Problems
WinSock Proxy Client Problems

To Top WinSock Proxy Diagnostic Utility

When the client Setup program is run and the client software is installed on a computer, a WinSock Proxy diagnostic utility is installed into the Mspclnt directory on the client. This utility presents configuration information that is useful when troubleshooting WinSock Proxy conditions.

For computers running 32-bit operating systems, the utility is named Chkwsp32.exe. For computers running 16-bit operating systems the utility is named Chkwsp16.exe.

To run the WinSock Proxy diagnostic utility

  1. On the client computer, open the MS-DOS command-prompt window and change to the Mspclnt directory.

  2. Run the utility with the -f option.

    For example, on a client computer running the Windows 95 operating system, type:

    chkwsp32 -f

To Top WinSock Proxy Server Problems

Inability for user to access or administrate different protocols for WinSock Proxy service.

By default, the Administrator user logon account is the only account allowed to access any port regardless of port configuration. To allow other users to access or administrate protocols or assigned ports:

  1. Check the LAT to make sure that the user computer’s IP address is included.
  2. Use Internet Service Manager to check that the protocol has been added.
  3. Use Internet Service Manager to check that the user (or a group the user belongs to) has been granted permission to use the protocol.

Ping fails to work with WinSock Proxy.

Ping.exe uses Winsock.dll only when looking up the domain host name of the server you are trying to ping. Once the DNS name lookup has completed, Ping.exe uses ICMP for connection. If you have an internal DNS server, make sure its IP address is contained in the Local Address Table (LAT), C:\Msp\Msplat.txt, that is configured during Setup. Also, check your Ping utility program. If you are using an application to ping with that requires use of a third-party Windows Sockets DLL, ICMP ping results may be unpredictable.

WinSock Proxy service problems with other third-party TCP/IP stacks.

Currently, Microsoft Proxy Server has not been tested with other third-party TCP/IP implementations. Use of a third-party stack may produce unpredictable results.

Server domain name look-ups failing on local network.

The WinSock Proxy service redirects all DNS look-ups to the computer running Microsoft Proxy Server. If you have an internal DNS server, make sure its IP address is contained in the Local Address Table (LAT), C:\Msp\Msplat.txt, that is configured during Setup. Domain names that do not contain dots are considered internal names to Microsoft Proxy Server.

To Top WinSock Proxy Client Problems

Internal subnetwork is not reachable through a WinSock Proxy client application.

Check that the subnetwork address ranges are included in the Local Address Table (LAT), C:\Msplat.txt. If there are internal subnet addresses missing from the LAT, add the missing IP address pairs to the server LAT file (C:\Msp\Msplat.txt) so that these address changes will be propagated to all clients when the next table update cycle is performed by Microsoft Proxy Server.

Cannot connect to other ISP after installing WinSock Proxy client.

The WinSock Proxy client is set up for use with the internal network. When you connect to another Internet Service Provider, you are now on a different network, and the WinSock Proxy client must be disabled.

After a computer has the WinSock Proxy client software installed, it is able to use Windows Sockets applications to access Internet sites through Microsoft Proxy Server on the corporate network. However, the computer will be unable to use Windows Sockets applications to access any Internet sites through a dial-up connection to a private Internet service provider (ISP). This might occur, for example, if a user has a home computer that is sometimes used to connect to the corporate network, and sometimes to a private ISP. To correct this condition, you can turn the WinSock Proxy client on and off using the WinSock Proxy Client application in the Control Panel.

WinSock Proxy service problems with other third-party TCP/IP stacks.

Currently, Microsoft Proxy Server has not been tested with other third-party TCP/IP implementations. Use of a third-party stack may produce unpredictable results.

Windows For Workgroups clients using IPX not able to access WinSock Proxy Service for Proxy Server.

IPX is currently supported only for Windows 95 and Windows NT clients.

Prompting to “Enter domain credentials” each time a new Windows Sockets application is launched.

Domain credentials are required each time a new Windows Sockets application is launched and another Windows Sockets application is not currently active. If the first Windows Sockets application is left open and minimized, there is no need to resupply domain credentials for successive Windows Sockets applications that are loaded for the same domain.

To Top Performance Troubleshooting

Browsing internal Web sites works, but external WWW sites do not appear in user browse lists.

Try to ping the server IP address for Microsoft Proxy Server from the client computer’s command prompt.

If the response is “Bad IP address,” check to see if you have any local WINS or DNS servers used for client address resolution. Verify that any active name servers used for your client TCP/IP protocol configuration are configured correctly. For further assistance, contact your network administrator.

Private network performance is slow for all clients accessing the same server.

If performance is slow for WinSock Proxy client requests to particular servers on the private network, check that the IP addresses of those servers are included in the Local Address Table (LAT). The information in the LAT identifies the range of IP addresses of your private network. If an internal server is not listed in the LAT, WinSock Proxy clients will redirect their connections to it through Microsoft Proxy Server.

To check or correct this condition, use Microsoft Internet Service Manager and, for each computer running Microsoft Proxy Server in your network, review the IP address ranges listed in the Construct Local Address Table dialog box. (This dialog box is accessible from the Edit Local Address Table (LAT) button, on the Services property sheet of both the WinSock Proxy and Web Proxy services.)

Add IP address ranges or individual IP addresses as necessary.

–Or–

You can directly read and edit the Msplat.txt file, located by default in the C:\Msp\clients directory of each computer running Microsoft Proxy Server.

Slow connection from a client using a Windows Sockets connected application on a local network.

If certain local addresses are slow, the problem may be caused by WinSock Proxy attempting to redirect a local connection. To prevent this, check that the local computer you are attempting to establish connection to is defined in the Local Address Table (LAT). The client LAT is contained in C:\Mspclnt\Msplat.txt.

To Top RAS Troubleshooting

RAS does not hang up calls or disconnect properly after dialing

To ensure that RAS always disconnects after each dialing attempt, a value in seconds for Idle seconds before hanging up must be set in Logon Preferences for the RAS phonebook entry that is used by Microsoft Proxy Server for dial-out. Dialing settings made in User Preferences are not observed when a non-user service (such as Microsoft Proxy Server) dials. Logon preferences are accessed by selecting More from within Dial-Up Networking. For more information on configuring RAS preferences, see RAS online Help or your Windows NT product documentation.


Installing the Search Components

If Microsoft® Index Server is not already installed, click the Download button.

You will be connected (if you have an Internet connection) to the Microsoft Index Server page, located at www.microsoft.com on the World Wide Web. Follow the instructions on that page to download, install, and configure Microsoft Index Server on your server. After installing Microsoft Index Server, you can reopen the Microsoft® Proxy Server Installation and Administration Guide, open the Search page, and perform a full-text search.

Note You must have Internet connectivity in order to install Microsoft Index Server. For more information on installing Microsoft Index Server and using it to search the Microsoft Proxy Server Installation and Administration Guide, see “Server Installation.”


Appendix D, Architecture

Appendix D

Architecture

How the Web Proxy Service Works
How the WinSock Proxy Service Works

To Top How the Web Proxy Service Works

The CERN-Proxy Protocol
The Microsoft Proxy Server Web Proxy service
Caching Mechanisms

To Top The CERN-Proxy Protocol

What is CERN-Proxy?
How HTTP Works
How the GET Method Works
Examples of Usage with Web Proxy Service

To Top What is CERN-Proxy?

The CERN-proxy protocol is widely recognized throughout the World Wide Web (WWW) community as the standard for implementing proxy services in TCP/IP-based networks. It has its origins within the standards for Hypertext Transfer Protocol (HTTP) as a UNIX-based service first developed by members of Switzerland’s Conseil Europeen pour la Recherche Nucleair (European Laboratory for Particle Physics, or CERN) in the early 1990s.

As the CERN staff added application-aware proxy support for Hypertext Transfer Protocol daemon (HTTPd) servers commonly known as Web servers to their libraries, the WWW community built on these additions. In the time since it was first introduced, the CERN-proxy protocol has become an accepted industry standard for implementing HTTP proxy service. The Microsoft Proxy Server Web Proxy service is fully compatible with the CERN-proxy standard.

To better understand how CERN-proxy works, it is important to understand the differences between how most Internet applications, such as File Transfer Protocol (FTP) and Gopher, work and how HTTP applications work.

Standard TCP/IP applications such as FTP use TCP (or in some cases, User Datagram Protocol, or UDP) as the transport-level protocol for supporting client/server communications. For HTTP-based applications, a set of commands (called methods) are defined that are used in Web-based client/server communications. While CERN-compatible proxy services support WWW (HTTP), FTP, and Gopher requests, it is important to keep in mind that a CERN-based Web proxy server uses HTTP for all communications with its Web Proxy clients.

To Top How HTTP Works

HTTP defines a set of commands (called methods) that a client can send to a server. The two most common methods are:

  • GET GET is used to forward a Uniform Resource Locator (URL) to a server requesting the resource to which the URL refers.

  • POST POST is used to forward a request that contains a URL and data; typically, a user provides this data by completing a Hypertext Markup Language (HTML) form.

To Top How the GET Method Works

In a simple HTTP request, a browser that is not configured for proxy service sends an HTTP URL directly to a Web server. The browser sends the server a GET method, which includes the path and resource name requested. In the process, the browser will remove the protocol and site name from the URL (http://domainname) before forwarding the GET method request on to the site named in the URL.

For example, if the following URL is typed on the command line of a browser not configured for proxy service

http://host.com/sales/report.htm

the browser parses the URL and sends the following command to Host.com as:

GET /Sales/Report.htm

This type of processing simplifies communications because HTTP is the protocol for all message requests that browser clients communicate to the server, but it limits browser requests to sending and receiving by use of HTTP only. Browser requests for FTP URLs can not be handled directly in this manner, although proxy service can support these types of requests for browser clients.

Examples of GET Usage with Proxy Service

When a browser is configured for use with a proxy server, GET methods issued by the browser are created with more detail about the resource included. The browser client will issue the full URL without parsing the named protocol first. The named protocol indicates the type of service being requested and whether the GET request is for a WWW, FTP, or Gopher resource. The fully detailed GET method is then forwarded to the proxy server.

The following is an example of a WWW (HTTP) request that shows proxy-based service for a document entitled Doc.htm in the Sales directory on the server Host.com:

The process by which a proxy request is serviced is as follows:

  1. The Web browser sends the full URL request as a GET statement to the proxy server.

  2. The proxy server:

    • Receives the request.

    • Parses the URL.

      If the URL is in the cache, the request is serviced to the Web browser from the cache.

    • Identifies the type of resource the request is for (such as HTTP or FTP).

    • Resolves the domain name to an IP address.

    • Requests Doc.htm from the Internet server by using the appropriate protocol, such as HTTP or FTP.

      In this case, because the URL specified HTTP, HTTP is the appropriate protocol. Note that a request sent to a Web server is formatted by the proxy service as a standard request, that is, a request not forwarded by the proxy service.

  3. The Web server:

    • Receives the request.

    • Responds by sending Doc.htm to the proxy by using HTTP.

  4. The proxy server:

    • Receives Doc.htm.

    • Sends Doc.htm to the browser by using HTTP.

  5. The Web browser receives Doc.htm and displays it on-screen, completing the process.

Another example of this process will demonstrate how an FTP resource is requested and handled under proxy service.

The following diagram shows how an FTP request is forwarded using proxy service. The browser sends a request to the proxy service for an FTP-published document named Q296.doc. The GET method that is used contains the full FTP URL entered at the browser command line, ftp://host.com/sales/Q296.doc. (Note that the HTTP protocol is used by the browser to send the GET method to the proxy.)

In this case, the proxy service identifies the request as the FTP protocol, and requests Q296.doc from host.com by using the FTP protocol. Host.com then returns Q296.doc to the proxy by using the FTP protocol, and the proxy uses the HTTP protocol to send the document to the client.

Browsers that are not configured for the proxy service issue FTP and Gopher requests by using the FTP and Gopher protocols, respectively. A browser that is not configured for the proxy service cannot issue an FTP or Gopher requests by using HTTP.

Configuring a browser to communicate with a proxy server actually simplifies the work that the browser needs to do, because all requests are processed with HTTP and have complete URLs.

To Top The Microsoft Proxy Server Web Proxy Service

About the Web Proxy Service
Proxy ISAPI Filter
Proxy ISAPI Application
Advantages of the Web Proxy Service

To Top About the Web Proxy Service

The Microsoft Proxy server fully supports the CERN standards for proxy service with added support for other application-level proxy services as well.

How does the Web Proxy service work? Certain application services have knowledge of the underlying protocols used by the applications they support. This knowledge allows Microsoft Proxy Server to offer additional features, such as user authentication, protocol conversions, and local caching of retrieved content. These features add security, improve response time and access control, and decrease network usage.

A Web proxy performs functions associated with both clients and servers. As a server, it receives WWW requests from private network clients; as a client, it responds to private network clients’ requests by issuing the appropriate requests to a WWW server on the Internet. The interface between the client and server components of the Web Proxy Service provides opportunities to add value to the connections it services. By increasing security and functionality for client connections, the Web Proxy Service do much more that simply relay data for between servers and clients.

The Web Proxy Service runs as an extension to Microsoft Internet Information Server (IIS) version 2.0. It is implemented as a dynamic-link library (DLL) that uses the Internet Server Application Programming Interface (ISAPI), and therefore runs within the process of the IIS WWW service.

The WWW service must be installed and running in order for proxy requests to be processed. Because all proxy requests for Web, Gopher, or FTP resources are sent from the client to the proxy by using the HTTP protocol, it is both convenient and efficient for the IIS WWW service to receive these requests and pass them on to the Web Proxy Service DLL by means of the ISAPI interface.

Note In order to install Microsoft Proxy Server, you must have both Windows NT Server 4.0 and Internet Information Server 2.0 installed. For more information on installing either of these products, see the product documentation.

Functionally, the Web Proxy Service consists of two components, the Proxy ISAPI Filter and the Proxy ISAPI application.

To Top Proxy ISAPI Filter

The ISAPI filter interface allows for registration of an extension that the Web server calls whenever it receives an HTTP request from a client. An ISAPI filter is called for every request, regardless of such details as the identity of the resource requested in the URL. Thus, an ISAPI filter can monitor, log, modify, redirect, or authenticate requests sent to the Web server.

The process of calling an ISAPI filter in an HTTP request can be described as follows:

  1. The HTTP client browser forms and passes a URL request on to the network for forwarding to a server running IIS.
  2. The IIS server receives the request and calls an ISAPI filter DLL.
  3. The ISAPI filter DLL loads and registers with the WWW service.
  4. The request is filtered for notification points (such as monitor, log, modify, redirect, or authenticate requests).
  5. The request is then forwarded back to the WWW service for response action.
  6. A response is issued by the WWW service and the ISAPI filter DLL is called again.
  7. The response is filtered for notification points (monitoring, logging, and so on).
  8. The response is then returned to the client.

The WWW service can call the ISAPI filter DLL’s entry point at various times during a request-and-response sequence. When the ISAPI filter is loaded, it programmatically registers the notification points in which it is interested. The WWW service then starts calling the ISAPI filter DLL’s entry point at each requested notification point for each HTTP request.

Note For more information about:

  • The ISAPI filter interface, see the ActiveX Development Kit, available at http://www.microsoft.com/intdev/ .
  • The ISAPI interface and the IIS WWW service, see the Installation and Administration Guide For Microsoft Internet Information Server, an online guide installed with the product.

The Proxy ISAPI filter is contained within an additional DLL (W3proxy.dll) that examines each request to determine if the request is either a proxy request or a standard HTTP request.

It registers itself to use the SF_NOTIFY_PREPROC_HEADERS notification point, because when called at this notification point for a request, the Proxy ISAPI filter can see the URL sent by the client (and can modify the URL), before the Web server processes the request.

Once the Proxy ISAPI filter examines each request, it can modify the header in one of the following ways:

  • If the request is a proxy request—that is, if the request contains a URL complete with protocol and domain name as described in The CERN-Proxy Protocol, earlier in this chapter—the Proxy ISAPI filter adds the name of the Proxy ISAPI application (W3proxy.dll) to the URL. This causes the WWW service to forward the request to the Proxy ISAPI application for processing.

  • If the request is not a proxy request—that is, if the request does not contain a protocol and a domain name—then the request is assumed to be for a Web resource on a Web server. The Proxy ISAPI filter does not modify the request, allowing ordinary Web publishing to occur between the Web server and client.

To Top Proxy ISAPI Application

The ISAPI application interface uses an in-process mechanism to extend Web server functionality. Unlike Common Gateway Interface (CGI), another mechanism for extending Web server functionality, an ISAPI application does not initiate a new process for every request. ISAPI applications can create dynamic HTML and integrate the Web with other service applications, such as databases.

An ISAPI application DLL loads once; thereafter, the Web server calls the DLL whenever it receives a client request for that application. The Proxy ISAPI application is contained within W3proxy.dll, which also contains the Proxy ISAPI filter. Because both application and filter reside in W3proxy.dll, all necessary initialization for both is done when the server is started.

Every time it receives a request, the Proxy ISAPI application does the following:

  1. Authenticates the client.
  2. Applies the domain filter.
  3. Looks for objects in the cache and returns objects from there, first checking that the cached object is current to its source.
  4. Gets the objects from the Internet, sends them to the client, and adds them to the cache if appropriate.

If a request is valid, and it is necessary to issue the request to an Internet site, the ISAPI application parses the URL to extract the protocol (typically HTTP, FTP, or Gopher), and the domain name. For HTTP requests, the ISAPI application calls the appropriate Windows Sockets APIs directly to process file requests.

For HTTP requests, all input/output (I/O) is done asynchronously after the domain name has been resolved. If possible, the Domain Name System (DNS) is used to resolve the domain name. (DNS is used to resolve Internet or UNIX system names. Microsoft TCP/IP includes DNS support.)

Issuing the request to the Internet site includes the following steps:

  1. Resolve the domain name to an IP address (if possible, the DNS cache is used).
  2. Connect to the remote site.
  3. Send the request to the remote site.
  4. Receive the response header from remote site.
  5. Receive the data (send to the client and save in the cache).

The ISAPI Proxy application uses a small set of reusable worker threads and asynchronous I/O to achieve very high performance. An Asynchronous Thread Queue (ATQ) and the TransmitFile API further enhance thread efficiency. The Proxy ISAPI application benefits from the high performance and scalability built into IIS, as well as its own architecture.

To Top Advantages of the Web Proxy Service

By running as an ISAPI application, the Microsoft Proxy Server benefits from many other functional and performance features of IIS. An example is the Web server’s support for HTTP Keep-Alives.

Keep-Alives is a feature that when supported by both browser and server allows TCP connections to remain intact after a request and response are completed. This significantly improves performance if another request is made from the same client to the same server within a time limit for connections. Support for Keep-Alives requires that the Web server be able to return the byte size of responses to clients, and that time outs are used by client and server so as to efficiently manage Windows Sockets connections.

Because individual Web pages can often contain numerous links to separate graphic image files on the Web server, Keep-Alives can often improve performance for non-proxy environments. The speed with which Web page contents can be accessed is vastly improved, even when another HTML page is not requested.

For a Microsoft Proxy Server, the Keep-Alives mechanism is much more valuable. In a typical scenario, a company has a small number of computers running Microsoft Proxy Server for Internet access. Every attempt within the company to access Internet Web, Gopher, and FTP sites requires a connection from a browser on the internal network to the Microsoft Proxy Server. The probability of reusing a connection between the same client and the same Microsoft Proxy Server, is very high. For Internet Explorer version 3.0, support for Keep-Alives to a proxy server is a feature.

