ASA web proxy?

Does anyone know if the ASA has a built in web proxy like competing products? Basically, I want to proxy all internal users and authenticate them against Active Directory. Based upon their group permissions, I want to be able to configure what kinds of websites they can gain access to.
If the product can't do this - will it at least allow me to authenticate users for access to the internet? Anything else I can configure to limit what access they have?
Thanks,
Jim

AFAIK the ASA will not work like that, however you might be able to configure it somehow like that.
Using DAP and cut-through proxy, you can choose a list of access-lists that will be pushed to the user based on their group membership after they authenticate.
Using LDAP as the authentication protocol and retrieving the LDAP attributes like memberOf you can use DAP to enforce this kind of network ACL where you can chose what remote destination will this user be able to reach, unfortunately this is not as granular as defining the NAMES of your sites rather your IP Addresses.
https://www.cisco.com/en/US/products/ps6120/products_white_paper09186a00809fcf38.shtml
http://www.cisco.com/en/US/docs/security/asa/asa80/asdm60/user/guide/vpn_dap.html
HTH

Similar Messages

  • HTTP failed - Transparent web proxy

    Hello,
    I developped an application with Flex 3 B1, it works at my
    home but when I tried it in my office I have this type of message
    sometime
    code:
    Channel.Call.Failed
    Message:
    error
    Detail:
    NetConnection.Call.Failed: HTTP: Failed
    Sometime the application works, sometime not... I think this
    is a web proxy problem. I called the person in charge of this and
    for him some program cannot works with a transparent proxy.
    Somebody have the same problem ?
    Best regards,
    Marc

    Thank you Ken for you whitepaper.
    I read the configuration and it is mentioned that the IronPort and clients are not on the same interface (segment). I also read that the IronPort Appliance and clients must be on the same ASA interface to avoid passing trough the ASA itself again.
    Which of these two is right ?
    In my architecture I'm not able to set the IronPort on the same interface as clients (2 differents interfaces and subnet).
    I attached a document explaining the architecture
    My bad I saw that the WSA and clients are on the same ASA interface in the inside networks. Still, in my configuration is it possible to enable WCCP ?
    I also so that it is possible to implement a route-map which perfrom PBR by changing the next-hop ip for specific traffic but this function is not avalaible on ASA as i heard. Can anyone confirm that ?
    Ce message a été modifié par: Maxime GERGES

  • QOS when using a WEB PROXY

    Hi
    Please view the attachment first.
    Basically we have a Cisco 6500 chassis with about 25 VLANS and around 25 -30 Access layer switches are serving as distribution layer switches in each VLAN.
    We now have a Web Proxy for each segment serving the users for internet access. the proxy server has only 1 ethernet interface.
    I used to police traffic for each segment at the interface connected to the Cisco ASA using Policy MAP's, This could also be done on the ASA Anyway.
    Now my problem is , we are planning to have one single high-end web proxy to serve all the VLANS. And this will be connected in say the Vlan 1 of the Cisco 6500. I have no problem here as we have GIG ETH ports on the 6500. So traffic entering and leaving the same vlan would not cause any problem.
    But the problem is i can't police traffic based on the vlan as only the IP of the Proxy will be seen on the interface connected to the ASA for all Http traffic.
    I cannot apply the policing on the vlan interfaces as, i do not want to police internal traffic.( yes there is one option where i can deny traffic with internal destination's from the policing. But in this case i'll have police configured on all vlan interface, a bit ugly and hectic.
    Another alternative is to put the web proxy in the DMZ, but my ASA has only fast Ethernet interfaces and we have got high internet Bandwidth, this would cause congestion.
    Any Ideas with respect to how i can proceed ????
    Thanks in Advance

    No, I still don't get it;-) What interface are you talking about? Wouldn't the DMZ be hanging off a real physical interface? If that's the case, there should not be any increase in traffic utilization across the internal and external interfaces from today. The DMZ interface would be the only one you need to worry about. The picture doesn't mention show anything special going on with the internal or external interfaces. If they're just fast Ethernet, then the theoretical maximum of Internet traffic today is 100Mbps, but in reality it is almost certainly lower even if you are pegging the internal interface.
    I agree that the DMZ interface, because it will see some traffic twice, may still need to be >100Mbit. Your internal interface utilization should help determine that. If it does, I believe there is a gig interface you can purchase for the 5510. This assumes you have a gig interface on the proxy (or multiple fast Ethernet interfaces)

