[deesloop]

I'm trying to get my clients to come throught the corporate ISA proxy for filtered internet access, but cant get it to work.

I've created a specifix BESBrowser account
Enable WAP Config to False.
Allow IBS Browsers to False.
Service Exclusivity Policy Group set Allow Other Browser Services to False.
This should force use of Blackberry browser only.

Then I created
PROXY PROXY server.domain:8080 in Proxy Mappings of MDS components

All the PCS in the company work fine going throught the Proxy. But the end users can still get the internet without going through the proxy. ISA monitor shows no sessions while they are on, and the can browse to unstuiable websites (we use Websense to filter)

Any ideas what to do to fix?


Thanks

[dankarlinski]

Wirelessly posted (White and Nerdy)

Did you remember to push the policy to the end users?

[deesloop]

I didnt know this was part of a policy?
Is it not set in Blackberry solution topology\components\MDS Connection service?
Do I have to do it somewhere else?
Part of the IT policy?

[fadmin]

What is your URL? http:// and https://.* ? Can you browse internet from BES server using IE?

[deesloop]

I can browse from the BES service fine.
IS has proxy settings in it for the besbrowser account.

.*://.*(:\d*)?(/.*)*(\?.*)?

Which is the default, and I thought should just work

Maybe I need to do more?

[fadmin]

Provide some more details such as BES versions, is it running on SBS maybe, what authantication is being used, error you get on BB etc.

[deesloop]

It's a BES 5 server - Version: 5.0.0.137
There are no errors. Basically the handhelds should go out through the
ISA proxy server. However they are not.They can get porn and other stuff
that they should not.

I havent set authentication or snything like that
I've basically only done the steps listed i nthe OP.

I can "Authentication Support enabled" set to no - that must be a default.
Do I need to do more seting changes - either here or i nthe IT policy?

Thanks

[fadmin]

Is ISA on the same server?

[deesloop]

No Isa is elsewhere
I thought what happens is you set up a username and password
Then when a device request a web page it contacts the BES
BEs then tries to get the page using hte credentials I supplies
Then if it works then ISA processes the request

Am I missing somethnig else - I could eaily be as I'm a total Newbie on this.

[fadmin]

On device you have just Blackberry Browser? When you open BB browser and then press menu>Options>General Properties and make sure BB browser is default one and not Internet browser.

[deesloop]

Yep Blackberry Browser is the listed one.

[fadmin]

What proxy type do you have selected in MDS? Proxy or direct or ..?? We don't use ISA proxy and we don't need user name and password to enter to browse Internet. All we need is to allow access to the internet from BES IP address, enter proxy address:port in mds and then proxy filters whatever is allowed or disallowed.

[deesloop]

Proxy type is set to PROXY.
I want them to go through ISA for URL filtering done by Websense.
One day we may well replace websense with a hardware proxy, but not now.

[fadmin]

This sounds to me that your BES setup is ok but it seems that websense does not reckognize traffic from BB browser and just lets it go through. I found this as well that may also confirm this:
http://www.blackberryforums.com/bes-...e-filters.html

Sorry I could not help more.

[CanuckBB]

Can you navigate to blocked sites from the BES?

It sounds like BESAdmin account is not being filtered. Also, is the gateway on BES the ISA server?

[TargetIT]

We don't use ISA, but I do know users get the same firewall restrictions as the BES box - it's coming from the same IP. Again, not sure if that helps in ISA world or not.

[deesloop]

Alas the problem has deteriorated
There is now no internet at all.
I'm just getting ab unch of 400 bad request errors.
The server could not understand the page request or was unable to process it.
connection refused Google or bbc:80

I read a post (http://www.blackberryforums.com/bes-...nt-filter.html) about editing the wsMSP.ini file on the ISA server in the system32 folder.

[configSection]
IgnoreForwardedRequest=0

But then I got no internet
I then changed it back and still no internet
I can get to the web and am filtered properly from the BES box.

Is there a delay in making changes in the mds components on the server before it takes effect?
I stop start services but no joy.

Also BB must be using MDS as if I stop the service I get an error about not being able to communicate with the MDS.