To Top Caching Mechanisms

About Caching
Passive Caching
Active Caching

To Top About Caching

The Web Proxy Service uses caching to maintain a local copy of HTTP objects. This allows subsequent requests for these objects to be serviced from a local disk copy, rather than issuing the request over the Internet, thereby improving user-perceived performance and reducing bandwidth consumption on the site’s Internet connection.

Not all objects that pass through Web Proxy Service can or should be cached. Some objects are dynamic and change frequently, some change every time they are accessed. Other objects require authentication of the requesting client and cannot be cached for security reasons.

A Web object must satisfy the following criteria in order to be cached:

  • The request must be a GET.
  • There may be no ? keywords, which are typically used for basic logons.
  • The file must be served by the HTTP protocol (objects associated with other protocols are not cached).
  • The HTTP response header must not include WWW-Authenticate, Pragma: no-cache, Cache-control: Private, Cache-control: no-cache, or Set-Cookie.
  • The date in the Expires: header field must be later than the one in the Date: header. The Expires: header is used in all HTTP requests to indicate a date and time for the request to expire on the network.The Date: header is used to indicate the date and time that the Web server received the request. Both fields are generically returned in almost all HTTP requests. Some Web servers indicate to downstream caches that a page should not be cached by setting the Expires: header equal to the Date: header, indicating that the page expires immediately. Also, setting this field to “Expires: 0” will prevent caching as well.
  • The HTTP Result code must be 200 (success).
  • The object must not be encrypted or protected by Secure Sockets Layer (SSL).
  • There cannot be an Authorization header in the HTTP request header, or Vary in the response header.

The HTTP header may include “cookies,” which allow a server to customize a response for a particular user. Cookies are increasingly used for custom pages or for informal (that is, not very secure) authentication. Microsoft Proxy Server will treat cookies as another optional HTTP header that will be disregarded, with the exception of the Set-Cookie header. It will be assumed that subsequent transactions after the cookie has been set can be cached, unless any of the subsequent objects requested include headers with cache ineligible exception values based on the criteria in the preceding list.

Microsoft Proxy Server caches data by means of two different types of caching processes: passive caching and active caching. The remainder of this section discusses each of these processes in further detail.

To Top Passive Caching

Passive caching, also referred to as “on-demand” caching, is the most basic mode of caching. The following figure depicts passive caching.

Microsoft Proxy Server interposes itself between the client and local or remote Web and intercepts requests (for example, HTTP GET requests) from the client. Before forwarding the request on to the Web, Microsoft Proxy Server first calls into its cache (Urlcache.dll) to determine if the cache can satisfy the request by using the RetrieveUrlFile API. If the data is in the cache and has not expired, it is returned immediately to the client by using the Windows Sockets TransmitFile API.

If the object is not cached or if the cached copy of the object has expired, Microsoft Proxy Server retrieves the object from the Web, returns it to the user, and inserts it into the cache (by using the CreateUrlFile and CacheUrlFile APIs). If the local disk space reserved for the cache is too full to hold the new data, older objects are removed from the cache using a formula that evaluates age, popularity, and size.

The Microsoft Proxy Server cache APIs are documented in the ActiveX Development Kit, available at http://www.microsoft.com/intdev/ .

To Top Active Caching

Microsoft Proxy Server uses active caching to improve the retrieval performance by increasing the likelihood that a requested object will be found in the cache. Active caching works as a superset to passive caching.

Typically, in passive caching, an object is placed in the cache and a Time-To-Live (TTL) expiration value is associated with that object. During this TTL, all requests for the object are serviced from the cache without generating traffic back to the upstream Web server. After the TTL has expired, subsequent client requests for the object will generate traffic to and from the Web server. The response from the server will be stored in the cache and a new TTL will be calculated.

Active caching augments this system by having the server automatically generate requests for a specified subset of objects. Microsoft Proxy Server optimizes the choice of objects for active caching on the basis of the following qualities:

  • Popularity Ensures that requests made by Microsoft Proxy Server are likely to be requested by clients as well.

  • TTL Longer TTLs are more valuable to cache than shorter TTLs; Microsoft Proxy Server will also check objects that are close to expiration.

  • Server load Microsoft Proxy Server performs more aggressive active caching during periods of low server load than when the server is heavily loaded.

Active caching results in:

  • Better Client Performance Clients are more likely to find their URL in the cache, resulting in lower latency (the amount of time clients wait for a response) and better throughput.

  • Even Load Distribution Active caching has the effect of balancing the request load for the server across time, by rescheduling some cache update requests from high-peak periods of server activity to off-peak periods.

  • More Accurate Data By checking unexpired objects during off-peak periods, the likelihood of returning stale data to clients is reduced.

To Top How the WinSock Proxy Service Works

Understanding Windows Sockets and WinSock Proxy
WinSock Proxy Architecture
Windows Sockets APIs
WinSock Proxy Limitations

To Top Understanding Windows Sockets and WinSock Proxy

About Windows Sockets
About WinSock Proxy

To Top About Windows Sockets

Windows Sockets is a mechanism for interprocess communication between network applications running on the same computer, or on different computers connected using a local area network (LAN) or wide area network (WAN). It defines a set of standard APIs that an application uses to communicate with one or more other applications, usually across a network.

The Windows Sockets APIs support:

  • Initiating an outbound connection for a client application.
  • Accepting an inbound connection for server application.
  • Sending and receiving data on a client/server connection.
  • Terminating a client/server connection.

The specification includes a standard set of APIs supported by all Windows-based TCP/IP protocol stacks, and to be used by network applications. Support for other transport protocols is included in Windows Sockets with some implementations supporting IPX/SPX and NetBEUI protocols.

In Windows Sockets, application communications channels are represented by data structures called sockets. A socket is identified by two items:

  • An IP address
  • A port number

Windows Sockets can support both point-to-point connected service (also referred to as stream-oriented communications), and multipoint connectionless service (referred to as datagram-oriented communications). When using the TCP/IP protocol suite, stream-oriented communications use TCP and datagram-oriented communications use UDP.

Connected Service using TCP Sockets

Most Internet application protocols, including HTTP, Gopher, and FTP, are connection-oriented client/server protocols. A client typically initiates a connection to a server in order to process a specific client request. A server waits for connections initiated by clients, accepts those connections, and begins communicating with each client following the rules of the specific application protocol. Communications managed expressly between a server and its clients in this manner form what is known as connected service.

For application protocols that use connected service, the Transmission Control Protocol (TCP) has been long established as the transport-level protocol of choice. TCP supports the use of sockets as well to form connected communications between computers on a network.

For example, a TCP socket can be formed by first associating an IP address and a TCP port. The IP address is a 32-bit number that uniquely identifies the local IP network interface. The port identifies a virtual channel used for communications at the TCP level. A stream-oriented connection is then formed by associating a local IP address-TCP port pair with a remote IP address-TCP port pair.

A server goes through the following steps to create a TCP socket with a client:

  • The socket() API is used to establish a socket and associate it with a specific streaming protocol, such as TCP.

  • The bind() API is used to associate a local IP address and port with the socket. Most servers specify that they want to bind the socket to all local IP addresses, and indicate the well-known port for the application protocol (port 80 for HTTP, port 21 for FTP, and so on).

  • The listen() API is used to enable inbound connections on the IP/port pair.

  • When a client connection is received, the server uses the accept() API to complete the connection process, associate a different socket with the connection, and go back to the listening stage on the original socket to handle future client connections.

  • The server uses the recv() and send() APIs to communicate with the client.

  • The server can use the getsockname() API to query the local and remote IP address-port pairs.

A client typically initiates a TCP socket connection to a server in order to process a user request. With stream-oriented TCP connections, the client executes the following steps:

  • The socket() API is used to establish a socket and associate it with a specific streaming protocol, such as TCP.

  • The bind() API is used to associate a local IP address and port with the socket. Most clients specify that they are willing to use any local IP address and port.

  • The connect() API is used to initiate a connection to a specified IP address/port pair. The remote IP address specified identifies the server, and the port identifies the service (80 for HTTP, 21 for FTP, and so on).

  • The client uses the recv() and send() APIs to communicate with the server.

  • The client can use the getsockname() API to query the local and remote IP address-port pairs.

Connectionless Service using UDP Sockets

Some Internet applications can use User Datagram Protocol (UDP), a transport protocol that delivers server data in a form that offers higher throughput performance than TCP. UDP is very effective for delivering data from servers to clients at the highest possible speeds by using unacknowledged delivery and packaging data into small uniform-length packets called datagrams. Communications that consist of UDP datagrams sent from a server to clients on a network in this manner form what is known as connectionless service. This type of service is useful for real-time applications such as streaming audio and video. For example, RealAudio and VDOLive both use UDP to offer connectionless service to clients.

For UDP, the client and server each establish a UDP socket in the following way:

  • The socket() API is used to establish a socket and associate it with a specific datagram protocol, such as UDP.
  • The bind() API is used to bind the socket to a local IP address-port pair.
  • The sendto() and recvfrom() APIs are then used to begin immediately sending and receiving data. These APIs specify the IP port to send to, and return the IP port received from.

While most UDP implementations consist of a client communicating with a single server at a time, UDP is a connectionless protocol and supports communications between a client application and multiple servers over a single socket.

To Top About WinSock Proxy

WinSock Proxy allows a Windows Sockets application running on a private network client to perform as though it is directly connected to a remote Internet server application, when in actuality, the Microsoft Proxy Server serves as the proxy host for this connection. WinSock Proxy consists of two parts: a service running on a gateway computer, and a DLL installed on each client computer.

The WinSock Proxy service runs on Windows NT Server version 4.0 only. It runs as a stand-alone Windows NT service, and is responsible for creating virtual connections between internal applications and Internet applications. The WinSock Proxy service is also responsible for doing “data pumping” between the two actual communications channels set up for a virtual connection, and acting as a TCP/IP protocol gateway if the internal network runs IPX/SPX.

One of the benefits of this type of design is that all application-level communications are channeled through a single secured computer—the gateway computer running Microsoft Proxy Server. The WinSock Proxy service can also provide application-level event monitoring for redirected Windows Sockets applications on the private network.

With WinSock Proxy, client applications send Windows Sockets APIs to communicate with server applications running on Internet computers, and the WinSock Proxy service on the Microsoft Proxy Server intercepts these calls. The Microsoft Proxy Server then handles redirecting these APIs to the remote server on the Internet. This establishes a logical communications path from the internal client application to the Internet server application by way of the computer running Microsoft Proxy Server.

The gateway process is not visible to either the internal network client or the remote server. Both client and server computers appear to share only a single connection to each other. In truth, both maintain separate connections to the computer running Microsoft Proxy Server through separate network hardware interfaces on the computer running Microsoft Proxy Server.

There are some side effects to using the proxy server to access the Internet.

  • External servers see different users coming from the same address.
  • A client application that binds a socket to a specific port may fail when the requested port is already assigned to another client. To avoid this, the client software can either request PORT_ANY (0), or try a range of ports when a bind fails with the error WSAEADDRINUSE. (Note that the socket option SO_REUSEADDR will not work in this case.)

The WinSock Proxy service offers client and server support for most standard and custom Internet applications that communicate using Windows Sockets 1.1. Almost all Windows Sockets 1.1 TCP/IP applications can be redirected using WinSock Proxy. However, redirection of Windows Sockets 2.0 APIs or applications is not supported at this time. The WinSock Proxy service works with Windows-based TCP/IP applications on the private network, and any TCP/IP applications platform on the Internet.

To Top WinSock Proxy Architecture

WinSock Proxy Client Components
WinSock Proxy Control Channel
TCP Redirection
UPD Redirection
Using TCP/IP on the Internal Network
Using IPX/SPX on the Internal Network

To Top WinSock Proxy Client Components

On client computers, the WinSock Proxy uses a specially designed DLL to redirect Windows Sockets API calls from the client to remote servers. When this DLL is installed, it renames the standard Windows Sockets DLLs, and the WinSock Proxy DLL is given the name of the corresponding Windows Sockets DLL (Winsock.dll for 16-bit; Wsock32.dll for 32-bit). This results in all Windows Sockets API calls being forwarded to the WinSock Proxy DLL first, and then the WinSock Proxy DLL redirecting calls to the renamed Windows Sockets DLL as needed, or processing the call itself.

Once the WinSock Proxy DLL is actively installed on the client, it intercepts all Windows Sockets API calls made by applications on the client computer. Depending on the API, and the current socket status, the client WinSock Proxy DLL may:

  • Completely process the client’s request.

  • Pass the request to the (renamed) actual Windows Sockets DLL on the local computer (after possibly making changes to the request).

–Or–

  • Need to pass control information (by use of the WinSock Proxy Control Channel) to the WinSock Proxy service on the computer running Microsoft Proxy Server.

For network communication between local applications on the internal network, the WinSock Proxy client DLL passes Windows Sockets API calls to the previously installed (and renamed) Windows Sockets DLL. This allows Windows Sockets communications to continue to work normally. Also, this is true regardless of whether the previous Windows Sockets DLL was obtained from a third-party TCP/IP stack or directly from Microsoft. In all cases, the Windows Sockets DLL that was installed prior to WinSock Proxy client setup is maintained for forwarding local network calls.

There are two versions of the WinSock Proxy client DLL: a 16-bit version and a 32-bit version. The 16-bit version is installed on Windows 3.1 and Windows For Workgroups 3.11. The 32-bit version is installed on Windows NT. Both versions are installed on Windows 95.

To Top WinSock Proxy Control Channel

The WinSock Proxy service and client DLLs communicate by using a control channel that is set up when the client DLL is first loaded. The control channel uses the connectionless UDP protocol. UDP allows a single socket on the gateway computer to be used for communications with all WinSock Proxy clients, and is faster than TCP. A simple acknowledgment protocol is used between WinSock Proxy client and service to add reliability to the control channel.

The goal is to use the control channel as infrequently as possible, and to have as few Windows Sockets APIs that require special processing on the client computer as possible. For example, for TCP connection requests, the control channel is used to set up the virtual connection, but once the connection is set up, sending and receiving data (send() and recv() APIs) requires no special processing on the client: the WinSock Proxy DLL simply forwards these requests to the (renamed) Windows Sockets DLL. This also means that the Win32 APIs ReadFile and WriteFile, which bypass Windows Sockets, will work with redirected connections.

The WinSock Proxy control channel is used for the following purposes:

  • To set up TCP connections for WinSock Proxy clients to remote servers

    When a connection with a remote application is being established, the control channel is used in establishing the virtual connection. Once the connection is established, sending and receiving data will not require use of the control channel.

  • To maintain UDP communications between WinSock Proxy clients and WinSock Proxy servers

    The control channel is used by WinSock Proxy clients to contact the WinSock Proxy server when the UDP socket is bound. Additionally, in order to support multiple remote applications communicating with the internal application, port-mapping information is sent to the client DLL each time a new remote peer sends data. Sending and receiving data to and from known peers does not require the control channel.

  • To manage database requests between WinSock Proxy clients and WinSock Proxy servers

    Redirection of the Windows Sockets database requests, such as DNS name resolution (gethostbyname(), and so on) is handled by passing the client request to the WinSock Proxy service by using the control channel, and the response is forwarded to the client DLL by using the control channel.

When the first application on a client attempts to make its first Windows Sockets connection, the WinSock Proxy DLL is loaded and initialized. At this time, the WinSock Proxy DLL does the following:

  1. It establishes its own WinSock Proxy control channel with the WinSock Proxy service, and notifies the service, by using the control channel, that it is active.

  2. The WinSock Proxy service then downloads the Local Address Table (LAT). The LAT is a routing table that consists of a list of IP address pairs, each pair indicating a range of addresses located on the internal (private) network. The LAT is used by the client to determine which requests need to be redirected.

    Note Routing information is updated by copying files over the network using Windows NT file sharing protocols (server message block, or SMB). The control channel is not used for this purpose.

Note LAT information is stored in the Msplat.txt file, located by default at C:\Msp\clients. It is initially configured by the Microsoft Proxy Server Setup program. It can be modified or changed later by using Internet Service Manager.

Once the WinSock Proxy DLL has initialized service, for future connection attempts by applications, the WinSock Proxy DLL attempts to determine if the application is trying to communicate with a local computer (private network) or remote computer (Internet).

For connection attempts and Windows Sockets APIs destined for a local computer, the WinSock Proxy DLL simply forwards the API calls to the (renamed) Windows Sockets DLL, for normal processing. If a Windows Sockets API call contains no information about the destination (and therefore no indication as to whether it should be redirected), the WinSock Proxy component assumes it is a local request, and forwards the request to the standard Windows Sockets DLL.

When a Windows Sockets database API is called by an application (gethostbyname(), and so on) to resolve an Internet name or address, the WinSock Proxy components work together, using the control channel, to redirect the request to the gateway computer, and have the request processed on the Internet.

The architecture of WinSock Proxy requires special processing by the client’s WinSock Proxy DLL when establishing a connection with an Internet site, but once a communication channel is established, standard Windows Sockets and Win32 APIs for reading and writing a socket or file can be used with no special processing on the client. The application performs as if it is reading and writing to the Internet site, while it is actually communicating with the WinSock Proxy service, which forwards the requests.

The WinSock Proxy control channel uses UDP port number 1745 on the WinSock Proxy server and client computers.

The following illustration depicts the WinSock Proxy components on an IPX/SPX private network.

To Top TCP Redirection

TCP handles point-to-point, connection-oriented communications. For each TCP connection requested by an internal application, two actual connections are set up by WinSock Proxy service:

  • A connection between the client application and the WinSock Proxy service using the WinSock Proxy Microsoft Proxy Server’s internal network port interface.

  • A connection between the WinSock Proxy service and the Internet application using the WinSock Proxy Microsoft Proxy Server’s external (Internet) port interface.

Data received from either connection is forwarded to the other connection, and both applications perform as though they are communicating directly with each other.

A TCP redirected connection is managed in the following way:

  1. The WinSock Proxy control channel is used to set up a TCP redirected connection. Once the TCP redirected connection is set up, the control channel is not used for data transfer.

  2. The internal application then initiates an outbound TCP connection to an Internet site.

  3. The send() and recv() APIs are then called on the client and server. The WinSock Proxy client DLL forwards send() calls to the real Windows Sockets DLL (these APIs do not contain addresses, they simply refer to a socket), and all data is identical to data sent in a normal (non-redirected) socketed connection. (The ReadFile() and WriteFile() Win32 APIs work on TCP redirected connections as well. For Windows NT, these APIs are not handled by Windows Sockets and therefore are not intercepted by the WinSock Proxy DLL.)

Once an internal application’s socket has been remotely bound, WinSock Proxy makes it appear that the socket is bound to the proxy computer’s Internet interface. If the internal application calls the getsockname() API, the data returned will indicate that the socket’s local IP address is that of the proxy computer. Thus, it appears to the application that it is on the Internet. This is necessary for protocols such as FTP, in which the client sends its local IP address to a server, in order for the server to initiate a new TCP connection back to the client.

When an internal application attempts to listen for a TCP connection initiated by an Internet application, WinSock Proxy uses the local IP address to which the application’s socket is bound to determine whether the listen should be redirected. If the local IP address is that of the Internal computer’s interface (a private network IP address), the listen will be local (passed to the Winsock DLL). If the IP address bound to the socket is that of the Microsoft Proxy Server’s Internet interface, the listen will be redirected.

When a listen() API is redirected, WinSock Proxy does the following:

  • Listens for a socket connection on the WinSock Proxy service’s Internet IP address and the same port specified as the local port in the internal application’s socket bind.

  • When an external site connects to the port, creates a socket connection between the internal application (on the local port specified by the application), and the WinSock Proxy service (on its internal IP address and an arbitrary port). This connection is initiated by the WinSock Proxy service, because the internal application is listening for an incoming connection.