  • WLC - Redirect Traffic to Web Proxy

    Hi,
    We need to create Guest WLAN on WLC 5508 which will be used for internet access only.
    My questions are:
    1. Is it possible to use our external web proxy server to authenticate users?
    2. Can we also forward all traffic to the external web proxy to filter the websites that can be accessed (without configuring it on the browser)?
    3. Can this be achieved using the L3 webauth?
    Our topology:
    WLC -- Switch -- ASA Firewall -- Internet -- External Web Proxy
    We are using WLC as DHCP server for Guest WLAN with ASA Firewall as the gateway.
    Any inputs and ideas are appreciated.
    Many thanks.

    Otiynomed,
    I have come across this problem recently as well and ended up using an Internal DHCP server with Option 252 configured which will point Users towards our proxy for authentication. Unfortunately it isn't a perfect setup as the following issues occurred:
    If using Option 252, make sure the wpad file has an internal re-direction for the virtual interface of your anchor controller to allow web-auth redirection otherwise devices will try to get to that address externally
    Some devices don't support Option 252
    You have to set the devices to 'auto proxy discover' whether Windows or Apple
    If using devices running less than iOS 6 then embedding authentication in the proxy settings upon initial connection will still end up with users being prompted for HTTPS authentication constantly. HTTP traffic will work fine however.
    Android devices don't like Option 252 and most of the applications don't work with authentication via a proxy except browsing
    Alternatively, use web-auth but link it to an LDAP server or RADIUS server for authentication and use a transparent proxy. Problem solved

  • Mac Adobe Flash Player not supporting Web Proxy Authentication

    Anyone else got an enterprise network where you use web proxies with web authentication and no traffic allowed out except through the proxies?
    You may need to be in the UK for this, but try accessing BBC iPlayer content - http://www.bbc.co.uk/iplayer and you should discover that the content won't play. the error says "This content doesn't seem to be working. Try again later.". The content will never work as the Mac version of Flash (currently 10.1.53.64) is not able to respond to web proxy authentication requests. The BBC use various streaming server which are randomly selected when a user starts a stream and they have no DNS. Just IP addresses. They don't publish a list for security reasons. So it is almost impossible to exempt all their servers from authentication.
    I've logged a bug with Adobe. If you have this issue too, please add a comment and vote so that they can begin to grasp the impact of this problem:
    https://bugs.adobe.com/jira/browse/FP-5161

    I have the same issues in Australia trying to access flash content from the ABC website. The strange thing is the content will play if your leave the browser open for 5min.
    After several packet data captures we identified that it has to do with the amount of time it takes the Mac timeout from the proxy before it plays the video content.
    No solution yet.