Once an internal application’s socket is bound to the Microsoft Proxy Server’s Internet IP address and an inbound connection is established, a getsockname() API call by the application will return the proxy’s Internet IP address as the local IP address, and the Internet site’s IP address and port as the remote IP and port.

The following illustration shows WinSock Proxy redirecting a TCP connection.

To Top UDP Redirection

UDP offers connectionless communications, and supports multiple applications communicating with an application over the same UDP socket. A UDP-based application uses sendto() to send data, specifying the destination IP address, and recvfrom() to receive data, returning the source IP address.

When an internal application binds a UDP socket, the WinSock Proxy service binds a UDP socket to its Internet IP address, and the same local port as used by the client. This is the socket used for communications between all Internet peers for the internal application.

When an internal client computer receives a packet over UDP from the Internet:

  • The packet was actually forwarded by the WinSock Proxy service, and the source address will be that of the computer running Microsoft Proxy Server.

  • The WinSock Proxy client DLL needs to change the source port and IP address to that of the actual Internet source before the internal application receives the data. However, the problem is that for UDP there can be multiple sources of data sent to one destination socket.

In other implementations, this problem is sometimes handled by having the Web Proxy Service add a header to the data (which contains the original source port and IP address) before forwarding it to the internal client. The client DLL would then strip off this header and modify the source IP address and port passed to the application. This solution requires much work on every data packet, including a buffer copy, and may even result in the buffer size being larger than the maximum allowed. In this case, splitting the data into multiple packets needs to be supported, as well as ordering and recombining at the destination. Also, this solution prevents Win32 APIs from working. (On Windows NT, Win32 APIs are not passed to Windows Sockets.)

Instead, the problem of multiple-source IP addresses is solved by creating a separate UDP socket in Microsoft Proxy Server for each Internet peer sending data to the client. Each time the first data packet is received from a new Internet port and IP address, WinSock Proxy service creates a new UDP socket on a different local port, in Microsoft Proxy Server (bound to the proxy’s internal IP interface). The WinSock Proxy service maintains a table that maps Internet ports and IP addresses to the port number of the WinSock Proxy server’s socket for that Internet site. Each time it changes, the mapping table is forwarded to the WinSock Proxy client DLL by using the control channel.

When the WinSock Proxy service receives data from an Internet application destined for the client, it sends the data to the client by using the associated socket on the Microsoft Proxy Server. The WinSock Proxy client DLL looks at the source (remote) port number of the data packet (proxy-server port number), and uses the table to map that to an Internet application’s port and IP address. The internal application is handed the Internet port and IP address as the source.

The result is that handling UDP communications:

  • Does not require extra control channels.
  • Does not cause data packets to be modified.
  • Does not require use of the control channel when data is sent from an Internet peer that the WinSock Proxy service already knows about.

Win32 APIs also work for reading and writing the socket.

When the internal application sends data to one of the remote peers, the WinSock Proxy DLL uses the mapping table to map the destination port and IP address (specified by the internal application) to an WinSock Proxy server port, and sends the data to the appropriate UDP socket (port) on the WinSock Proxy server computer.

Because this mechanism requires a new socket for each Internet peer application, extra resources are used in the Microsoft Proxy Server when an internal application uses UDP to communicate with many remote peers. Most Internet client applications that use UDP (RealAudio, VDOLive, and so on), communicate with a single server application, so this is an efficient trade-off. For other UDP client applications, the number of servers communicating with the client is usually small. (WinSock Proxy will limit the number of mappings per socket, keeping the most recently used, and re-establishing mappings as needed.)

When an internal application calls getsockname() for a remoted UDP socket, the local IP address returned is that of the proxy’s Internet interface.

The following illustration depicts redirected UDP communications that use WinSock Proxy.

To Top Using TCP/IP on the Internal Network

When the internal network runs TCP/IP, a TCP/IP application could try to communicate with a local (internal network) or remote (Internet) application. When the WinSock Proxy client DLL initializes, it receives from the WinSock Proxy service, using the control channel, a Local Address Table, which contains a list of IP addresses and subnets that are located on the private network. Future communication attempts by applications on the client computer with a specific IP address can be routed locally or remotely by the WinSock Proxy DLL, as appropriate. If communication is attempted with a local IP address, the WinSock Proxy DLL simply forwards the request to the real Window Sockets DLL, with no special processing.

In some cases an application attempts to communicate, but the WinSock Proxy DLL cannot determine whether the application is trying to communicate with a local computer or a remote computer. For example, a typical server application binds a socket to all local IP addresses (IP_ANY), and then listens on that socket. If WinSock Proxy cannot in any way determine if a listen() API should be local or remote, it will assume local (the more secure of the two).

If multiple internal servers are to be set up to do redirected listen() APIs on the same port at the same time, they must use different IP addresses on the Internet interface of the computer running Microsoft Proxy Server. For example, if two servers running Microsoft Exchange (IMC) internally will be listening on the SMTP port (port 25), the Microsoft Proxy Server must have two IP addresses assigned to its Internet: one for each computer running Exchange (IMC) server. Because both internal servers listen() on the same port, and the two listen() instances must be redirected to the same port on the proxy computer, the only way to distinguish them on the proxy is by using different IP addresses.

To Top Using IPX/SPX on the Internal Network

If the internal network does not run TCP/IP, it is assumed that all attempts by Windows Sockets applications to communicate over TCP/IP are to be redirected to the Internet.

When the internal network runs IPX/SPX, the principle of how communications are redirected is identical to that used when the internal network runs TCP/IP. When an internal application attempts to establish communications over TCP/IP, the WinSock Proxy DLL changes the Windows Sockets API parameters to those appropriate for IPX/SPX (address reformatting, and so on), and the communications between client and WinSock Proxy server are handled over IPX/SPX. The WinSock Proxy server acts as a protocol gateway, converting between IPX/SPX on the private network and TCP/IP on the Internet. In addition to standard redirection functionality, the following tasks are accomplished by the WinSock Proxy DLL when establishing remote communications with IPX/SPX:

  • socket() API. When an application specifies a protocol of TCP or UDP in a socket API call, the WinSock Proxy DLL changes this to the appropriate IPX/SPX protocol.

  • bind() API. When an application specifies a local IP address to bind a socket to, WinSock Proxy converts this to a local IPX/SPX address. A request to bind to IP_ANY is also converted.

  • connect() API. When an application attempts to connect to an Internet application, the address passed to the Windows Sockets DLL needs to be the IPX address of the Microsoft Proxy Server’s internal interface.

  • sendto() API. The destination IP address needs to be converted to IPX address of the internal interface of the computer running Microsoft Proxy Server.

  • recvfrom() API. The source IP address returned needs to be converted from IPX address of the computer running Microsoft Proxy Server to IP address of the Internet application.

  • The control channel uses IPX instead of UDP.

To Top Windows Sockets APIs

socket()
bind()
connect()
listen() and accept()
recv() and send()
recvfrom() and sendto()

To Top socket()

The socket() API is used by applications to establish a socket and associate it with a protocol (TCP, UDP, and so on) The socket() API requires no special processing by the WinSock Proxy DLL if the internal network runs TCP/IP; the API is simply passed to the standard Windows Sockets DLL for the local creation of the socket. If the local network runs IPX/SPX, the WinSock Proxy DLL needs to change the protocol specified in the socket() API call (UDP or TCP), to the appropriate IPX/SPX protocol.

To Top bind()

After calling the socket() API, clients may call the bind() API to bind the socket to a specific local interface (IP address) and port. This API is intercepted by the WinSock Proxy DLL and forwarded to the WinSock Proxy service using the control channel, when one of the following is true:

  • The private network is running IPX, and not TCP/IP.
  • The private network is running TCP/IP, but the specified IP address is not in the LAT, and is not ADDR_ANY.
  • The application configuration specifies that bind is remote.
  • The application already has a connection using the proxy server, and the bind is not to PORT_ANY and ADDR_ANY. (Note that some FTP clients can redirect even when they bind to PORT_ANY and ADDR_ANY.)

The WinSock Proxy service, in preparation of an attempt by the application to create a remote connection using this socket, creates one socket on the gateway computer for a UDP socket, and two sockets on the gateway computer for a TCP socket. This is done by calling the socket() and bind() APIs for the one or two new sockets. One new socket will be bound to the same port number that the client specified in its bind(), and the IP address of the gateway computer’s Internet interface. For TCP, the second socket is bound to the IP address of the gateway computer’s internal interface (and an arbitrary port). The client’s socket bind() request will then be passed to the Winsock DLL on the client computer, for normal processing.

To Top connect()

An application uses the connect() API to initiate an outbound TCP connection to a remote IP address and port pair. If the WinSock Proxy DLL determines, by looking up the IP address in the downloaded Local Address Table, that the application is attempting to connect to a remote (Internet) site (or if the local network runs IPX/SPX), the DLL forwards the request to the WinSock Proxy service using the control channel.

The WinSock Proxy service performs these actions:

  • A connect() API (on the socket that was previously bound to the Internet interface).

  • For the other socket, which was bound to the interface on the internal network, the listen() and accept() APIs are used to establish the connection with the client.

The WinSock Proxy DLL passes the connect() API to the Windows Sockets DLL, but first changes the IP address of the remote computer to that of the gateway computer’s internal interface (or converts it to the gateway computer’s IPX address, if the local network runs IPX/SPX). The listen() and accept() APIs used by the WinSock Proxy service will complete the establishment of this connection.

The result is that the WinSock Proxy service on the gateway computer has two socket endpoints that represent communications channels with the two communicating applications.

To Top listen() and accept()

When a client allows an inbound connection from a remote computer, it calls the listen() API. If the WinSock Proxy DLL determines from the Local Address Table, or configuration information, that the client is attempting to establish a connection with an Internet computer, the DLL forwards the listen() API to the WinSock Proxy service by using the control channel. listen() will be redirected only if the bind() call was remoted.

The WinSock Proxy service will do a listen() on the socket bound to its Internet interface when the client did its bind(). When the remote application attempts to connect to the WinSock Proxy service’s socket, the service will do an accept() to complete the connection process. The service will then do a connect() on the internal socket to establish a connection with the internal client application. The client application will then call the accept() API to complete the connection process.

The result is that the WinSock Proxy service on the gateway computer has two socket endpoints that represent the two communicating applications.

Note that if inbound access is not allowed, or if a site attempts to connect and that site is filtered (by using Microsoft Proxy Server Internet site filtering), the connection is discarded and will not reach the client.

To Top recv() and send()

Once a TCP socket connection is established between internal application and the WinSock Proxy service, and a corresponding connection is established between WinSock Proxy service and remote application, the client can receive and send data with the recv() and send() APIs.

The WinSock Proxy service uses the recv() API on both connections for receiving data packets. When a client sends data, the data is actually sent to the WinSock Proxy service, because it has the socket endpoint of the client’s connection. The WinSock Proxy service simply receives the data on that connection, and sends it to the remote computer using the other connection.

When the remote application sends data to the client, the WinSock Proxy service receives this data and sends it to the client application.

Receiving and sending data on the client computer requires no special handling on the part of the WinSock Proxy DLL. The DLL simply passes these API calls on to the (renamed) Windows Sockets DLL. The WinSock Proxy service does all of the special handling, by passing the data to the associated connection. This results in high performance when sending and receiving data on the client. The Win32 APIs for reading and writing files, when applied to a redirected socket, will work successfully.

To Top recvfrom() and sendto()

The recvfrom() and sendto() APIs are most often used with UDP connectionless communications. The sendto() API requires an IP address and port destination, and the recvfrom() API returns an IP address and port of the originator of the data.

When the internal application does a bind() on a UDP socket, the WinSock Proxy service binds a socket on the gateway computer’s external (Internet) interface, to send and receive data to and from remote applications. Once this socket is bound, remote servers can send data, destined for the internal application. Each time a UDP data packet is received from a new IP address and port pair, the WinSock Proxy service creates a new UDP socket on the gateway computer and binds it to a different port on the gateway’s internal interface.

The WinSock Proxy service maintains a mapping table of remote IP address and port pairs (that have sent data) with the port number of the corresponding internal-interface socket in the gateway computer. This mapping table is downloaded to the WinSock Proxy DLL on the client computer by using the control channel.

When a UDP data packet is received from a remote computer, the WinSock Proxy service looks up the internal socket (based on the remote computer’s IP address and port) to use for that remote computer, and sends the data to the internal computer by using the corresponding socket. The WinSock Proxy DLL on the client computer will receive the data packet from the gateway computer’s IP address, and the port that it was sent from can be used to look up the IP address, and port, of the originating remote computer. The WinSock Proxy DLL will replace the source information, making it appear that the data came directly from the remote computer.

When the client (internal) application sends data to a remote computer, the WinSock Proxy DLL intercepts the request and modifies the destination to send it to the WinSock Proxy service by using one of the WinSock Proxy service’s sockets bound to the internal IP interface. In order to determine which WinSock Proxy service socket to use, the WinSock Proxy DLL looks up the final destination IP address and port pair in the UDP mapping table, and that indicates which WinSock Proxy service socket (port) to send to.

To Top WinSock Proxy Limitations

Version 1.0 of Microsoft Proxy Server can redirect Windows Sockets 1.1 applications. Redirection of Windows Sockets 2.0 APIs or applications is not supported. Almost all Windows Sockets 1.1 TCP/IP applications can be redirected. This section describes limitations that may prevent specific protocols or applications from working through the WinSock Proxy service.

When an internal application receives an inbound TCP connection from an Internet site, the internal application’s bind() API needs to be redirected to the WinSock Proxy service computer’s Internet interface. If multiple internal computers will be running that same application, and therefore listening on the same port at the same time, each one needs to use a different Internet IP address on the WinSock Proxy server in order to distinguish them (because the port is the same).

There are a small number of APIs that cannot be handled properly in a redirected environment. Following is a list of APIs that will not be redirected properly:

  • duplicatehandle()
  • getsockopt()

Note The getsockopt() API returns the local information, which is usually equal to the remote information.

Also, WinSock Proxy does not support Out-Of-Band (OOB) data transfer. In general, OOB is implementation-dependent and may not work between different network stacks.


Appendix E, Web Proxy Service Reference

Appendix E

Web Proxy Service Reference

This appendix provides a reference to the property sheets and dialog boxes displayed in Internet Service Manager for the Web Proxy service of Microsoft Proxy Server.

Opening the Administrative Interface for the Web Proxy Service
Web Proxy Service Properties
Web Proxy Permissions Properties
Web Proxy Caching Properties
Web Proxy Logging Properties
Web Proxy Filters Properties

To Top Opening the Administrative Interface for the Web Proxy Service

To open the administrative interface for the Web Proxy service

  1. From the server’s desktop, click Start, select Programs, and then select the Microsoft Proxy Server program group.

  2. Click Internet Service Manager.

    The Microsoft Internet Service Manager window is displayed.

  3. If necessary, connect to the server to be administered. From the Properties menu click Connect to Server and complete the dialog box that appears.

    This step is unnecessary if you are administering the local server.

  4. In the Microsoft Internet Service Manager window, click the server name next to the Web Proxy service.

    The Web Proxy Service Properties window appears. It contains tabs labeled Service, Permissions, Caching, Logging, and Filters.

The following table summarizes each Web Proxy service property sheet.

Property | Description
Service | Use the Web Proxy Service property sheet to display the product ID, to add a comment about the server or the Web Proxy service, to edit the Local Address Table (LAT), and to view information about current connections.
Permissions | Use the Web Proxy Permissions property sheet to determine which users or groups of users are allowed to access the Internet through the Web Proxy service on a server. Permissions are granted separately for each supported protocol.
Caching | Use the Web Proxy Caching property sheet to enable or disable caching of Internet objects, and to configure cache parameters.
Logging | Use the Web Proxy Logging property sheet to set the logging options for the Web Proxy service. Microsoft Proxy Server can log information about all Internet requests made by clients. It can log to a text file or to a table in an ODBC-compliant database (such as Microsoft Access or Microsoft SQL Server).
Filters | Use the Web Proxy Filters property sheet to allow or prevent client access to specific Internet sites. The filtering set here is common to both services. It applies to all users who access the Internet using the Web Proxy or WinSock Proxy services on the server.

To Top Web Proxy Service Properties

Web Proxy service Property Sheet
User Sessions Dialog Box
Local Address Table Configuration Dialog Box
 Construct Local Address Table Dialog Box

To Top Web Proxy Service Property Sheet

Use the Web Proxy Service property sheet to display the product ID, to add a comment about the server or the Web Proxy service, and to view information about current connections.

To open the Web Proxy

  1. In Internet Service Manager, open the Web Proxy service for the appropriate server, as described in Opening the Administrative Interface for the Web Proxy service.

    By default, the Service tab should be selected.

  2. If it is not already selected, click the Service tab.

The Web Proxy Service property sheet has the following elements:

  • Product ID This is the product identification number (product ID) for this copy of Microsoft Proxy Server.

    The product identification number is provided on the Certificate of Authenticity included with each copy of Microsoft Proxy Server. During installation it must be typed into a dialog box of the Setup program.

  • Comment To add or change a comment, in the Comment box type a remark about the server or the Web Proxy service. When Internet Service Manager is set to display Report view, the text entered here will appear in the Comment column, next to the Web Proxy service for this server.

  • Enable Internet Publishing Clear the Enable Internet Publishing check box to allow publishing only on the private (internal) network. By default, this check box is cleared.

    Select the Enable Internet Publishing check box to allow this server to use Microsoft Internet Information Server to publish to computers on the Internet.

    Note Select this check box only if you understand the security implications. For information see Appendix G, “IIS Considerations.”

  • Current Sessions Click this button to display the Web Proxy Service User Sessions dialog box, which displays the user name of all users who have recently sent Internet requests to the Microsoft Proxy Server, the time at which each connection was established, and the elapsed time since each connection was established.

  • Edit Local Address Table (LAT) Click the Edit Local Address Table (LAT) button to modify the Local Address Table on the server. This table defines the IP addresses of your network, and excludes external (Internet) addresses.

To Top User Sessions Dialog Box

Use the User Sessions dialog box to view the user name of all users who have recently sent Internet requests to the server, the time at which each connection was established, and the elapsed time since each connection was established.

To open the User Session dialog box

  • From the Web Proxy Service tab, click the Current Sessions button.

To Top Local Address Table Configuration Dialog Box

Use the Local Address Table Configuration dialog box to create a list of the IP addresses that constitute your private network. The information you provide is used to create a table, called the Local Address Table (LAT), that defines your private network.

It is used to determine whether an IP address is on the private network, or is external. If the address is internal, the client connection is made directly. If the address is external, the connection is made remotely, through Microsoft Proxy Server.

To open the Local Address Table

  • From the Web Proxy Service property sheet, click Edit Local Address Table (LAT).

The Local Address Table Configuration dialog box has the following elements:

  • Edit Use the boxes under Edit to enter a pair of IP addresses to be added to the Internal IP Ranges list. You can add a single IP address by typing the same address in both boxes, or a range of IP addresses by typing the first IP address of the range in the From box, and the last IP address of the range in the To box.

  • From In the From box, type the first address of a pair of IP addresses to be added to the Internal IP Ranges list.

    If you are adding a single IP address, enter it here.

    If you are adding a range of IP addresses, enter the first IP address of the range.

  • To Use the To box to enter the second address of a pair of IP addresses to be added to the Internal IP Ranges list.

    If you are adding a single IP address, enter the same address that was entered in the From box.

    If you are adding a range of IP addresses, enter the last IP address of the range.

  • Add Use the Add button to move pairs of IP addresses from the From and To boxes to the Internal IP Ranges list. To add a range of IP addresses to the list, under Edit type a pair of addresses in the From and To boxes, and then click Add. To add a single IP address to the list, under Edit type the same address in both the From and To boxes, and then click Add.

  • Remove Use the Remove button to delete pairs of IP addresses from the Internal IP Ranges list. To remove an IP address or address pair from the list, select it from the Internal IP Ranges box, and then click Remove.

  • Internal IP Ranges Each IP address pair in the Internal IP Ranges list identifies a range of addresses that are part of your private network. Addresses can be added to the list by clicking the Construct Table button, or by entering IP address pairs in the From and To boxes and then clicking Add.

    Note Each IP address pair identifies either a range of addresses, or a single IP address. The second entry is not a subnet mask.

  • Construct Table To generate the list of IP address pairs from internal routing tables used by Windows NT Server, click Construct Table and complete the Construct Local Address Table dialog box that appears.

To Top Construct Local Address Table Dialog Box

Use the Construct Local Address Table dialog box to determine which IP addresses will be added to the Local Address Table (LAT).

To open the Construct Local Address Table Dialog Box

  • From the Local Address Table Configuration dialog box, click Construct Table.

The Construct Local Address Table dialog box has the following elements:

  • Add the private ranges To add to the LAT three ranges of IP addresses defined by IANA as private address ranges that can be used in a private IP network that is not connected to the Internet, select the Add the private ranges check box.

  • Load from NT Internal Routing Table Click this option to load IP addresses accessible through some or all of the server’s network adapter cards.

  • Load known address ranges from all IP interface cards If you do not know which of the server’s cards are connected to the private network and which are connected to the Internet, select this option. IP addresses accessible through any of the server’s network adapter cards will be added to the LAT.

    However, if you choose this option, after you complete the Construct Local Address Table dialog box and return to the Local Address Table Configuration dialog box you will need to review the generated list of IP ranges. Use the edit controls in the Local Address Table Configuration dialog box to remove any IP address pairs that define external (Internet) addresses. Also add any needed IP address pairs until all addresses of your internal network are defined.

  • Load known address ranges from the following IP interface cards If you know which of the server’s network adapter cards are connected to the private network and which are connected to the Internet, select this option.

    Then, in the list of network adapter cards, select the check box for each of the internally connected cards, and clear the check box for each of the externally connected cards.

  • Network Adapter Cards The server’s network adapter cards are listed below the Load known address ranges from the following IP interface cards option.

    If a network adapter card is connected to the private network, select its check box. The IP addresses accessible through that card will be added to the Local Address Table (LAT). If a network adapter card is connected to the Internet, clear its check box. The IP addresses accessible through that card will be excluded from the LAT.

To Top Web Proxy Permissions Properties

Web Proxy Permissions Property Sheet
Web Proxy Add Users and Groups Dialog Box

To Top Web Proxy Permissions Property Sheet

Use the Web Proxy Permissions property sheet to determine which users or groups of users are allowed to access the Internet through the Web Proxy service on a server. Permissions are granted separately for each protocol.

To open the Web Proxy Permissions property sheet

  1. In Internet Service Manager, open the Web Proxy service for the appropriate server, as described in Opening the Administrative Interface for the Web Proxy service , earlier in this appendix.
  2. Click the Permissions tab.

The Permissions property sheet has the following elements:

  • Enable Access Control When the Enable Access Control check box is selected, Web Proxy service security is enabled. When this check box is cleared, the Web Proxy service will not attempt to validate connections from clients.

    Note The authentication options used by the Web Proxy service (anonymous, basic, and Windows NT Challenge/Response) are set in the WWW service of Internet Information Server.

  • Protocol This drop-down list box lists the Internet protocols available to users of the Web Proxy service on this server. To permit a user to use a protocol, select that protocol from the Protocol box, click Add, and complete the dialog box that appears.

  • Grant Access To For the protocol selected in the Protocol box, the Grant Access To box lists the users and groups permitted to use that protocol on this server.

  • Add To assign a user or group the right to use a protocol on this server, select the protocol from the Protocol box, click Add, and complete the Add Users and Groups dialog box that appears.

  • Remove To remove a user or group from the list of those granted the right to use a protocol on this server, select the protocol from the Services box, select the user or group from the list under the Protocol box, and choose Remove.

The available protocols are:

  • FTP Read File Transfer Protocol. Use this protocol to download files through your browser.

  • Gopher Access through your browser to links and files on Gopher servers.

  • WWW HTTP and HTTPS protocols for the World Wide Web. Use WWW for browser access to the Web.

  • Secure Allows various Secure Socket Layer (SSL) connections. By default this includes SNEWS, but other protocols can be configured by editing the Windows NT registry.

To Top Web Proxy Add Users and Groups Dialog Box

Use the Add Users and Groups dialog box to grant access to the selected protocol to a user or to a group. You can grant access to users and groups from this server, from the local domain, and from trusted domains.

Tip It is a good idea to use User Manager for Domains to create a user group containing the user accounts of all users who need access to WWW, FTP, or Gopher. Then, for each protocol, you only have to apply permissions once for the entire group, rather than for each individual member. For more information about user groups and about User Manager for Domains, see your documentation for Windows NT.

To open the Add Users and Groups dialog box

  1. In the Web Proxy Permissions property sheet, select a protocol from the Protocol box.
  2. Click Add.

The Add Users and Groups dialog box has the following elements:

  • List Names From Select a computer or domain. The groups of that domain will be listed in the Names box.

  • Names Lists the groups of the selected computer or domain. If Show Users has been clicked, also lists user accounts.

    Local groups (as distinct from global groups) are a special case. When an asterisk (*) appears next to a domain or computer name in the List Names From box, it indicates that the local groups of that domain or computer can be listed in Names. When the asterisk is absent, it indicates that local groups cannot be listed.

  • Add After selecting users or groups in Names, click Add to move the names to the Add Names list.

  • Show Users By default, only groups are listed in Names. Select Show Users to also display user accounts in Names.

  • Members To view the members of a listed group, select the group in Names and then click Members. The Group Membership dialog box will appear.

  • Search To search for a particular user or group, click Search and complete the Find Account dialog box that appears.

  • Add Names When you click OK, the list of users and groups in Add Names is added to the list in the Permissions property sheet. You choose which users or groups to add to this list. You add users and groups to the Add Names list by typing the account names (separated by colons); by selecting the names from the Names list and clicking Add; by clicking Search and completing the Find Account dialog box; or by selecting a group from Names, clicking Members, and completing the Group Membership dialog box.

To Top Web Proxy Caching Properties

Web Proxy Caching Property Sheet
Microsoft Proxy Server Cache Drives Dialog Box
Advanced Cache Policy Dialog Box
Cache Filter Properties Dialog Box

To Top Web Proxy Caching Property Sheet

Use the Web Proxy Caching property sheet to enable or disable caching of Internet objects, and to configure cache parameters.

In this property sheet you can set the location and size of the disk cache. The disk cache stores a copy of each object that a client requests from the Internet in an area of the hard disk called the cache. When a second request is made for the same object, Microsoft Proxy Server fulfills the request with the copy of the object in the cache.

The cache can operate in either a passive or an active mode. In the passive mode, it copies each object requested from the Internet to the hard disk of the computer running Microsoft Proxy Server. In the active mode, it updates objects in the cache periodically. You can specify how often to update the cache.

Using an object from the cache:

  • Decreases the time it takes for a client to retrieve an object.
  • Reduces Internet traffic from your Microsoft Proxy Server to the Internet.

To open the Caching property sheet

  1. In Internet Service Manager, open the Web Proxy service for the appropriate server, as described in Opening the Administrative Interface for the Web Proxy service.
  2. Click the Caching tab.

The Web Proxy Caching property sheet has the following elements:

  • Enable Caching Select this option to cache Internet objects to disk. Clear this option to disable caching.

  • Cache Expiration Policy Use this slider to set the freshness of objects in the cache. Freshness is a measure of how long a local copy of an object in the cache is used in place of the remote object from the original Web site.

    Move the slider bar toward Always Request Updates to maintain the freshest cache data and increase the amount of Internet traffic that the server generates. Move the slider toward Fewest Internet Requests to allow objects in the cache to be used for the maximum Time-To-Live (TTL), which reduces Internet traffic. TTL is the time in seconds that an object remains in the cache before reaches its expiration date. At that time, the object will no longer be used in place of the original object on an Internet site (in the case of passive caching) or be updated by Microsoft Proxy Server (in the case of active caching). To generate the least number of Internet requests, move the slider all the way to the right (to Fewest Internet Requests).

  • Enable Active Caching If this check box is selected, active caching is enabled. If it is cleared, active caching is disabled and only passive caching is performed.

    Active caching uses the cache to proactively ensure the freshness and availability of certain HTTP data. The cache manager creates its own request for an object, without client prompting, when the TTL has expired or is near expiration. Web objects are subject to active caching on the basis of their popularity relative to their rate of change. Additionally, the active caching algorithm incorporates calculations of current server load in order to process requests to the Internet during periods of low usage.

  • Active Caching Policy Use this slider bar to specify how frequently objects in the cache are updated. Set the slider bar toward Most client cache hits to update the cache frequently. Set the slider bar toward Fewest Internet Requests to minimize the number of times Microsoft Proxy Server makes requests to Internet sites to update objects in the cache.

  • Total Cache Displays the total space allocated for the cache in the Total Available Cache field. To change this allocation, click Change Cache Size and complete the dialog box that appears.

  • Change Cache Size To change the disk drives and the amount of disk space allocated to the cache, click Change Cache Size and complete the Microsoft Proxy Server Cache Drives dialog box that appears.

  • Reset Defaults Returns the Cache Expiration Policy and Active Caching Policy to their default (centered) settings.

    Note If the Cache Expiration Policy and Active Caching Policy sliders are grayed, choosing Reset Defaults will reset them to active and will also reapply the default settings. (These sliders are grayed if the parameters have been set by editing the Windows NT registry.)

  • Advanced Click Advanced to display the Advanced Cache Options dialog box and:

    • Specify a maximum size allowed for cached objects.
    • Return expired objects from the cache when the requested Internet site is unavailable and the cache does not contain an unexpired copy of the requested object.
    • Filter the cache, listing specific URLs, sites, or directories that either should always be cached or can never be cached.

To Top Microsoft Proxy Server Cache Drives Dialog Box

Use the Microsoft Proxy Server Cache Drives dialog box to specify the disk drives that will be used for caching, and the amount of space on each drive that will be allocated to caching.

The disk cache should always be located on one or more hard drives installed on the computer running Microsoft Proxy Server. (You cannot use network drives to store cached data.) You should choose hard disks of sufficient size, and make the cache as large as possible. Using multiple drives is a good idea, because breaking a very large cache into several smaller caches can sometimes speed access to objects. To help prevent a from disk filling up, it is a good idea to store the logs and the cache on different volumes.

When configuring the cache drives you must, at a minimum, allocate at least one drive and 5 MB for caching. However, the recommended minimum allocation is higher. It is suggested you allocate at least 100 MB plus 0.5 MB for each Web Proxy service client (and round up to the nearest full megabyte). For example, if a server will be servicing 79 Web Proxy service clients, it is recommended you allocate 140 MB or more to the cache. For each server the optimal cache allocation will vary depending on load and configuration, but in general, increasing the disk space allocation benefits the cache.

Allocate space from a drive to the cache in increments of 5 MB. If you assign a number to the cache that cannot be evenly divided by 5, the allocation is rounded down to the next lowest 5-MB increment. For example, if you assign 194 MB to the drive C:, 190 MB is actually allocated from that drive to the cache.

To open the Microsoft Proxy Server Cache Drives dialog box

  • From the Caching property sheet, click the Change Cache Size button.

The Microsoft Proxy Server Cache Drives dialog box has the following elements:

  • Drive column This column displays all the local drives installed on the server, identified by drive letter.

  • File System column This column displays the file system (such as NTFS or FAT) of each drive. It is strongly recommended that you use only NTFS volumes for caching. Also, do not assign a read-only drive (for example, a CD-ROM drive) to the cache.

  • Maximum Size (MB) column If a drive is configured to cache, the amount of allocated space is shown in this column. If a drive is not configured to cache, this column is empty.

    To change this setting, select the drive from the list, enter the new value in the Maximum Size (MB) box, and click Set.

  • Drive The drive letter and file system type of the selected drive. The cache setting for this drive can be changed by using the Maximum Size (MB) box and the Set button.

  • Space Available (MB) The total amount of free space on the selected drive.

  • Maximum Size (MB) box Specify the maximum amount of disk space, in megabytes, that will be allocated from the selected drive to the cache.

    To set a drive to cache, select it from the Drive list, enter a value in this box, and click Set. To remove a drive from the list of those that cache, select it from the list, enter 0 in this box, and click Set.

    When you modify an existing cache drive:

    • If you modify an existing cache drive and reduce the Maximum Size (MB) value, some cache data on that drive can be lost.
    • If you set the Maximum Size (MB) value to 0, all cache data on that drive will be lost.
    • If you increase the Maximum Size (MB) value, the new setting takes effect immediately. There is no effect on the data already cached on that drive.

  • Set Click Set to save the value entered in the Maximum Size (MB) box. The saved value will be displayed in the Drive list, in the Maximum Size (MB) column.

  • Total Maximum Size for All Drives (MB) Displays the total disk space, in megabytes, allocated to the cache. This is the sum of all entries in the Maximum Size (MB) column.

To Top Advanced Cache Policy Dialog Box

Use the Advanced Cache Policy dialog box to:

  • Specify a maximum size allowed for cached objects.
  • Return expired objects from the cache when the requested Internet site is unavailable and the cache does not contain an unexpired copy of the requested object.
  • Filter the cache, listing specific URLs, sites, or directories that either should always be cached or can never be cached.

To open the Advanced Cache Policy dialog box

  • From the Caching property sheet, click Advanced.

The Advanced Cache Policy dialog box has the following elements:

  • Limit Size of Cached Obje cts to If this check box is cleared, there is no limit to the size of a cached object. If this check box is selected, objects larger than the size specified in the adjacent box will not be cached.

    By default, this box is cleared and there is no limit to the size of a cached object.

  • KB Specifies the maximum allowed size of a cached object. To limit the size of cached objects, select the Limit Size of Cached Objects to check box and type a value (in kilobytes) in this box. Objects larger than the entered size will not be cached.

    0 is not a valid value. If you enter 0 (or if you do not enter any value in this box), when you click OK to exit this dialog box the Limit Size of Cached Objects to check box will be cleared.

  • Return expired objects when site is unavailable To specify that cached objects will be sent to the client when the object is in the cache and the Internet server is unavailable, select this check box. Objects in the cache will be used even if they are expired. If you clear this option, when the Internet server is unavailable and the object in the cache is expired, the cached object will not be returned to the client. By default, this option is selected.

  • Cache Filters This list contains the currently configured cache filters.

  • URL The URL column displays the URL that will be filtered.

  • Status In the Status column an entry of Cached indicates that objects from that URL will always be cached (subject to other caching rules), and Not Cached indicates that objects from that URL will never be cached.

    The Status property of a filter is useful, for example, if you want to specify a wildcard filter to deny caching of all Internet objects from a site, and then create another filter to re-enable caching of objects from a particular sub-tree of the site.

  • Add To add an item to the Cache Filters list, click Add and complete the Cache Filters Properties dialog box that appears.

  • Edit To alter a listed item, select it from the Cache Filters list, click Edit, and complete the Cache Filters Properties dialog box that appears.

  • Remove To remove an item from the Cache Filters list, select the item and click Remove.

To Top Cache Filter Properties Dialog Box

Use the Cache Filter Properties dialog box to specify a URL whose objects will not be cached. Or, use this dialog to specify a URL whose objects will be cached regardless of other filters. (You will usually do this when you have already specified a wildcard filter to deny caching of all Internet objects from a site, and want to re-enable caching of objects from a particular sub-tree of the site.)

To open the Cache Filter Properties dialog box

  • From the Advanced Cache Policy dialog box, click Add.

    –Or–

    From the Advanced Cache Policy dialog box, select an URL from the Cache Filters list and click Edit.

The Cache Filter Properties dialog box has the following elements:

  • URL In the URL box, type a URL whose objects will never be cached or will always be cached (subject to other caching rules). Type the URL using one of the following formats. Note the use of the asterisk (*) wildcard character.

    • Use the format www.domainname.com/path to specify a specific location at that domain.

      For example, www.microsoft.com/intdev specifies only the intdev page.

    • Use the format www.domainname.com/path* to specify all objects under that path at that site.

      For example, www.microsoft.com/indev* specifies the indev page and all pages below.

    • Use the format *.domainname.com/path to specify all sites with similar domain names.

      For example, *.mydomain.com/beta specifies www.mydomain.com/beta, ftp.mydomain.com/beta, gopher.mydomain.com/beta, and so on.

    • Use the format *.domainname.com/path* to include all sites with similar domain names and all objects under that path.

      For example, *.mydomain.com/* specifies all pages in mydomain.com.

  • Always cache Select this option to always cache Internet objects returned from the URL entered in the URL box.

    Use this option when you have already specified a wildcard filter to deny caching of all Internet objects from a site, and want to re-enable caching of objects from a particular sub-tree of the site.

  • Never cache Select this option to prevent caching of Internet objects returned from the URL entered in the URL box.

    This is the default option for a URL entered in the URL box.

To Top Web Proxy Logging Properties

Use the Web Proxy Logging property sheet to set the logging options for the Web Proxy service. Microsoft Proxy Server can log information about all Internet requests made by clients. It can log to a text file or to a table in an ODBC-compliant database (such as Microsoft Access or Microsoft SQL Server).

To open the Web Proxy Logging property sheet

  1. In Internet Service Manager, open the Web Proxy service for the appropriate server, as described in Opening the Administrative Interface for the Web Proxy service , earlier in this appendix.
  2. Click the Logging tab.

The Web Proxy Logging property sheet has the following elements:

  • Enable Logging Select Enable Logging to log Internet accesses to a text file, or to a table in a SQL or ODBC-compliant database.

  • Regular Logging Records only a subset of all available information for each Internet access. This option reduces the disk space needed for a log file.

  • Verbose Logging Records all available information for each Internet access.

  • Log To File Saves log information to a text file. This text file can be viewed with a text editor, such as Notepad.

  • Automatically open new log file When selected, periodically begins a new Web Proxy log file, using the interval specified by the Daily, Weekly, Monthly, or When File Size Reaches options. When a new log file is started, the old log file is closed (and can optionally be archived on other storage media).

    When cleared, the same Web Proxy log file is used continuously.

  • Daily, Weekly, or Monthly Selecting one of these options specifies that a new log file should be started at daily, weekly, or monthly intervals.

  • When file size reaches Starts a new file each time the log file reaches the specified size. The log file will be closed when it reaches this size. Closed log files can then be stored on disk or other media.

  • MB The value in this box determines the file size that, when reached in the current log files, causes a new log file to be started. To change this value, type a number or click the arrows.

  • Log file directory

    Displays the path where Web Proxy log files are written and stored. To change this location, type a new path. Although it is possible to write a log file to another computer on your network, it is recommended that you write your Web Proxy log file to the local hard disk of the computer running Microsoft Proxy Server. To help prevent the disk filling up, it is a good idea to store the logs and the cache on different volumes.

    The default is to place Web Proxy service text file logs under the following path:

    C:\Winnt\System32\W3plogs

  • Browse If you want to change the Log file directory but are not sure of the new path, you can click Browse and complete the Select Directory dialog box.

  • Log file name Microsoft Proxy Server generates the Web Proxy log file name for you. When a new Web Proxy log file is opened daily the file name takes the format W3yymmdd.log, where yy is a number representing the year, mm is a number representing the month, and dd is a number representing the day of the month. For weekly logs the format is W3Wyymmw.log, where w is a number between 1 and 5. For monthly logs, the format is W3Myymm.log.