  • Error while creating web proxy

    Hi,
    I've created a web service in ProjectsManagement workspace (jws). Now, I'm trying to invoke that service from ProjectsFinancialsEss workspace (jws) by creating a web-proxy. However, I'm getting the following error when I'm creating the web-proxy:
    oracle.jdeveloper.webservices.model.WebServiceException: Error creating model from wsdl
    "file:/ade/amrmishr_amr_feb12_03_v2/fusionapps/prj/components/projectsManagement/resourceManagement/reporting/model/src/oracle/apps/projects/resourceManagement/reporting/model/UpdateResourceUtilizationDataService.wsdl": no !/ in spec
    Please find the jDev stack trace below:
    oracle.jdeveloper.webservices.model.WebServiceException: Error creating model from wsdl "file:/ade/amrmishr_amr_feb12_03_v2/fusionapps/prj/components/projectsManagement/resourceManagement/reporting/model/src/oracle/apps/projects/resourceManagement/reporting/model/UpdateResourceUtilizationDataService.wsdl": no !/ in spec
         at oracle.jdeveloper.webservices.model.java.JavaWebService.createPortTypes(JavaWebService.java:1635)
         at oracle.jdeveloper.webservices.model.WebService.createServiceFromWSDL(WebService.java:2846)
         at oracle.jdeveloper.webservices.model.WebService.createServiceFromWSDL(WebService.java:2611)
         at oracle.jdeveloper.webservices.model.java.JavaWebService.<init>(JavaWebService.java:509)
         at oracle.jdeveloper.webservices.model.java.JavaWebService.<init>(JavaWebService.java:461)
         at oracle.jdeveloper.webservices.model.proxy.WebServiceProxy$ProxyJavaWebService.<init>(WebServiceProxy.java:2268)
         at oracle.jdeveloper.webservices.model.proxy.WebServiceProxy.updateServiceModel(WebServiceProxy.java:1701)
         at oracle.jdeveloper.webservices.model.proxy.WebServiceProxy.setDescription(WebServiceProxy.java:525)
         at oracle.jdevimpl.webservices.wizard.jaxrpc.proxy.ProxyJaxWsSpecifyWSDLPanel.setDescription(ProxyJaxWsSpecifyWSDLPanel.java:238)
         at oracle.jdevimpl.webservices.wizard.jaxrpc.common.SpecifyWsdlPanel.buildModel(SpecifyWsdlPanel.java:1109)
         at oracle.jdevimpl.webservices.wizard.jaxrpc.common.SpecifyWsdlPanel$5.run(SpecifyWsdlPanel.java:661)
         at oracle.ide.dialogs.ProgressBar.run(ProgressBar.java:655)
         at java.lang.Thread.run(Thread.java:619)
    Caused by: oracle.jdeveloper.webservices.tools.WsdlValidationException: Error creating model from wsdl "file:/ade/amrmishr_amr_feb12_03_v2/fusionapps/prj/components/projectsManagement/resourceManagement/reporting/model/src/oracle/apps/projects/resourceManagement/reporting/model/UpdateResourceUtilizationDataService.wsdl": no !/ in spec
         at oracle.jdevimpl.webservices.tools.wsa.WsaAdaptor.newWsdlValidationException(WsaAdaptor.java:825)
         at oracle.jdevimpl.webservices.tools.wsa.WsaAdaptor.getSeiInfo(WsaAdaptor.java:515)
         at oracle.jdeveloper.webservices.tools.WebServiceTools.getSeiInfo(WebServiceTools.java:523)
         at oracle.jdeveloper.webservices.model.java.JavaWebService.getSeiInfo(JavaWebService.java:1741)
         at oracle.jdeveloper.webservices.model.java.JavaWebService.createPortTypes(JavaWebService.java:1496)
         ... 12 more
    Caused by: oracle.j2ee.ws.common.tools.api.ValidationException: Error creating model from wsdl "file:/ade/amrmishr_amr_feb12_03_v2/fusionapps/prj/components/projectsManagement/resourceManagement/reporting/model/src/oracle/apps/projects/resourceManagement/reporting/model/UpdateResourceUtilizationDataService.wsdl": no !/ in spec
         at oracle.j2ee.ws.tools.wsa.jaxws.JaxwsWsdlToJavaTool.getJAXWSModel(JaxwsWsdlToJavaTool.java:679)
         at oracle.j2ee.ws.tools.wsa.WsdlToJavaTool.createJAXWSModel(WsdlToJavaTool.java:478)
         at oracle.j2ee.ws.tools.wsa.Util.getJaxWsSeiInfo(Util.java:1360)
         at sun.reflect.GeneratedMethodAccessor1137.invoke(Unknown Source)
         at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
         at java.lang.reflect.Method.invoke(Method.java:597)
         at oracle.jdevimpl.webservices.tools.wsa.Assembler$2$1.invoke(Assembler.java:218)
         at $Proxy90.getJaxWsSeiInfo(Unknown Source)
         at oracle.jdevimpl.webservices.tools.wsa.WsaAdaptor.getSeiInfo(WsaAdaptor.java:505)
         ... 15 more
    Caused by: oracle.j2ee.ws.common.tools.api.ValidationException: no !/ in spec
         at oracle.j2ee.ws.tools.wsa.SchemaTool.genValueTypes(SchemaTool.java:188)
         at oracle.j2ee.ws.tools.wsa.jaxws.JaxwsWsdlToJavaTool.getJAXWSModel(JaxwsWsdlToJavaTool.java:662)
         ... 23 more
    Caused by: oracle.j2ee.ws.common.databinding.common.spi.DatabindingException: no !/ in spec
         at oracle.j2ee.ws.common.tools.databinding.jaxb20.JAXB20TypeGenerator.generateJavaTypes(JAXB20TypeGenerator.java:124)
         at oracle.j2ee.ws.tools.wsa.SchemaTool.genValueTypes(SchemaTool.java:186)
         ... 24 more
    Any help on this will be greatly appreciated.
    Thanks and regards,
    Amrit