    When the Automatically open new log option is selected and a new Web Proxy log file is opened each time the log file reaches a specified size, the file name takes the format W3Bnnnn.log, where nnnn is a number that increments with each new log. For example, W3B0007.log.

  • Log to SQL/ODBC Database Choose this option to write all Internet accesses to a table in an SQL or ODBC-compliant database. Writing log data to a database is slower than writing to a text file, but data querying and reporting are enhanced by using an SQL or ODBC-compliant database (such as Microsoft SQL Server or Microsoft Access).

    Log files are stored in one table. Each Internet transaction generates one record in the table. The database can exist on the computer running Microsoft Proxy Server or on another computer on your private network.

  • ODBC data source name (DSN) Type the ODBC Data Source Name (DSN) for the database that the Web Proxy service will be logging to.

  • Table Type the name of a table in the database. Microsoft Proxy Server will log Web Proxy service information to this table.

  • User Name Type a valid user name for the database table.

  • Password If the table is password protected, type the password.

To Top Web Proxy Filters Properties

Web Proxy Filters Property Sheet
Web Proxy Deny or Grant Access To Dialog Box

To Top Web Proxy Filters Property Sheet

Use the Web Proxy Filters property sheet to allow or prevent client access to specific Internet sites. The filtering set here is common to both services. It applies to all users who access the Internet by using the Web Proxy or WinSock Proxy services on this server.

To open the Web Proxy Filters property sheet

  1. In Internet Service Manager, open the Web Proxy service for the appropriate server, as described in Opening the Administrative Interface for the Web Proxy service.
  2. Click the Filters tab.

The Web Proxy Filters property sheet has the following elements:

  • Enable Filtering Select this option to implement access filtering, which controls client access to Internet sites. You can use access filtering to prohibit access to specified sites or to allow access to only the sites specified. The filtering applies to all users who access the Internet through this server.

  • Granted When this option is selected, users who access the Internet through this server are granted access to all Internet sites, except for those that are listed. (Access is denied only for the listed sites.)

  • Denied When this option is selected, users who access the Internet through the this server are denied access to all Internet sites, except for those that are listed. (Access is granted only for the listed sites.)

  • Except to those listed below The list displays the exceptions to the selected option (Granted or Denied). To change the list, use the Add, Edit, or Remove buttons.

  • Add To add an item to the list of exceptions, choose Add and complete the dialog box that appears.

  • Edit To alter a listed item, select it, choose Edit, and complete the dialog box that appears.

  • Remove To remove an item from the list of exceptions, select the item and click Remove.

To Top Web Proxy Deny or Grant Access To Dialog Box

If the Granted option in the Filters property sheet is selected, use the Deny Access To dialog box to specify an Internet site that all users of this server will not be allowed to access. If the Denied option in the Filters property sheet is selected, use the Grant Access To dialog box to specify an Internet site that all users of this server will be allowed to access.

To open the Deny Access To or Grant Access To dialog box

  • From the Web Proxy Filters property sheet, click Add.

    –Or–

    From the Web Proxy Filters property sheet, select an item from the Except to those listed below list and click Edit.

The Web Proxy Deny Access To or Grant Access To dialog box has the following elements:

  • Single Computer Select this option to grant or deny access to a single computer. If you select this option, you must also enter the computer’s IP address.

  • Group of Computers Select this option to grant or deny access to a group of computers. If you select this option you must enter an IP address and a subnet mask.

  • Domain Select this option to grant or deny access to a domain or to multiple sites with similar domain names. If you select this option, you must enter a domain name in the Domain Name box.

  • IP Address If you have selected Single Computer or Group of Computers, enter the appropriate IP address in this box.

  • Subnet Mask If you selected the Group of Computers option, enter the appropriate subnet mask in this box.

  • Domain If you selected the Domain option, enter the domain name in this box. You can include a path within the domain.


Appendix F: WinSock Proxy Service Reference

Appendix F

WinSock Proxy Service Reference

This appendix provides a reference to the property sheets and dialog boxes displayed in Internet Service Manager for the WinSock Proxy service of Microsoft Proxy Server.

Opening the Administrative Interface for the WinSock Proxy Service
WinSock Proxy Service Properties
WinSock Proxy Protocols Properties
WinSock Proxy Permissions Properties
WinSock Proxy Logging Properties
WinSock Proxy Filters Properties

To Top Opening the Administrative Interface for the WinSock Proxy Service

To open the administrative interface for the WinSock Proxy service

  1. From the server’s desktop, click Start, select Programs, and then select the Microsoft Proxy Server program group.

  2. Click Internet Service Manager.

    The Microsoft Internet Service Manager window is displayed

  3. If necessary, connect to the server to be administered. From the Properties menu click Connect to Server and complete the dialog box that appears.

    This step is unnecessary if you are administering the local server.

  4. In the Microsoft Internet Service Manager window, click the server name next to the WinSock Proxy service.

    The WinSock Proxy Service Properties window appears. It contains tabs labeled Service, Protocols, Permissions, Logging, and Filters.

The following table summarizes each WinSock Proxy service property tab.

Property | Description
Service | Use the WinSock Proxy Service property sheet to display the product ID, to add a comment about the server or the WinSock Proxy service, and to edit the Local Address Table (LAT).
Protocols | Use the WinSock Proxy Protocols property sheet to determine which Windows Sockets applications can be used to access the Internet through the WinSock Proxy service on this server, and for each protocol configuration, which ports can be used for outbound and inbound connections.
Permissions | Use the WinSock Proxy Permissions property sheet to determine which users or groups of users can access the Internet by using a particular protocol configuration through the WinSock Proxy service on this server. Permissions are granted separately for each protocol configuration.
Logging | Use the WinSock Proxy Logging property sheet to set the logging options for the WinSock Proxy service. Microsoft Proxy Server can log information about all Internet requests made by clients. It can log to a text file or to a table in an ODBC-compliant database (such as Microsoft Access or Microsoft SQL Server).
Filters | Use the WinSock Proxy Filters property sheet to grant or deny client access to Internet sites. The filtering set here is common to both services. It applies to all users who access the Internet using the Web Proxy or WinSock Proxy services on a server.

To Top WinSock Proxy Service Properties

WinSock Proxy Service Property Sheet
 Local Address Table Configuration Dialog Box
 Construct Local Address Table Dialog Box

To Top WinSock Proxy Service Property Sheet

Use the WinSock Proxy Service property sheet to display the product ID, to add a comment about the server or the WinSock Proxy service, and to edit the Local Address Table (LAT).

To open the WinSock Proxy

  1. In Internet Service Manager, open the WinSock Proxy service for the appropriate server, as described in Opening the Administrative Interface for the WinSock Proxy service.

    By default, the Service tab should be selected.

  2. If it is not already selected, click the Service tab.

The WinSock Proxy Service property sheet has the following elements:

  • Product ID This is the product identification number (product ID) for this copy of Microsoft Proxy Server.

    The product identification number is provided on the Certificate of Authenticity included with each copy of Microsoft Proxy Server. During installation it must be typed into a dialog box of the Setup program.

  • Comment To add or change a comment, in the Comment box type a remark about the server or the WinSock Proxy service. When Internet Service Manager is set to display Report view, the text entered here will appear in the Comments column, next to the WinSock Proxy service for this server.

  • Edit Local Address Table (LAT) Click the Edit Local Address Table (LAT) button to modify the Local Address Table on the server. This table defines the IP addresses of your network, and is used by WinSock Proxy clients to determine whether Windows Sockets connections should be established directly with a server on the private network, or should be redirected to the Internet through the WinSock Proxy service on the server.

To Top Local Address Table Configuration Dialog Box

Use the Local Address Table Configuration dialog box to create a list of the IP addresses that constitute your private network. The information you provide is used to create a table, called the Local Address Table (LAT), that defines your private network.

Each time a Windows Sockets application on a client attempts to establish a connection to an IP address, the LAT is used to determine whether the IP address is on the private network, or is external. If the address is internal, the connection is made directly. If the address is external, the connection is made remotely, through the WinSock Proxy service of Microsoft Proxy Server.

To open the Local Address Table Configuration

  • From the WinSock Proxy Service property sheet, click Edit Local Address Table (LAT).

The Local Address Table Configuration dialog box has the following elements:

  • Edit Use the boxes under Edit to enter a pair of IP addresses to be added to the Internal IP Ranges list. You can add a single IP address by typing the same address in both boxes, or a range of IP addresses by typing the first IP address of the range in the From box, and the last IP address of the range in the To box.

  • From Use the From box to enter the first address of a pair of IP addresses to be added to the Internal IP Ranges list.

    If you are adding a single IP address, enter it here.

    If you are adding a range of IP addresses, enter the first IP address of the range.

  • To Use the To box to enter the second address of a pair of IP addresses to be added to the Internal IP Ranges list.

    If you are adding a single IP address, enter the same address that was entered in the From box.

    If you are adding a range of IP addresses, enter the last IP address of the range.

  • Add Use the Add button to move pairs of IP addresses from the From and To boxes to the Internal IP Ranges list. To add a range of IP addresses to the list, under Edit type a pair of addresses in the From and To boxes, and then click Add. To add a single IP address to the list, under Edit type the same address in both the From and To boxes, and then click Add.

  • Remove Use the Remove button to delete pairs of IP addresses from the Internal IP Ranges list. To remove an IP address or address pair from the list, select it from the Internal IP Ranges box, and then click Remove.

  • Internal IP Ranges Each IP address pair in the Internal IP Ranges list identifies a range of addresses that are part of your private network. Addresses can be added to the list by clicking the Construct Table button, or by typing IP address pairs in the From and To boxes and then clicking Add.

    Note Each IP address pair identifies either a range of addresses, or a single IP address. The second entry is not a subnet mask.

  • Construct Table To generate the list of IP address pairs from internal routing tables used by Windows NT Server, click Construct Table and complete the Construct Local Address Table dialog box that appears.

To Top Construct Local Address Table Dialog Box

Use the Construct Local Address Table dialog box to determine which IP addresses will be added to the Local Address Table (LAT).

To open the Construct Local Address Table dialog box

  • From the Local Address Table Configuration dialog box, click Construct Table.

The Construct Local Address Table dialog box has the following elements:

  • Add the private ranges To add to the LAT three ranges of IP addresses defined by IANA as private address ranges that can be used in a private IP network that is not connected to the Internet, select the Add the private ranges check box.

  • Load from NT Internal Routing Table Click this option to load IP addresses accessible through some or all of the server’s network adapter cards.

  • Load known address ranges from all IP interface cards If you do not know which of the server’s cards are connected to the private network and which are connected to the Internet, select this option. IP addresses accessible through any of the server’s network adapter cards will be added to the LAT.

    However, if you choose this option, after you complete the Construct Local Address Table dialog box and return to the Local Address Table Configuration dialog box you will need to review the generated list of IP ranges. Use the edit controls in the Local Address Table Configuration dialog box to remove any IP address pairs that define external (Internet) addresses. Also add any needed IP address pairs until all addresses of your internal network are defined.

  • Load known address ranges from the following IP interface cards If you know which of the server’s network adapter cards are connected to the private network and which are connected to the Internet, select this option.

    Then, in the list of network adapter cards, select the check box for each of the internally connected cards, and clear the check box for each of the externally connected cards.

  • Network Adapter Cards The server’s network adapter cards are listed below the Load known address ranges from the following IP interface cards option.

    If a network adapter card is connected to the private network, select its check box. The IP addresses accessible through that card will be added to the Local Address Table (LAT). If a network adapter card is connected to the Internet, clear its check box. The IP addresses accessible through that card will be excluded from the LAT.

To Top WinSock Proxy Protocols Properties

WinSock Proxy Protocols Property Sheet
Protocol Definition Dialog Box
Port Range Definition Dialog Box

To Top WinSock Proxy Protocols Property Sheet

Use the WinSock Proxy Protocols property sheet to determine which Windows Sockets applications can be used to access the Internet through the WinSock Proxy service on this server, and for each protocol configuration, which ports can be used for outbound and inbound connections.

To open the WinSock Proxy Protocols

  1. In Internet Service Manager, open the WinSock Proxy service for the appropriate server, as described in Opening the Administrative Interface for the WinSock Proxy service , earlier in this appendix.
  2. Click the Protocols tab.

The WinSock Proxy Protocols property sheet has the following elements:

  • Protocol Definitions This box lists the protocol configurations (supporting Windows Sockets applications) that can be used to access the Internet through the WinSock Proxy service on this server.

    When Microsoft Proxy Server is installed, a default set of protocol configurations are created and will appear in this list. Use the Add, Edit, and Remove buttons to modify the list.

  • Add To configure a protocol and add it to the list of protocols that can be used to access the Internet through the WinSock Proxy service on the server, click Add and complete the Protocol Definition dialog box that appears. The protocol is added to the Protocol Definitions list.

  • Edit To modify the settings for a configured protocol, select a protocol from the Protocol Definitions list, click Edit, and complete the Protocol Definition dialog box that appears.

  • Remove To delete a protocol configuration, select it from the Protocol Definitions list and click Remove.

To Top Protocol Definition Dialog Box

Use the Protocol Definition dialog box to configure protocols for use with the WinSock Proxy service on this computer.

To open the Protocol Definition dialog box

  • From the WinSock Proxy Protocols property sheet, click Add.

    –Or–

    Select an item from the Service Definitions list and click Edit.

The Protocol Definition dialog box has the following elements:

  • Protocol Name Type the name of a protocol definition to be added to the WinSock Proxy service for this server.

  • Initial Connection Use the Initial Connections options to define how each initial connection using this protocol definition will be handled.

  • Port Type the port number that will be used for initial connections by this protocol definition.

  • Type Specify the protocol type that will be used for initial connections. Select TCP (for Transmission Control Protocol) or UDP (for User Datagram Protocol).

  • TCP Select TCP when Transmission Control Protocol should be used for initial connections.

  • UDP Select UDP when the User Datagram Protocol should be used for initial connections.

  • Direction Specify whether the initial connection port will be configured for Outbound or Inbound.

  • Inbound If you selected TCP, select Inbound to allow external sites to initiate connections to clients through the port.

    If you selected UDP, select Inbound to allow the port to pass packets sent from an external site to a client.

  • Outbound If you selected TCP, select Outbound to allow clients to initiate connections to external sites through the port.

    If you selected UDP, select Outbound to allow the port to pass packets sent from a client to an external site.

  • Port Ranges for Subsequent Connections Use the Port Ranges for Subsequent Connections options to define how to handle connections or packets that originate as a result of requests or packets sent on the initial connection’s port number.

    The list under Port Ranges for Subsequent Connections displays the port, packet type, and direction for each existing subsequent connection configuration. (Note that a port range of 0 indicates Any, which permits connections to ports 1024-5000.)

  • Add To specify a port or port range that will be used for subsequent connections, click Add, and complete the Port Range Definition dialog box that appears.

  • Edit To modify the settings for a port range for a subsequent connection, select the port range from the Port Ranges for Subsequent Connections list, click Edit, and complete the Port Range Definition dialog box that appears.

  • Remove To remove a port or port range from the list of those that will be used for subsequent connections, select the port range from the Port Ranges for Subsequent Connections list and click Remove.

To Top Port Range Definition Dialog Box

Use the Port Range Definition dialog box to set the parameters for subsequent connections. Subsequent connections are those that originate as a result of requests or packets sent on the initial connection’s port number. The subsequent connection parameters include the port number or range, the protocol type, and the direction.

To open the Port Range

  • From the WinSock Proxy Protocol Definition dialog box, click Add.

    –Or–

    Select an item from the Port Ranges for Subsequent Connections list and click Edit.

The Port Range Definition dialog box has the following elements:

  • Port or Range In the Port or Range boxes, enter a single port or a range of port numbers to use for subsequent connections.

    Note that you can enter 0 to indicate Any, which allows connections to ports 1024-5000.

  • Type Specify the protocol type that will be used for subsequent connections. Select TCP (for Transmission Control Protocol) or UDP (for User Datagram Protocol).

  • TCP Select TCP when the Transmission Control Protocol should be used for subsequent connections.

  • UDP Select UDP when the User Datagram Protocol should be used for subsequent connections.

  • Direction Specify whether subsequent connection ports will be configured for Inbound or Outbound.

  • Inbound If you selected TCP, select Inbound to allow external sites to initiate connections to clients through the port.

    If you selected UDP, select Inbound to allow the ports to pass packets sent from an external site to a client.

  • Outbound If you selected TCP, select Outbound to allow clients to initiate connections to external sites through the port.

    If you selected UDP, select Outbound to allow the ports to pass packets sent from a client to an external site.

To Top WinSock Proxy Permissions Properties

WinSock Proxy Permissions Property Sheet
WinSock Proxy Add Users and Groups Dialog Box
 Protocol Selection Dialog Box

To Top WinSock Proxy Permissions Property Sheet

Use the WinSock Proxy Permissions property sheet to determine which users or groups of users can access the Internet using a particular protocol configuration through the WinSock Proxy service on this server.

To open the WinSock Proxy Permissions property sheet

  1. In Internet Service Manager, open the WinSock Proxy service for the appropriate server, as described in Opening the Administrative Interface for the WinSock Proxy service , earlier in this appendix.
  2. Click the Permissions tab.

The WinSock Proxy Permissions property sheet has the following elements:

  • Enable Access Control Select this check box to enable access control. With access control, only users who are granted WinSock Proxy permissions can use WinSock Proxy protocols to access the Internet through the WinSock Proxy service. By default this check box is selected.

    Clear this check box to disable access control. Without access control, any WinSock client can access the Internet through the WinSock Proxy service (the WinSock Proxy equivalent of Anonymous access).

  • Protocol This box lists the protocol configurations that have been created for this server and are available to users of the WinSock Proxy service.

    A special selection in the this list, Unlimited Access, allows access to all protocols and all ports of this server. This includes ports not defined in any protocol configuration. Also, users granted Unlimited Access are not affected by WinSock Proxy domain filtering. Grant permission to Unlimited Access only to users who should have such access.

    Note The protocol definitions that appear in the list are added, removed, and modified by using the Protocols property sheet.

  • Grant Access To This box lists the users and groups permitted to use the protocol that is selected in the Protocol box.

  • Add To grant a user or group permission to use a WinSock Proxy protocol to access the Internet, select the protocol from the list in the Protocol box, choose Add, and complete the Add Users and Groups dialog box that appears.

  • Remove To revoke permission to use a protocol, select the protocol from the Protocol list, select one or more users and groups from the list in the box below, and choose Remove.

  • Copy To This button allows you to grant permissions for more than one protocol at a time.

    To grant users access permission for several protocols, select a protocol from the Protocol list, select one or more users and groups from the Grant Access To list, click Copy To, and complete the Protocol Selection dialog box that appears.

  • Remove From This button allows you to revoke permissions for more than one protocol at a time.

    To deny users permission for several protocols, select a protocol from the Protocol list, select one or more users and groups from Grant Access To list, click Remove From, and complete the Protocol Selection dialog box that appears.

To Top WinSock Proxy Add Users and Groups Dialog Box

Use the Add Users and Groups dialog box to grant a user or to a group permission to use the selected protocol configuration to access the Internet through the WinSock Proxy service on the server. You can grant access to users and groups from this server, from the local Windows NT domain, and from trusted Windows NT domains.

Tip It is a good idea to use User Manager for Domains to create a user group containing the user accounts of all users who need access to WWW, FTP, or Gopher. Then, for each protocol, you only have to apply permissions once for the entire group, rather than for each individual member. For more information about user groups and about User Manager for Domains, see your documentation for Windows NT.

To open the Add Users and Groups dialog box

  1. In the WinSock Proxy Permissions property sheet, select a protocol from the Protocols box.

  2. Click Add.

The Add Users and Groups dialog box has the following elements:

  • List Names From Select a computer or domain. The groups of that domain will be listed in the Names box.

  • Names Lists the groups of the selected computer or domain. If Show Users has been clicked, also lists user accounts.

    Local groups (as distinct from global groups) are a special case. When an asterisk (*) appears next to a domain or computer name in the List Names From box, it indicates that the local groups of that domain or computer can be listed in Names. When the asterisk is absent, it indicates that local groups cannot be listed.

  • Add After selecting users or groups in Names, click Add to move the names to the Add Names list.

  • Show Users By default, only groups are listed in Names. Select Show Users to also display user accounts in Names.

  • Members To view the members of a listed group, select the group in Names and then click Members. The Group Membership dialog box will appear.

  • Search To search for a particular user or group, click Search and complete the Find Account dialog box that appears.

  • Add Names When you click OK, the list of users and groups in Add Names is added to the list in the Permissions property sheet. You choose which users or groups to add to this list. You can add users and groups to the Add Names list by typing the account names (separated by colons); by selecting the names from the Names list and clicking Add; by clicking Search and completing the Find Account dialog box; or by selecting a group from Names, clicking Members, and completing the Group Membership dialog box.

To Top Protocol Selection Dialog Box

Use the Protoc ol Selection dialog box to grant or remove user access permissions for several WinSock Proxy protocols.

In the Permissions property sheet (the window described in the preceding section) you selected one or more users and groups. Now, in the Protocol Selection dialog box:

  • If you clicked Copy To in Permissions, then the protocols you select in this dialog box are the protocols for which those users will have access permissions added.

  • If you clicked Remove From in Permissions, then the protocols you select in this dialog box are the protocols for which those users will have their access permissions revoked.

To open the Protocol Selection dialog box

  1. In the Permissions property sheet, select a protocol from the Protocols box.
  2. From the Grant Access To list, select one or more users and groups.
  3. Click either Copy To or Remove From.

To Top WinSock Proxy Logging Properties

Use the WinSock Proxy Logging property sheet to set the logging options for the WinSock Proxy service. Microsoft Proxy Server can log information about all Internet requests made by clients. It can log to a text file or to a table in an ODBC-compliant database (such as Microsoft Access or Microsoft SQL Server).

To open the WinSock Proxy Logging property sheet

  1. In Internet Service Manager, open the WinSock Proxy service for the appropriate server, as described in Opening the Administrative Interface for the WinSock Proxy service.
  2. Click the Logging tab.

The WinSock Proxy Logging property sheet has the following elements:

  • Enable Logging Select Enable Logging to log Internet accesses to a text file, or to a table in a SQL or ODBC-compliant database.

  • Regular Logging Records only a subset of all available information for each Internet access. This option reduces the disk space needed for a log file.

  • Verbose Logging Records all available information for each Internet access.

  • Log To File

    Saves log information to a text file. This text file can be viewed with a text editor, such as Notepad.

  • Automatically open new log file When selected, periodically begins a new log file, using the interval specified by the Daily, Weekly, Monthly, or When File Size Reaches options. When a new log file is started, the old log file is closed (and can optionally be archived on other storage media).

    When cleared, the same WinSock Proxy log file is used continuously.

  • Daily, Weekly, or Monthly Selecting one of these options specifies that a new log file should be started at daily, weekly, or monthly intervals.

  • When file size reaches Starts a new file each time the log file reaches the specified size. The log file will be closed when it reaches this size. Closed log files can then be stored on disk or other media.

  • MB The value in this box determines the file size that, when reached in the current log files, causes a new log file to be started. To change this value, type a number or click the arrows.

  • Log file directory Displays the path where WinSock Proxy log files are written and stored. To change this location, type a new path. Although it is possible to write a log file to another computer on your network, it is recommended that you write your WinSock Proxy log file to the local hard disk of the computer running Microsoft Proxy Server. To help prevent the disk filling up, it is a good idea to store the logs and the Web Proxy cache on different volumes.

    The default is to place WinSock Proxy service text file logs under this path:

    C:\Winnt\System32\Wsplogs.

  • Browse If you want to change the Log file directory but are not sure of the new path, you can click Browse and complete the Select Directory dialog box.

  • Log file name Microsoft Proxy Server generates the WinSock Proxy log file name for you. When WinSock Proxy logs files are opened daily the file name takes the format WSyymmdd.log, where yy is a number representing the year, mm is a number representing the month, and dd is a number representing the day of the month. For weekly logs the format is WSWyymmw.log, where w is a number between 1 and 5. For monthly logs, the format is WSMyymm.log.

    When the Automatically open new log option is selected and a new WinSock Proxy log file is opened each time the log file reaches a specified size, the file name takes the format WSBnnnn.log, where nnnn is a number that increments with each new log. For example, WSB0007.log.

  • Log to SQL/ODBC Database Choose this option to write all Internet accesses to a table in an SQL or ODBC-compliant database. Writing log data to a database is slower than writing to a text file, but data querying and reporting are enhanced by using an SQL or ODBC-compliant database (such as Microsoft SQL Server or Microsoft Access).

    Log files are stored in one table. Each Internet transaction generates one record in the table. The database can exist on the computer running Microsoft Proxy Server or on another computer on your private network.

  • ODBC data source name (DSN) Type the ODBC Data Source Name (DSN) for the database that the WinSock Proxy service will be logging to.

  • Table Type the name of a table in the database. Microsoft Proxy Server will log WinSock Proxy service information to this table.

  • User Name Type a valid user name for the database table.

  • Password If the table is password protected, type the password.

To Top WinSock Proxy Filters Properties

WinSock Proxy Filters Property Sheet
WinSock Proxy Deny or Grant Access To Dialog Box

To Top WinSock Proxy Filters Property Sheet

Use the WinSock Proxy Filters property sheet to grant or deny client access to Internet sites. The filtering set here is common to both services. It applies to all users who access the Internet using the Web Proxy or WinSock Proxy services on a server.

To open the WinSock Proxy Filters property sheet

  1. In Internet Service Manager, open the WinSock Proxy service for the appropriate server, as described in Opening the Administrative Interface for the WinSock Proxy service , earlier in this appendix.
  2. Click the Filters tab.

The WinSock Proxy Filters property sheet has the following elements:

  • Enable Filtering Select this option to implement access filtering, which controls client access to Internet sites. You can use access filtering to prohibit access to specified sites or to allow access to only the sites specified. The filtering applies to all users who access the Internet through this server.

  • Granted When this option is selected, users who access the Internet through this server are granted access to all Internet sites, except for those that are listed. (Access is denied only for the listed sites.)

  • Denied When this option is selected, users who access the Internet through this server are denied access to all Internet sites, except for those that are listed. (Access is granted only for the listed sites.)

  • Except to those listed below The list displays the exceptions to the selected option (Granted or Denied). To change the list, use the Add, Edit, or Remove buttons.

  • Add To add an item to the list of exceptions, choose Add and complete the dialog box that appears.

  • Edit To alter a listed item, select it, choose Edit, and complete the dialog box that appears.

  • Remove To remove an item from the list of exceptions, select the item and click Remove.

To Top WinSock Proxy Deny or Grant Access To Dialog Box

If the Granted option in the Filters property sheet is selected, use the Deny Access To dialog box to specify an Internet site that all users of a server will not be allowed to access. If the Denied option in the Filters property sheet is selected, use the Grant Access To dialog box to specify an Internet site that all users of a server will be allowed to access.

Note that for the WinSock Proxy service, filtering by domain name does not affect Internet requests where the client application accesses a site using an IP address. To effectively filter a site you may find it useful to create filters both on the domain name and the IP address.

To open the Deny Access To or Grant Access To dialog box

  • From the WinSock Proxy Filters property sheet, click Add.

    –Or–

    From the WinSock Proxy Filters property sheet, select an item from the Except to those listed below list and click Edit.

The WinSock Proxy Deny Access To or Grant Access To dialog box has the following elements:

  • Single Computer Select this option to grant or deny access to a single computer. If you select this option, you must also enter the computer’s IP address.

  • Group of Computers Select this option to grant or deny access to a group of computers. If you select this option you must enter an IP address and a subnet mask.

  • Domain Select this option to grant or deny access to a domain or to multiple sites with similar domain names. If you select this option, you must enter a domain name in the Domain Name box.

  • IP Address If you have selected Single Computer or Group of Computers, enter the appropriate IP address in this box.

  • Subnet Mask If you selected the Group of Computers option, enter the appropriate subnet mask in this box.

  • Domain If you selected the Domain option, enter the domain name in this box. You can include a path within the domain.


Appendix G: IIS Considerations

Appendix G

IIS Considerations

The Default Configuration
 Publishing to the Internet
Publishing On Your Private Network

To Top The Default Configuration

Microsoft Proxy Server must be installed on a server that already has Microsoft Internet Information Server (IIS) installed. When Microsoft Proxy Server is installed on a server, it configures IIS so that it will not listen to Internet requests (requests sent to the IP address of the server’s network adapter card that is connected to the Internet). In this default configuration, requests from Internet clients are ignored. IIS cannot publish to Internet clients, but can publish to private network (internal) clients.

To Top Publishing to the Internet

Internet Publishing with Microsoft Proxy Server
How to Enable Publishing to the Internet
 Further Suggestions Before Publishing

To Top Internet Publishing with Microsoft Proxy Server

The Microsoft Proxy Server was designed primarily to manage outbound connections and performance for internal clients on a private network accessing Internet services. Although it offers increased security for your network, using a gateway computer running Microsoft Proxy Server for Internet publishing is not a preferred solution.

If you do decide to use Microsoft Proxy Server and IIS together for external Web publishing, it is recommended that you use different computers for Microsoft Proxy Server and IIS whenever possible.

If you have a small network and server costs are a primary concern, you may want to consider hosting your organization’s Web site by using leased server space available through your Internet service provider. Many ISPs offer this type of hosting service to businesses for a fixed monthly rate. For larger networks, where server security is of primary concern, consider carefully the possible consequences of combining Web servers publishing to the Internet, and the need for maintaining security and privacy for your internal network.

The following sections discuss steps needed to configure Microsoft Proxy Server for external publishing to the Internet. Also, a number of suggestions are provided to help you in making your private network secure when publishing on the Internet.

To Top How to Enable Internet Publishing

  1. From Internet Service Manager, double-click the computer name next to the Web Proxy service.

    The Service Properties window appears. Make sure the Service tab is selected.

  2. Set the Enable Internet Publishing option.

    By default, this option is cleared. Selecting this option allows IIS to listen on port 80 of the server’s network adapter card that is connected to the Internet, allowing Internet Web clients to access published documents on this server. Clearing this option prevents the WWW service of IIS from publishing to the Internet.

    Note This option has no effect on FTP or Gopher publishing to the Internet using ports 21 and 70 respectively. FTP and Gopher services do not distinguish between internal and external publishing. To restrict access from the Internet to these services other security measures should be used, such as setting ACL permissions for FTP or Gopher published files. Also, it is recommended that if FTP or Gopher services are not used, these services should be turned off using Internet Service Manager to stop each service.

  3. From the Services tab, click OK.

    The Internet Service Manager window returns.

Warning Publishing on the Internet compromises gateway security and increases the exposure of your private network to external users.

When Microsoft Proxy Server is used to service outbound proxy connections, your network and server are not continuously present or visible to Internet users. When Web publishing is allowed, your server maintains a continuous presence on the Internet and can allow users to try random or varied methods for intrusion to your network. Also, where interactive scripts or programming extensions (such as CGI or ISAPI DLLs) are used to allow dynamic changes in Web published content, the possibility exists for users to search out server security leaks through Web server applications that are not thoroughly tested or carefully designed.

To Top Further Suggestions Before Publishing

If you are further considering using Microsoft Proxy Server for your Internet publishing server, the following is a list of items that suggest some ways to further secure your private network when doing so.

  • Never add external IP addresses used on the Internet to the Local Address Table (LAT) on the Microsoft Proxy Server.

    Whether you are considering publishing to the Internet or not, adding external IP addresses to the LAT exposes your entire private network to Internet servers and clients. This can severely jeopardize your private network’s security.

  • Separate Microsoft Proxy Server and IIS publishing onto different computers or separate domains.

    If your private network is large enough and you have multiple Windows NT domain servers, consider creating a separate domain for all computers running Microsoft Proxy Server and those running IIS for external publishing. By using separate Windows NT domains and establishing a single, one-way trust relationship between the Microsoft Proxy Server domain and another internal domain, you can further restrict access to your private network.

    For example, if you have an internal domain named CORPORATE established for internal Windows NT-based servers on your private network, you might add a new domain named PROXY to include the computer running Microsoft Proxy Server and any IIS-based servers publishing to the Internet. By setting a single domain trust relationship where the PROXY domain trusts the CORPORATE domain, you can allow users on your internal network to have fully assignable access permissions to Microsoft Proxy Server services on the PROXY domain, but restrict Internet users from accessing resources on the internal CORPORATE domain.

  • Set default access to shared volumes and directories to read-only access.

    Use Windows NT Explorer to set up default sharing permissions for all users and limit external user logons.

    Set a default Access Control List (ACL) for all URL cache and IIS publishing directories (such as C:\Winnt\System32\Inetsrv\Wwwroot) on the Microsoft Proxy Server to allow Read Access for Everyone.

  • Do not use network drive mappings.

    Network drive mappings to other remote servers on your internal network should not be used. This is critically important if you are also using the same computer for Microsoft Proxy Server and for Web publishing with IIS.

  • Avoid publishing with active scripts or input forms.

    If you choose to combine external Web publishing with Microsoft Proxy Server, it is better to avoid using active HTML-based scripts when publishing Web documents. Active HTML-based scripts can include any Common Gateway Interface (CGI), Visual Basic (VB), ActiveX, or Java scripts or forms that are used in your Web publishing. If scripts are used in Web publishing, be sure that Windows NT File System (NTFS) partitions are used to secure script directories.

  • Enable auditing of all system and critical directories for server volumes.

    For more information on setting up auditing of Microsoft Proxy Server server volumes, see “Server Administration.”

To Top Publishing on Your Private Network

You can use the copy of IIS that is on the same computer as Microsoft Proxy Server to publish to private network clients with no effect on gateway security.


Appendix I, Web Proxy Messages

Appendix I

Web Proxy Messages

Web Proxy Service Messages
Web Proxy Client Messages

To Top Web Proxy Service Messages

Web Proxy service messages listed in this appendix are displayed at the server computer as pop-up messages, or are registered in the Windows NT system log. Entries to the Web Proxy service log appear under the source name of WebProxyLog in the Windows NT system log. The Windows NT system log can be viewed by using Event Viewer.

The Web Proxy service returns many messages in the following general format:

Message text error number.

Where

Message text is the explanatory message.

error number is a Windows NT error code number.

Not all error messages follow this format. For information about Windows NT error codes, see your documentation for Windows NT Server 4.0.

Following are the Web Proxy Service messages.

Logging information failed. The log object was never created possibly due to wrong configuration.

Information for configuring service logging may be missing or incorrect.

Using Internet Service Manager, verify that logging information for the service is entered correctly on the Logging property sheet in the Web Proxy service properties. Also, verify that the database is using the same settings for data source, table name, and user name as specified for Web Proxy service.

The creation of log context failed. The data is error code.

Information for configuring service logging may be missing or incorrect.

Verify that logging information for the service is entered correctly in the Web Proxy service properties by using Internet Service Manager, or you can view or change the registry entries for logging with this service by using the Registry Editor. Also, verify that the database is using the same settings for data source, table name, and user name as specified for Web Proxy service.

The parameters specified for logging are too long. Field: fieldname; Data Given: data.

The database table used for service logging requires an adjustment. Either the field is not long enough to contain the data, or the field type is incorrectly set in the database design.

Check the database configuration to see that table fields and data types declared for each field are entered correctly. For more information on setting up SQL or Access database tables for service logging, see “Monitoring.”

The server resumed request logging.

The Web Proxy Server was able to resume service logging without intervention.

No further action is required.

The server was unable to add the virtual root rootname for the directory directoryname due to the following error: number. The data is the error code.

The directory name is not recognized for the server volume specified in the virtual root mapping.

Check that the directory name entered for drive mapping is correct.

The server was unable to continue request log owing to failure indicated by error code in data. Additionally it received error message: number.

An error in service logging occurred for the Web Proxy service.

Contact your support provider for further assistance. Be sure to note the exact message text encountered and the number returned with the message.

The server was unable to find the log file directory directoryname. The data is error code.

The log file directory is either missing or has been incorrectly set for Web Proxy service properties.

Use Internet Service Manager to verify that the log file directory is set correctly on the Logging property sheet in Web Proxy service properties. Also, verify that the specified directory exists, and recreate the directory if necessary.

The server was unable to load ODBC32.DLL for SQL logging due to the following error: number. The data is the error code.

The specified dynamic-link library (DLL) could not be located in the current system path.

Verify the existence of the specified DLL in the Windows system directory. The system directory is typically C:\Winnt\System32.

The server was unable to logon the Windows NT account accountname due to the following error: number. The data is the error code.

The account name entered is not an account recognized by Windows NT.

Make sure the user name used is correctly entered.

The server was unable to open ODBC Data Source sourcename, Table: tablename, under User Name username. The ODBC Error is: number. The data is the error code.

The ODBC specified data source could not be opened because it does not exist or because the table and user name information is incorrect.

Use Internet Service Manager to verify that the ODBC Data Source, Table, User Name, and Password items are correctly entered on the Logging property sheet for Web Proxy Service properties. Check that the ODBC database is ready to accept logging.

The server was unable to register the administration tool discovery information. The administration tool may not be able to see this server. The data is the error code.

The server failed to register on the network.

Check for a server name conflict on the Internet.

W3PCache corrected a corrupted or old format URL cache by removing all or part of the cache’s contents.

Some cached objects have been deleted or removed from the cache and no further action is required. If message reoccurs, you can type chkdsk /r at an MS-DOS command prompt to locate disk errors and recover readable information for the disk drive.

W3PCache failed to initialize the URL Cache on disk.

Use Internet Service Manager to stop the Web Proxy service. Correct cache settings by selecting Reset Defaults from the Caching property sheet. Restart the Web Proxy service. If initialization fails, run Setup and select the Reinstall option.

If the problem continues you can also try running chkdsk /r to recover readable information, or deleting the cache directories and moving the cache to a different drive location. (Note: You must stop the WWW service before you can delete Web Proxy cache directories.)

W3PCache initialization failed due to incorrect configuration. Please use the administration utility or manually edit the registry to correct the error and restart the service.

Use Internet Service Manager to stop the WWW Service. This will also stop the Web Proxy service. Correct cache settings by selecting Reset Defaults from the Caching property sheet in the Web Proxy service properties. Restart the WWW Service. If cache initialization still fails, run Setup and select the Reinstall option.

If the problem continues, repeat the previous steps to stop the WWW service again, and delete the cache directories before running Setup to select the Reinstall option.

W3Proxy failed to start because the system time is incorrect.

The date and time on the server’s system clock is not correct and must be adjusted before the service can be started.

Reset the time and date for the server using the Date/Time application. This can be done by double-clicking the time display located in the Taskbar, or by selecting and double-clicking the Date/Time application icon in Control Panel.

If the time and date do not remain set, check for other contributing factors, such as incorrect time serving from another domain server, or if CMOS battery failure has started to occur on the server hardware.