    Look like you hit Bug 11838224 which should be fixed in 11.1.2.x
    If you can't update you can use the following workaround:
    @ Details of Workaround
    @ =====================
    @ Deploy the model project and build the proxy from the wsdl provided from the
    @ WLS 10.3.x.0 server.
    Timo

  • '-1' bytes in log file - iPlanet Web Proxy Server 3.6

    I'm running iPlanet Web Proxy Server 3.6, and getting strange results in log file using extended format. Where the number of bytes should be (c1 - the content-length sent to the client by the proxy).
    I regularly get a '-1' instead of the number of bytes. Anyone tell me where this is coming from and how to stop it?

    Someone in the Web Proxy Server forum might. I guess you accidentally posted in the Web Server forum. However, if your question is time- or business-critical, you should probably contact Sun directly: http://www.sun.com/support

  • Multiple sites on CRM-ISA web proxy IIS

    Hello,
    We're upgrading to CRM v6 (2007), with Internet Sales / Web Channel B2B in scope. As part of the system landscape, we have a Windows server running IIS acting as a web proxy.
    Now, the question is, can we share this web proxy so that it works for multiple sites?
    We would like to put the Dev and the QA CRM systems to both use the same web proxy, which would have two sites configured in it.
    Has anyone done this before? Success or fail? I could not find any docu from SAP telling whether or not this would work.
    Also are there any requirements for the version of the IIS?
    We're currently on Win2k / IIS v5 but are going to Win2003 / IIS v6.
    Thanks and Regards,
    Rasmus

    I figured it out:
    You need to change which URL the site responds to under the 'Aliases' section.
    I haven't seen this anywhere else, so I hope this will help someone along the line...

  • Safari cannot open the page ~ The error was: "There was a problem communicating with the web proxy server (HTTP)

    Help!  I was cruzing along just fine and went out tonight only to receive the message above:
    Cannot open Page
    Safari cannot open the page
    The error was: "There was a problem communicating with the web proxy server (HTTP)."
    I have had all the Apple iPhone phone.  Have never encountered anything like this. 
    All systems are GO as soon as I log on to wifi. 
    Can anyone help, please. 

    I am also fixed.  I also loaded Onavo, but that was the other day ... this is what I did with the help of online chat with AT&T ...
    I went to:
    Settings
    Wifi
    I selected the network I was working on by hitting the blue arrow located on right side
    At the detail page of that network I scolled down to the bottom to find HTTP Proxy boxes
    I was on Off and changed it to Auto and it worked! 
    I was soo jazzed!!
    Instructions said if it was already on AUTO, to change it to Manual and make your Port = 80 but I didn't have to do that!
    YIPPIE!!  I'm a new man!!
    Go to settings -----> WI-FI  -----> select the network you're using  ------> hit the blue arrow located on the right-side of the network name (ie: show details of that network), this takes you to another page.  
    --------> at the bottom of the page you'll see "HTTP Proxy" boxes (located below the "renew lease" button) ---------------> change the proxy to AUTO.   Note: if you're already at AUTO, change it to "Manual" and make your Port = 80.

  • Sun Java Web Proxy Server Routing to another Proxy Server

    hello every body
    i have installed Sun java web proxy server and we are get internet services from anotyher proxy server.
    how route SOCKS (Ports) to another proxy server)
    I mean 8080 web browsing is ok but my socks applicaiton like outlook is not working. how to Route my Sun Java Web proxy Server Socks Server to another Proxy Server.
    Please reply
    best regards
    Aamir Mughal
    [email protected]

    Dear ahmad@bzu,
    I suspect that your download is corrupted. Check the file size ( for me it shows up 89,328KB(and the installation went smooth). So a possible solution should be to download again and try the installation.