To Top Web Proxy Client Messages

The following is a listing of messages that are returned by Internet Information Server (IIS) services and can be seen by Web Proxy clients. These messages can appear to users during Web Proxy connections to use FTP, Gopher, or World Wide Web (WWW) services. Also, some messages are general in nature and common to all of these IIS services. The service that returns the message is noted with each entry in brackets, such as:

[Gopher Service]

where the message is specific to use of a Web Proxy connection to access Gopher services for IIS.

For HTTP browser messages, all client messages are of the form:

The Proxy Server has encountered an error. message-text.

Where message-text is a brief explanation of the error message. Use the text displayed to refer to more specific information about each message as it appears in the following listing.

A connection with the server could not be established.

[IIS - All Services]

The server specified for connection is not responding or not available.

Check that the server name was entered correctly, and that the server has available connections.

A Gopher protocol error occurred.

[Gopher Service]

Verify the server supports the same version of Gopher protocol used by the client. In some cases, protocol errors can occur between a server that supports only standard Gopher and a client that uses Gopher Plus.

A protocol with the required capabilities was not found.

[IIS - All Services]

Microsoft Proxy Server does not support the requested protocol.

You can try entering the request again. First, verify that the protocol is a supported type such as http://, ftp://, or gopher://.

Access is denied

[WWW Service]

HTTP Error 5. This error indicates a security or permissions violation has occurred for the browser client. The server has been configured to deny access to the site URL requested.

Choose the OK button.

An error was detected while parsing the data.

[Gopher Service]

May indicate a problem with the Gopher server being accessed remotely.

Try later. Also, verify the server supports the same version of Gopher protocol used by the client. In some cases, protocol errors can occur between a server that supports only standard Gopher and a client that uses Gopher Plus.

An internal error occurred in the Proxy Internet extensions.

[IIS - All Services]

An error in software occurred for a Proxy Internet extension application needed for the current operation.

Contact your Microsoft support provider.

No more Internet handles can be allocated.

[IIS - All Services]

The Internet server does not have enough available resources to support the request for service at this time.

Try again later.

The access code is invalid

[WWW Service]

HTTP error 12. This error occurs when a client is attempting to connect by using the Internet port and the access to the proxy is invalid. It may be caused by a Local Address Table (LAT) configuration problem.

Copy the Msplat.txt to the client directory from the share source path on the Microsoft Proxy Server (typically C:\Msp\Clients).

The connection with the server was reset.

[IIS - All Services]

The connection was cleared at the server, or the server was shut down.

To complete the request, you will need to reconnect to the server and retry your request.

The connection with the server was terminated abnormally.

[IIS - All Services]

The server or the network was stopped without warning.

To complete the request, you will need to reconnect to the server and retry your request.

The FTP session was terminated.

[FTP Service]

The connection was closed, either because of a possible attempted security violation, or a timeout on the remote server.

Reconnect to the server or check for server availability. No further action is required.

The length is incorrect for the option type.

[IIS - All Services]

The length of the specified option in bytes is incorrect.

Reselect the current option and enter the data again while verifying that extra characters were not entered, and that the value you have entered is within the allowed length.

The locator is invalid.

[Gopher Service]

The locator used is not valid for the remote Gopher server.

Browse the directory and verify the correct path was used to locate the requested file.

The locator must be for a file.

[Gopher Service]

The URL entered is for a directory location and not a file.

Enter a Gopher URL that contains a file name. Browse the directory listing to locate the file.

The locator type is incorrect for this operation.

[Gopher Service]

Indicates a file name or directory name may be applied incorrectly.

Verify that the name used for specifying location is a file or directory name and correctly matched for the operation.

The locator type is not recognized.

[Gopher Service]

Indicates an incorrect Gopher type was used or the Gopher type used is not supported.

Verify that the name used for specifying location is a file or directory name and correctly matched for the operation.

The login request was denied.

[IIS - All Services]

The Internet server logon request was denied. The logon account may have been disabled or login information may have changed.

You can try logging on again to verify that information used was entered correctly. If the problem continues, contact the administrator for the Internet server you are requesting and report the problem.

The object or file requested is not referenced correctly or has been removed from the linked location.

[IIS - All Services]

Typically, this indicates that a hyperlink to another document is incorrect or no longer in effect.

Report the error to the system administrator for the remote server that returned this message. No further action is required.

The operation has been canceled.

[IIS - All Services]

The client or the server canceled this operation.

Clear the message. No further action is required.

The operation timed out.

[IIS - All Services]

The remote server did not respond within the time allowed.

The server may be unavailable at this time. Try again later or contact the server administrator.

The password was not allowed.

[IIS - All Services]

The password specified in the URL was not allowed. The password may have been changed or typed incorrectly.

Try entering the password again. If the problem continues, contact the system administrator for the remote server and report the problem.

The request for an HTTP header is invalid.

[WWW Service]

A header contained within the URL request is not recognized by the remote server.

You can contact the Web server administrator for the site to confirm that your browser is supported. No further action is required.

The request must be for a Gopher Plus item.

[Gopher Service]

The server and client do not support the same version of Gopher protocols.

The client must be modified or upgraded to use Gopher Plus.

The requested attribute was not found.

[Gopher Service]

The attribute requested is supported for Gopher Plus servers and was not found on the server.

Reconfigure the client to use standard Gopher protocol and resend the request.

The requested header was not found.

[WWW Service]

The requested URL contained source information that could not be located by the server.

Reload the document using the refresh function of your Web browser.

The requested operation is invalid.

[IIS - All Services]

The requested operation entered in the URL is not allowed or is not recognized by the remote Internet server.

You can enter the URL again or select a different operation. No further action is needed.

The server does not support the requested protocol level.

[WWW Service]

The protocol type specified in the URL request is not compatible with WWW or Web Proxy services or the requested resource.

Verify that the protocol entered is a supported protocol (such as FTP, Gopher, or HTTP) for proxy service.

The server name or address could not be resolved.

[IIS - All Services]

Find out if DNS, WINS, or DHCP services are in use on the local network. This message could indicate an error in client or server configuration settings for any of these services that are actively in use.

Review the TCP/IP Protocol properties by using the Network application in Control Panel for any of these services.

The server returned an invalid or unrecognized response.

[WWW Service]

The HTTP request could not be fully or correctly interpreted by the server. The request may have become corrupted by transmission errors.

In some cases, reloading the document in your Web browser may correct the problem. If the problem continues, contact your Microsoft support provider.

The server returned extended information.

[IIS - All Services]

Status information about the current connection was returned by the remote server that may or may not interfere with local processing of the client request. Review the request output for more detail.

The specified option is invalid.

[IIS - All Services]

The option requested is not available with your current configuration.

Clear the message and select a different option. No further action is required.

The specified option value can not be set.

[IIS - All Services]

The server does not support this value, or the value was typed incorrectly.

Retry the operation. If you still get this message, ask your network administrator to check the status of the remote computer.

The supplied HTTP header is invalid.

[WWW Service]

A header contained within the URL request is not recognized by the remote server.

You can contact the Web server administrator for the site to confirm that your browser is supported. No further action is required.

The URL does not use a recognized protocol.

[IIS - All Services]

The protocol is not supported or the request was not typed correctly.

Confirm that a valid protocol is used, such as http:// for a Web request.

The URL is invalid.

[IIS - All Services]

The request was not typed correctly.

Type the correct URL and retry.

The user name was not allowed.

[IIS - All Services]

The user name that was specified in URL was not allowed to log on.

Try a different name, or retry the same name after verifying that it is typed correctly.

There is already an FTP request in progress on this session.

[FTP Service]

Wait for the current request to be completed, or disconnect and then reconnect to the FTP server to check for server availability. No further action is required.

There is no more data.

[Gopher Service]

No more data exists beyond the last block of data returned from the server.

Stop the request for additional data by canceling the operation in progress.

Windows Internet Extension support has been shut down.

[IIS - All Services]

An Internet Extension application is required to complete the current operation.

Open the required Internet Extension application, then reselect this command option.


Appendix J, WinSock Proxy Messages

Appendix J

WinSock Proxy Messages

WinSock Proxy Service Messages Logged to the System

WinSock Proxy Service Messages Displayed to Clients

To Top WinSock Proxy Messages Logged to the System

Entries to the WinSock Proxy service log appear under the source name of WinSockProxyLog in the Windows NT system log. The Windows NT system log can be viewed using Event Viewer.

To view system event messages with Event Viewer

  1. From the server’s desktop, click Start. Select Programs, and then select Administrative Tools.

  2. Click Event Viewer.

    The Event Viewer window appears.

  3. Select Log from the menu. Click System to view the system log.

    The system log view appears.

  4. To view Event Detail window, select a message from the event listing and double-click it.

    The event detail for the message will appear.

Read the message description in the Descriptions window for more information on each specific message found in the system log.

The following is an alphabetized listing of messages logged by the WinSock Proxy service to the Windows NT system log.

Client from hostname attempts to access WinSock Proxy server using control protocol version number. The server supports version number.

The client is not using a compatible control protocol version for use with the server.

Modify the client TCP/IP control configuration to use the same version supported by the server.

Incorrect network configuration. None of server’s addresses is internal.

An IP address configured for the internal network adapter card for the server needs to be included within the Local Address Table (LAT) for the server.

Replace or modify the LAT in C:\Msp\Msplat.txt on the server.

The perfmon DLL for Remote WinSock failed because the function functionname failed. The data is the error.

System dynamic-link libraries (DLLs) needed for performance monitoring of the service may be missing or cannot be located on the system.

Confirm that the required DLL, Wspsperf.dll, is available in the Windows system directory (typically, this is the C:\Winnt\System32 directory). If it is missing, run Setup again and select Reinstall to repeat the last installation, restore the missing DLL file, and reinitialize service settings.

The WinSock Proxy service requires Windows NT Server.

Microsoft Proxy Server requires Windows NT Server version 4.0.

Install Microsoft Proxy Server on a computer that is running Windows NT Server 4.0 or upgrade the existing computer to Windows NT Server 4.0.

User username at host hostname has timed-out after number seconds of inactivity.

The WinSock Proxy service discontinued the listed connection because no response was received within current time-out limits.

For use of WinSock Proxy with Remote Access Service (RAS) to remote clients at a distance, try increasing the RAS time-out parameters. For more information on increasing timeouts or configuring RAS parameters, see your documentation for Windows NT Server 4.0.

WinSock Proxy Server failed to bind its socket. The data is the error. This could be caused by another service that is already using the same port.

The requested service port is already in use, or data loss may have resulted from a large number of packet collisions on the local network segment.

Monitor the application service that failed for the server and the client, or monitor traffic on your local network.

WinSock Proxy Server failed to determine network addresses.

The IP addresses used to establish a connection could not be located on either the internal or external network.

Verify that the Local Address Table (LAT), C:\Msp\Msplat.txt, is correct for the server. Confirm that there are no discrepancies between the LAT in use for both the server and the client by manually copying the LAT from the server to the client. If the error persists, verify that the correct IP address settings are in use for the client.

WinSock Proxy Server failed to initialize. The data (if any) is the error.

The service was unable to process the client request, possibly because of missing system files or configuration settings.

Use Internet Service Manager to restart the WinSock Proxy service. If the error continues, run Setup again and select Reinstall to repeat the last installation and restore missing files and settings.

WinSock Proxy Server failed to initialize because of bad registry. The data is the error.

The service was unable to process the client request, possibly because of missing or corrupted registry settings.

Use Internet Service Manager to restart the WinSock Proxy service. If the error continues, run Setup again and select Reinstall to repeat the last installation and restore missing files and settings. If the condition persists, restore the registry or affected keys on the server.

WinSock Proxy Server failed to initialize the network. The data is the error.

The service was unable to process the client request, possibly because of missing or corrupted network settings.

Stop and restart the network and all other Internet services on the computer running the WinSock Proxy service. If the condition persists, check for physical problems, such as cabling or termination faults on the local network segment.

WinSock Proxy Server failed to load security DLL.

The server requires a security DLL to be loaded and active to process clients. The required DLL is missing or cannot be found.

Check that Security.dll is located in the Windows NT system directory (typically, the C:\Winnt\System32 directory), and then restart the WinSock Proxy service.

WinSock Proxy Server failed to start because the system time is incorrect.

The date and time on the server’s system clock is not correct and must be adjusted before the service can be started.

Reset the time and date for the server by using the Date/Time application in Control Panel. If the time and date do not remain set, check for other contributing factors such as incorrect time serving from another domain server, or CMOS battery failure on the server hardware.

WinSock Proxy Server has failed due to a shortage of available memory. The data is the number of connections.

The server computer cannot support additional connections for the service because of lack of available resources.

Check the number of current connections in use on the server and server memory usage.

WinSock Proxy Server was unable to initialize due to a shortage of available memory. The data is the error.

The server computer cannot initialize service because of lack of available memory on the server.

Check for available memory and memory usage on the server. To view server memory usage, open Windows NT Diagnostics and select the Memory property sheet. If the available memory displayed is low or if further memory errors occur, close all other applications not required on the server or consider adding memory to the server computer.

WinSock Proxy Server was unable to initialize performance counters. The data is the error.

System DLLs needed for performance monitoring of the service may be missing or cannot be located on the system.

Check that the required DLL, Wspsperf.dll, is available in the Windows system directory (typically, this is the C:\Winnt\System32 directory). If it is missing, run Setup again and select Reinstall to repeat the last installation, restore the missing DLL file, and reinitialize settings.

To Top WinSock Proxy Service Messages Displayed to Clients

The following is a list of messages that are returned and displayed to clients by the WinSock Proxy Server.

A cross-device link exists.

A device on the remote server system that is required for this operation could not be accessed for the current connection.

Confirm that the device is available and not already in use by other connected sessions elsewhere.

A data source on the remote server could not be obtained.

The data source may be incorrectly named or no longer available.

Verify that the data source has been correctly specified and has not been renamed or relocated. Check with your database administrator to see that the remote database server is available.

A resource deadlock would occur.

The requested operation cannot be completed because sufficient resources do not exist or are not available on the local system.

Close other applications to free resources or restart the system. If the problem continues, contact help-desk personnel to check your computer’s configuration.

Accessing a corrupted shared.

Most likely, there are disk errors on the remote drive. In some cases, the file system may be of an unrecognized or unsupported type for the current application or platform.

Check that the remote disk drive is not corrupted, and review installation requirements for the current application.

Address is already in use.

The requested address cannot be obtained because it is in use elsewhere on the network.

Check that network address settings for the client are correct for the local network. Assign a different fixed network address to the client. Contact the network administrator for further assistance in resolving address duplication on the local network.

Address family is not supported by protocol family.

The network address provided is not correct or is not supported for the local network.

Make sure that the address is of the correct format and has been typed correctly before retrying the operation. If the problem continues, report the problem to your network administrator or to technical support.

Advertise error encountered.

Indicates that a network shared resource could not advertise service on the local network, possibly because of network or routing problems, or because packet filtering is being applied.

Check that the network is not offline. Also, verify that any routing advertising protocols required, such as Routing Information Protocol (RIP) or Service Advertising Protocol (SAP), are implemented properly on the network, and that the current application requires these routing services. Use other utilities to verify that the shared resource can be accessed or browsed from the network.

An error in type registration occurred.

An error in software has occurred.

Contact technical support and report the problem.

An interrupted system call was received.

The current proxy connection was interrupted, and the socket operation did not complete as expected. The problem could be the current application or a temporary problem or condition on the network.

Check the network connection for the computer or try reconnecting. If the problem continues, contact the network administrator and report the problem. If other network functions are stable and working, report the problem to the supplier of the current application.

An invalid exchange was made.

Indicates an error in the data, or that an exchange between the remote server and the client has been attempted that is not allowed within the software.

Reenter the data and retry the operation. If the problem continues, contact the supplier of the current application to report the problem and obtain a fix or workaround for the problem.

Argument list too long.

The requested operation contained additional information or parameters that could not be processed correctly through the current connection.

Retry the request. If the problem continues, contact the supplier for the current application or technical support.

Attempting to execute a shared library.

An incorrect file type was specified for execution on the system, possibly because a required shared library is missing.

Try reinstalling the current application to restore missing libraries or components. If the problem continues, contact the supplier for the current application to obtain an update, fix, or workaround for the problem.

Attempting to link in too many libraries.

The current operation is attempting to link in libraries that are not permitted by the system or application.

Check that the current platform in use for the application meets the manufacturer’s requirements for installation and that any special additional software and configuration changes have been followed. If the problem continues, contact the supplier for the current application to obtain an update, fix, or workaround for the problem.

Bad address encountered.

The network address used for the remote server is invalid for the current network.

Check to see that the address is typed correctly, and that the remote network address is reachable from the local network before retrying. If the problem continues, contact the network administrator for the remote server and report the problem.

Bad file number encountered.

An error in the software or in accessing the file system has occurred.

Retry the operation. If the problem continues, contact the supplier of the current application and report the problem.

Bad font file format used.

Indicates that a font file is of incorrect format or is outdated.

Contact the supplier of the current application to report the problem and obtain an updated file or workaround.

Bad network address encountered.

The network address used for the remote server is invalid for the current network.

Check to see that the address is typed correctly, and that the remote network address is reachable from the local network before retrying. If the problem continues, contact the network administrator for the remote server and report the problem.

Bad protocol option used.

The application has selected an unsupported protocol for use with this operation.

Check your application for protocol settings, or review documentation included with the application on how to review or change the current settings. If the problem continues, contact the supplier of the current application.

Can’t access a needed shared library.

Software components installed or called by the current application are missing or corrupted, or there may be disk errors occurring.

Reinstall the current application and retry the current operation. If the problem continues, contact the supplier for the current application to obtain an update, fix, or workaround for the problem.

Cannot assign requested address.

A request for a server-provided address was not honored. The address may already be in use elsewhere on the network, or there may not be addresses left to assign for the local subnetwork.

Check network address configuration to verify that the client is configured for dynamic addressing or assign a different address for the client. For networks using DHCP dynamic addressing for clients, check that there are addresses available to assign in the available address pool.

Channel number is out of range.

Indicates that a port or protocol error has occurred in the application or network environment.

Check that all service ports are defined correctly for the application and the WinSock Proxy service. If the problem continues, contact the supplier of the current application.

Communication error in sending.

An error occurred in sending information between the remote server and the local client.

Retry the requested communication. If the problem continues, check for network errors. If there are no significant errors on the network, contact the supplier for the current application and report the problem.

Connection refused.

Connection to the remote server was refused by the server. The server may be busy or there is excess traffic on the network.

Try again later. If connection is still refused, contact your network administrator.

Connection reset by peer.

The current connection has been closed by another peer user or peer server process.

You can attempt to re-establish the connection. Contact your network administrator and report the problem, or check connection logs on other servers on the network for more information.

Connection timed out.

A connection could not be placed between the client and the remote server within preset time allowed for a response. No connection was opened.

Verify that the remote server and the client are present on the network and configured properly. You may also try increasing the connection time-out interval for the current client or application if it supports adjusted time-out values.

Cross mount point achieved.

An error in accessing a device used for the current operation occurred or the device is already linked elsewhere.

Restart the system and reattempt the operation. If the problem continues, contact the supplier for the current application and obtain an update, fix, or workaround.

Current version is not supported.

The application is using a later version of Windows Sockets, which is not supported.

Check to see if the application is using Windows Sockets 1.1-compatible remote procedure calls, or use an earlier version of the application that supports Windows Sockets 1.1 calls.

Destination address required.

No IP or DNS network address for the remote server was provided.

Enter the address for the remote server and resubmit the remote command request.

Device is not a stream.

Indicates an error in the data, or that an exchange between the remote server and the client has been attempted that is not allowed within the software.

Re-enter the data and retry the operation. If the problem continues, contact the supplier of the current application to report the problem and obtain a fix or workaround for the problem.

Directory is not empty.

The directory cannot be removed. It still contains other files or subdirectories.

Move or delete the other files or subdirectories and try the operation again.

Disk quota exceeded.

The operation required the use of additional disk space not authorized by the server.

Cancel current disk operation and change file share permissions to allow more space for the current user.

EPROCLIM returned.

A software error occurred.

Exit the current application and restart it. If the problem continues, contact the supplier of the current application.

ESTALE returned.

An unexplained service error occurred in the current environment.

Exit the application and restart it. If the problem continues, contact the supplier for the current application.

EUSERS returned.

A software error occurred.

Exit the current application and restart it.

Exchange is full.

Indicates an error in the data, or an exchange between the remote server and the client has been attempted that could not be completed. The system may be too busy to process the request at this time.

Retry the operation later. If the problem continues, contact the supplier of the current application to report the problem and obtain a fix or workaround.

Executed format error.

A software error has occurred.

Retry the operation. If the problem continues, contact the supplier of the current application and report the problem.

Failure in streams buffer allocation.

There is insufficient buffer space available to maintain the currently streamed connection.

Increase the allocated space for streams buffers on the server. For more information on setting TCP or UDP buffer size for clients from within the registry on the server for use with the WinSock Proxy Service, see Appendix A, “Registry Entries.”

File already exists.

The attempt to create or save a file on the remote server cannot be completed because a file using the same name already exists on the remote volume at that path.

Save the new file under a different name, or delete or rename the old file.

File is too large.

Indicates that a disk restriction did not permit the file operation to be completed. Possibly a disk quota has been set for the destination directory, or there is a lack of available space on the targeted drive.

Check that sufficient space is available on the drive, and that disk space restrictions are not in effect for the directory.

File table has overflowed.

Probably indicates that the current operation has exceeded available disk capacity or other resources on the system.

Clear the message and verify that sufficient disk space and resources are available on the local system before retrying.

Host is down.

The remote host is not reachable at this time or has been shut down.

Contact your network administrator to confirm status of the remote host.

Host is unreachable.

The remote host is not reachable at this time or has been shut down.

Contact your network administrator to confirm status of the remote host.

Host was not found.

The remote server requested could not be located.

The server may be offline or relocated. Try again later or check with the server administrator to see if the server is offline or relocated under a different network name or address.

ICMP network is unreachable.

Probably indicates that a routing failure has occurred.

Investigate routers on local or remote networks to see that they are active and properly configured.

ICMP port is unreachable.

The remote server port is not responding.

The remote server may be unreachable because of hardware failure or because a nonexistent address was specified. Confirm that the address entered for connection is correct and retry the operation. If the problem reoccurs, contact the network administrator for the remote server.

ICMP protocol is unreachable.

The remote server is not responding.

The remote server may be unreachable because of hardware failure or because a nonexistent address was specified. Confirm that the address entered for connection is correct and retry the operation. If the problem reoccurs, contact the network administrator for the remote server.

Identifier removed.

Some identifying information for the connecting socket is missing or was parsed in communications transfer or operation. The cause could be a software problem or an intermediate device used to service the connection.

Retry the operation. If the problem continues, contact the supplier of the current application. Also, when troubleshooting the network, check for invalid packet errors on network data communicating equipment. If unusual numbers of errors are occurring, interference on cabling or data lines is a possible cause.

Illegal seek performed.

Indicates a possible error in file shared permissions or possible errors in the file table.

Verify that permissions are set. If the problem continues, verify the integrity of the disk by using appropriate utilities for the disk operating system in use.

Inode is remote.

Input for the current operation could not be obtained from a remote source.

Contact the supplier of the current application to obtain and report the problem.

Invalid argument.

The requested operation contained additional information or parameters that could not be processed correctly through the current connection.

Retry the request. If the problem continues, contact the supplier for the current application or technical support.

Invalid argument used.

The requested operation contained additional information or parameters that could not be processed correctly through the current connection.

Retry the request. If the problem continues, contact the supplier for the current application or technical support.

Invalid Ethernet packet in use.

Indicates a problem with packet formation or possible configuration problems with a router.

Check the client’s network configuration to confirm that the frame type selected for use matches the frame type used by servers on the local network. If the problem continues, review local router configuration for packet-length settings, or use a packet analysis tool to further investigate packet framing that is currently in effect on the network.

Invalid request code used.

Indicates the requested operation is not recognized or supported by protocol services in use between the remote server and the client.

Confirm that the protocol and port types are configured for WinSock Proxy service correctly for use with the current application, specifically any port types (UDP or TCP), port initial direction (inbound or outbound), and port numbers in use for the connection. If the problem cannot be traced to port settings or if the problem continues, report the problem to the supplier of the current application in use for the remote task.

Invalid request descriptor used.

Indicates an error in the data, or an exchange between the remote server and the client has been attempted that is not allowed within the software.

Reenter the data and retry the operation. If the problem continues, contact the supplier of the current application to report the problem and obtain a fix or workaround for the problem.

Invalid slot used.

Indicates a configuration error in hardware settings has been applied by the current operation.

Review any settings used for hardware device access or communication within the application to ensure settings are correct.

I/O error encountered.

The problem could be caused by instability in the local system environment itself.

Exit the application and reboot the computer. Try the operation again. If the problem continues, contact technical support and report the problem.

IP Subnet table is full.

The address table for routing hosts on the network indicates that all addresses on this subnetwork are in use.

Rebuild routing tables for affected hosts, or assign the host to a new subnetwork with available address space.

Is a directory.

A directory object has been selected for the current operation where a file was expected.

Select a file to complete this operation, or cancel. No further action is required.

Is not a directory.

A file object has been selected for the current operation where a directory was expected.

Select a directory to complete this operation, or cancel. No further action is required.

Is not a typewriter.

The current configuration does not support the attempted method of input.

Refer to usage instructions for the current application or contact the supplier of the application and report the problem.

Level 2 halted.

Indicates a problem has occurred at the data-link level, or the link connection has been cleared.

Check for errors logged for data link or data communications hardware devices. Report the line to your appropriate service provider for further assistance in resolving the problem.

Level 3 halted.

Indicates the network has been stopped. The current connection has most likely failed.

Check the client network connection or have the client reconnect to the network. If the message is repeated for other clients, check for problems in network cabling or termination, or that network hardware or software has not been stopped.

Level 2 is not synchronized.

Indicates a dateline problem for the current connected operation, possibly because of noise or interference on the line itself.

Check for performance problems or further errors on the line. Report the line to your appropriate service provider for further assistance in resolving the problem.

Level 3 reset.

The network has been reset, probably because an intermediate network host servicing the current connection, such as a router, was reset. The current connection has failed.

Reestablish the remote connection. If the problem continues, watch for errors or excess traffic on the network.

Library section in code file corrupted.

Software components installed or called by the current application are missing or corrupted, or there may be disk errors occurring.

Reinstall the current application and check the system for disk errors by using disk utilities appropriate for the current disk operating system. If the problem continues, contact the supplier for the current application to obtain an update, fix, or workaround for the problem.

Link number is out of range.

The number specified for linking is invalid. The link is broken.

You can attempt to recreate the link using the options within the application. If the problem continues, contact the supplier of the current application and report the problem.

Log name used is not unique.

The service is attempting to name a log using a file name that is already in use at the service logging path.

Rename or delete the previous log file or select a different name for the new log file.

Machine is not on the network.

The local computer is not connected to the network.

Connection to the network must be made first before the request can be processed.

Math argument used.

The input for the current operation was of an invalid type or unexpected for the current application, possibly because of an error in the data or software-based restrictions.

Enter the data again. If the problem continues, contact the supplier of the current application and report the problem.

Message is too long.

The message length exceeds current limits for the application. This could possibly indicate an incorrect protocol setting, or that a mismatched port type is configured between server and client.

Check the server and client configuration to verify that the selected transport is correctly matched to current application. If the problem continues, contact the supplier of the current application.

Mount device or directory is busy.

The remote server drive is unavailable or is possibly out of space.

Wait and retry the requested operation, or contact the administrator for the remote server.

Multihop attempted.

The remote connection attempted to cross an excessive number of intermediate routes between devices. If the connection has multiple routers available for forwarding, this could be an indication of misbehavior by other network forwarding devices, such as routers or bridges on the network.

Check that the maximum number of hops allowed for protocol service with this connection is sufficient. Also check statistics on bridges or routers by using network monitoring tools to see if excessive hop counts have been obtained.

Name entered is too long.

The name entered is incorrect or has too many characters.

Check that the name entered is a valid name. Type the name again and check that no added characters were included.

Network is down.

Problems in maintaining a connection to the local network are probably occurring. The current connection has failed.

Check the client network connection or have the client reconnect to the network. If the message is repeated for other clients, check for problems in network cabling or termination or that network hardware or software has not been taken offline.

Network was reset.

Probably indicates that an intermediate network host servicing the current connection, such as a router, has been reset. The current connection has failed.

Reestablish the remote connection. If the problem continues, watch for errors or excess traffic on the network.

No anode exists.

Indicates an error in the data or an exchange between the remote server and the client has been attempted that is not allowed within the software.

Reenter the data and retry the operation. If the problem continues, contact the supplier of the current application to report the problem and obtain a fix or workaround.

No buffer space is available.

There is no buffer space available to maintain the current streamed connection.

Allocate space for streams buffers on the server. For more information on setting TCP or UDP buffer size for clients from within the registry on the server for use with the WinSock Proxy Service, see Appendix A, “Registry Entries.”

No buffer space is supported.

The application requires the use of buffer space on the remote server to buffer connection throughput.

Check to see if buffer space is adjusted for the server. For the WinSock Proxy service, check the server registry entries for UDP or TCP buffer size and consider increasing these values. For more information on the registry entries for the WinSock Proxy service, see Appendix A, “Registry Entries.”

No children exist for parent object.

An application call to a referenced code library could not complete normally. The application may be missing components needed to complete the request.

Contact the supplier of the current application and report the problem.

No CSI structure is available.

Indicates a specialized component required is missing and the operation cannot be completed within the application in use.

Contact the supplier of the current application to report the problem and find out if there is a fix or workaround.

No data was found.

No data was received for full completion of the current operation.

Enter the data again and retry the operation. If the problem continues, check that connection to the network is still in effect.

No data record is available.

The remote source is empty or the requested data is not available at the specified location.

Make sure that the path to the data location on the remote source was entered correctly.

No message of desired type exists.

Indicates that a message could not be located, or the current application does not support messages of this type. Also, the message type may not be supported for this application.

Check to see if the message exists at the expected source location. If a message exists, contact the supplier for the current application and report the problem, or see documentation specific to the application.

No space is left on device.

Indicates a lack of available space on the destination drive. The file-copy operation could not be completed, possibly because a disk quota has been set for the destination directory path.

Make sure that the amount of disk space is sufficient on the destination drive, and that disk-space restrictions are not in effect for the directory.

No such device exists.

A device by this name cannot be located on the network.

Check that the device name has been entered correctly and that the device is operational and configured properly on the client computer.

No such device or address exists.

The device or address entered cannot be located on the network.

Make sure that the device name or address has been entered correctly and that the device is operational. Check that the address can reply to test utilities such as Ping.exe and is active on the network, or contact the network administrator for the remote device and report the problem.

No such file or directory exists.

The requested file operation could not be completed because the file or directory does not exist on the remote server.

No further action is required.

No such process exists.

The requested operation is not recognized by the remote server. The operation could be the result of errors in data or invalid user input.

Try the operation again. If the problem continues, contact the supplier for the current application and report the problem.

Non-recoverable error encountered.

The WinSock Proxy service encountered a fatal error.

Try restarting the WinSock application on the client and initiating a new connection.

Not enough memory.

Not enough memory is available on the local system to process the current operation.

Close other applications not in use before retrying. If the problem continues, reboot the computer to free memory resources and retry the operation.

Not enough memory is available.

Not enough memory is available on the local system to process the current operation.

Close other applications not in use before retrying. If the problem continues, reboot the computer to free memory resources and retry the operation.

Not Owner.

You do not have permission or ownership rights to access this remote shared resource.

Contact the network administrator for this resource about being added to the permissions list to access this resource.

Operation is already in progress.

The operation attempted has already been issued and is now in progress.

Cancel the new attempt and wait for the previous command to complete.

Operation is in progress.

The operation attempted is still in progress.

Cancel the new attempt and wait for the previous command to complete.

Operation is not supported on socket.

The current operation is not supported for Windows Sockets with the current application.

Check your application settings or contact the supplier for the current application and report the problem.

Operation would block.

The requested operation would prevent an operation already in progress from completing.

Wait for the system to complete processing of the current operation, or cancel the current operation before retrying.

Operation would block one in progress.

The requested operation would prevent an operation already in progress from completing.

Wait for the system to complete processing of the current operation, or cancel the current operation before retrying.

Package is not installed.

The requested feature is not currently installed.

Reinstall the application or upgrade to install the missing application. For more details on this error, see documentation for the current application about support for this or other additional features.

Permission denied.

The remote server refused access to the requested resource.

Contact the administrator for the remote server and report the problem or request permissions to access this shared resource.

Pipe has broken.

The current operation was suspended because of the data or connection in use, possibly caused by a failing network connection or errors on the network.

Reconnect to the remote source. If the problem continues, check for further errors on the network or excessive traffic on the network segment.

Protocol driver is not attached.

There is no driver for a supported protocol bound to the network adapter on the local computer.

Check the network configuration for the local computer. For Windows NT or Windows 95, use the Network application in Control Panel to view or modify current driver and protocol settings. To review the current bindings for the adapter, click the Bindings property sheet in the Network properties dialog box. Make sure that at least one supported network protocol for WinSock Proxy service (either TCP/IP or NWLink IPX/SPX) is bound to the network adapter.

Protocol error encountered.

Indicates a protocol error has occurred in the application or network environment.

Check that all service ports are defined correctly for the application and the WinSock Proxy service. If the problem continues, contact the supplier of the current application.

Protocol family not supported.

The protocol is not defined for use with the WinSock Proxy service.

Add the protocol to the WinSock Proxy Server service. For more information on adding protocols to the WinSock Proxy service, see “Configuring the WinSock Proxy Service.”

Protocol is not supported.

The protocol selected for use with the current application is not supported for WinSock Proxy service or has not been defined to the service.

Check that the protocol used by the current application has been added or defined correctly for use with the WinSock Proxy service. Using Internet Service Manager, check the protocol settings or add the protocol by selecting the Protocols property sheet in WinSock Proxy service properties. Select the protocol from the list and select Edit, or if the protocol is not listed, select Add and add a definition for the protocol.

Protocol is wrong type for socket.

The application requires a socket call that is not supported by the current protocol settings for the client application.

Check the current application settings for the protocol type in use for the remote connection. Also check to see if TCP or UDP protocol support is used for the application and configure accordingly within the WinSock Proxy service. For more information on configuring additional support for other protocol types or adding protocol definitions for the WinSock Proxy service, see “Configuring the WinSock Proxy Service.”

Read-only file system is in use.

The file system that is selected for a file copy or transfer operation does not allow write modification. Permissions may be in effect to prohibit write access, or the drive media may be of a type that does not permit write access.

Check that the drive is using a media type that supports write access, and that write permissions are assigned and in effect.

Remote address changed.

The network address for the remote server has been changed to a different address.

Reconnect to the remote server, or contact the administrator for the remote server to obtain more information about this problem.

Result is too large.

The output for the current operation was invalid for the system or application, possibly because of an error in the data, or software-based restrictions.

Enter the data again. If the problem continues, contact the supplier of the current application and report the problem.

Server mount error.

Indicates that the server is advertising on the network, but a resource on the server is not mounted or otherwise unavailable.

Check for hardware failure on the remote server or to see that the requested server resource is mounted.

Service cannot send after socket shutdown.

The operation to be placed remotely could not be completed because connection for this application has been closed.

Restart the application or place a new connection before retrying the operation.

Socket is already connected.

The current operation is unnecessary. A socket already exists between the client and the remote server.

Clear the message. No further action is required.

Socket is not connected.

The current operation cannot be completed because remote connection has been lost or was not made.

Open a connection to the remote source using the current application. If connected previously, try reconnecting.

Sockets library is not initialized.

Linked libraries for Windows Sockets are not initialized properly for client configuration.

Exit and restart the application. If the problem continues, reinstall the application or contact the supplier for the current application and report the problem.

Socket operation attempted on non-socket.

The selected operation indicates an error caused by the application software occurred in socket creation.

Contact the supplier of the current application to see if an update, fix, or workaround is available for this problem.

Socket type is not supported.

The socket operation attempted is not supported for the current configuration.

Check that the correct transport protocol (TCP, UDP) is selected for use with the current application and also with WinSock Proxy service.

Software caused connection to abort.

Another application process has caused the current connection to fail.

Exit and restart the application, then reconnect. If the problem continues, contact the supplier of the current application and report the problem.

Subnet module not linked.

A required software component is missing or not configured.

Check network configuration settings for the client and try reinstalling the application. If the problem continues, contact technical support for the application in use and report the problem.

System call interrupted.

The current proxy connection was interrupted, and the socket operation did not complete as expected. The problem could be the current application, or a temporary problem or condition on the network.

Check the network connection for the computer or try reconnecting. If the problem continues, contact the network administrator and report the problem. If other network functions are stable and working, report the problem to the supplier of the current application.

System is not ready.

The WinSock Proxy service is not active or is still in the process of starting.

First, check to see if the WinSock Proxy service is stopped or running. Stop and restart the service by using Internet Service Manager, or from the command prompt by issuing the following set of commands:

net stop wspsrv
net start wspsrv

If the error continues, shut down all services on Windows NT Server and reboot.

System is out of streams resources.

Indicates that insufficient streams buffers are available, or that a buffer overrun has occurred.

Increase buffer count for streaming protocol (TCP) or modify the connection rate.

The link has been severed.

The current connection has been broken.

Exit the application and check for other related communications hardware and software failures on the local computer first. Restart the application and retry connecting. If the problem continues, check for other failures on the network or verify that the remote server has not been shut down or removed from the network.

The object is remote.

Indicates the selected object cannot be used for the current operation because it is not locally sourced. The attempt to operate on the remote object was not completed.

Clear the message. No further action is required. If the problem continues, contact the supplier of the application in use.

Timer has expired.

The timeout allowed for this operation expired and the current operation failed.

You may try increasing the time-out parameters for this operation within the application or within your network client configuration to allow a longer delay in responding.

Too many files are open.

The system does not have available file handles to proceed with the current operation. An excessive number of files are currently open or in use by other applications on the system.

Close other applications before retrying. If the problem continues, increase the number of file handles or contact the supplier of the current application and report the problem.

Too many levels of symbolic links.

A software error occurred.

Contact the supplier of the current application.

Too many links used.

You have reached the maximum number of links that can be opened.

Close other connections or applications and retry the operation. If the problem continues, contact the supplier of the current application and report the problem.

Too many open files.

The system does not have available file handles to proceed with the current operation. An excessive number of files are currently open or in use by other applications on the system.

Close other applications before retrying. If the problem continues, increase the number of file handles or contact the supplier of the current application and report the problem.

Too many references used.

The requested operation contained additional information that could not be processed correctly through the remote connection.

Retry the request. If the problem continues, contact the supplier for the current application or technical support.

Try again.

The server was temporarily unable to process the current request. The server may be too busy to process the request.

Try reentering the request, or renewing connection to the server now or at a later time.

Trying to read unreadable message.

The message input has errors or is of an incorrect type to be processed by this operation.

Check the message data for errors or report the problem to the supplier of the current application.

Unknown error number encountered.

An error in software has occurred.

Contact technical support and report the problem.

Unknown I/O control call.

An error in software has occurred.

Contact the supplier of the current application and report the problem.