  • Caching issue in Web proxy 4.0.13

    I have the following settings in the obj.conf but i still see my http requests go back to the origin server. I have the Web proxy installed on Solaris 10
    # more obj.conf
    # You can edit this file, but comments and formatting changes
    # might be lost when the admin server makes changes.
    Init fn="flex-init" access="$accesslog" format.access="%Ses->client.ip% - %Req->vars.auth-user% [%SYSDATE%] \"%Req->reqpb.clf-request%\" %Req->srvh
    drs.clf-status% %Req->srvhdrs.content-length% \"%Req->headers.referer%\" \"%Req->headers.user-agent%\" \"%Req->headers.cookie%\" %Req->reqpb.method
    % %Req->reqpb.uri% %Req->reqpb.query% \"%Req->reqpb.protocol%\" %vsid% %Req->headers.x-forwarded-for%"
    Init fn="init-proxy" timeout="300" timeout-2="15"
    Init profiling="on" fn="stats-init"
    <Object name="default">
    AuthTrans fn="match-browser" browser=".*MSIE.*" ssl-unclean-shutdown="true"
    NameTrans fn="assign-name" name="stats-xml" from="(/stats-xml|/stats-xml/.*)"
    PathCheck fn="url-check"
    ObjectType fn="block-ip"
    ObjectType fn="cache-enable" cache-auth="1"
    ObjectType fn="cache-setting" max-uncheck="86400"
    Service fn="proxy-retrieve"
    AddLog fn="flex-log" name="access"
    Route fn="set-origin-server" server="origin.server.com" sticky-cookie="JSESSIONID" sticky-param="jsessionid" route-hdr="Proxy-jroute" route-cooki
    e="JROUTE" rewrite-host="false" rewrite-location="true" rewrite-content-location="true"
    </Object>
    <Object name="file">
    PathCheck fn="unix-uri-clean"
    PathCheck fn="find-index" index-names="index.html"
    ObjectType fn="type-by-extension"
    ObjectType fn="force-type" type="text/plain"
    Service fn="send-file"
    </Object>
    <Object ppath="ftp://.*">
    ObjectType fn="cache-enable" query-maxlen="10" log-report="off"
    ObjectType fn="cache-setting" lm-factor="0.10" max-uncheck="7200"
    Service fn="proxy-retrieve"
    </Object>
    <Object ppath="http://.*">
    ObjectType fn="cache-enable" query-maxlen="32" log-report="off" min-size="0" max-size="512000"
    ObjectType fn="cache-setting" lm-factor="1.00" max-uncheck="1209600"
    Service fn="proxy-retrieve" method="*"
    Route fn="set-origin-server" server="origin.server.com" sticky-cookie="JSESSIONID" sticky-param="jsessionid" route-hdr="Proxy-jroute" route-cooki
    e="JROUTE" rewrite-host="false" rewrite-location="true" rewrite-content-location="true"
    </Object>
    <Object ppath="https://.*">
    Service fn="proxy-retrieve"
    </Object>
    <Object ppath="gopher://.*">
    ObjectType fn="cache-enable" query-maxlen="10" log-report="off"
    ObjectType fn="cache-setting" lm-factor="0.10" max-uncheck="7200"
    Service fn="proxy-retrieve"
    </Object>
    <Object ppath="connect://.*:443">
    Service fn="connect" method="CONNECT"
    </Object>
    <Object ppath="connect://.*:563">
    Service fn="connect" method="CONNECT"
    </Object>
    <Object name="stats-xml">
    Service fn="stats-xml"
    </Object>looks like i am missing something obvious but i can't figure it out..suggestions/thoughts would be appreciated.
    thanks
    JB
    Edited by: hello343 on Feb 26, 2010 9:18 PM
    more info:
    I have the proxy running on port 8000. when i make request via the browser, i cannot get those pages to show up in the url database - these are the lines form the error log
    [26/Feb/2010:16:11:28] fine ( 9416): for host 192.168.1.153 trying to GET /licensees/licensee1/images/IRParents/layout/Nemours_logo.png, set-origin-server reports: using server origin.server.com:80
    [26/Feb/2010:16:11:28] fine ( 9416): for host 192.168.1.153 trying to GET /licensees/licensee1/images/IRParents/layout/Nemours_logo.png, service-http reports: attempting to contact origin.server.com:80
    [26/Feb/2010:16:11:28] fine ( 9416): for host 192.168.1.153 trying to GET /licensees/licensee1/images/IRParents/layout/Nemours_logo.png, reusing existing persistent connection to origin.server.com:80
    [26/Feb/2010:16:11:54] fine ( 9416): GC: partition index : 0, changed blocks : 0
    [26/Feb/2010:16:12:39] fine ( 9416): GC: partition index : 0, changed blocks : 0
    [26/Feb/2010:16:13:24] fine ( 9416): GC: partition index : 0, changed blocks : 0
    [26/Feb/2010:16:14:09] fine ( 9416): GC: partition index : 0, changed blocks : 0
    [26/Feb/2010:16:14:54] fine ( 9416): GC: partition index : 0, changed blocks : 0but i did get the url database to populate when i setup a "cache batch update" but even those urls, are not served from the cache when i try to access them via the browser - I am using Firefox - seems like when i make the request via the browser, the cache is not being used.
    Edited by: hello343 on Feb 26, 2010 9:29 PM
    Edited by: hello343 on Feb 26, 2010 9:33 PM

    i was missing the reverse mapping - that fixed the issue.

  • Why doesn't Sun ONE Web Proxy Server support full replication?

    Sun believes caching on-demand is a much more appropriate model for either the World Wide Web or an intranet. Common indexes should be distributed, but data can (and should) be stored wherever is most appropriate on the network. If Proxy Servers are deployed, there will be a 50 percent to 75 percent chance that the document will be cached locally and no chance of getting stale data.
    Sun ONE Web Proxy Server uses sophisticated statistical analysis to store the documents most likely to be needed. It also manages document expiry and version control, and by default checks the home server every time a document is requested. Full replication like that performed by other softwares presumes that each document needs to be fully replicated on every server. (Imagine doing that on the Web!) This model limits the scalability of the infrastructure, and requires many more servers, more hardware, and more management complexity. More importantly, it increases the likelihood of getting stale data. A document checked in at one location may take a day or more to be fully replicated around the world.

    If you have a support contract, get in touch with a support engineer. We've run into a bug related to following referrals in the "off-the-shelf" version of the proxy server. I believe there is a hotfix that solves the issue.

  • WEB Proxy issue after Mountain Lion Update

    I had MAC OS X 10.6.8 on  my Mac mini before I updated it with MAC OS X 10.8. To connect to Internet we have some proxy setting in our company for which secure web proxy server is mentioned for web proxy and secure web proxy options in advanced setting of network preferences. Now after update I can only access safari web browser. For other browsers like Chrome and Firefox popup asking for authentication keep on popping up even after entering correct details. It's become quite irritating not to be able to surf on chrome. Please tell me how to solve it.

    Hi no real idea on this, but many Network connectivity issues have been solved by this...
    Make a New Location, Using network locations in Mac OS X ...
    http://support.apple.com/kb/HT2712
    10.7…
    System Preferences>Network, top of window>Locations>Edit Locations, little plus icon, give it a name.
    10.5.x/10.6.x/10.7.x instructions...
    System Preferences>Network, click on the little gear at the bottom next to the + & - icons, (unlock lock first if locked), choose Set Service Order.
    The interface that connects to the Internet should be dragged to the top of the list.
    Instead of joining your Network from the list, click the WiFi icon at the top, and click join other network. Fill in everything as needed.
    For 10.5/10.6, System Preferences>Network, unlock the lock if need be, highlight the Interface you use to connect to Internet, click on the advanced button, click on the DNS tab, click on the little plus icon, then add these numbers...
    208.67.222.222
    208.67.220.220
    Click OK.
    Also, turn off IPv6:
    System Preferences » Network » AirPort » TCP/IP tab » Configure IPv6
    Or whatever Interface you use.

  • Lync 2013 Edge & Web proxy

    Hi Everyone
    I'm having a little trouble getting my head around the setup for Lync external access.
    I have setup an ADFS server, Lync 2013 server(works internally), 2012 web proxy server(doing nothing) and an edge server(currently doing nothing).
    My understanding is that the Edge and Web proxy server are in "parallel", I.E, they both face the WAN as they perform different tasks.
    The problem I have is that I'm unsure how to map everything correctly, I also don't understand how an external Lync client will get it's config. If my domain setup is:
    something.domain.internal, and I would like to register a DNS entry externally as something.domain.external. How do I map those correctly via the web proxy and edge server? Sending the request via the firewall is easy enough, however I'm unsure how I'm supposed
    to define them on my servers. Is the Lync server supposed to know about the external URL? Or does it not care?

    Hi,
    The Edge Servers run the services that allow external access to IM and presence, conferencing, audio/video, and other media services. You can also configure the Edge Server to federate with other Lync Server and other XMPP deployments.
    Lync Server uses the reverse proxy to publish a number of features, such as conferencing meetings, conference join locations, the address book, distribution list expansion, downloading meeting content, device updates, Mobility services, and more. Any reverse
    proxy that can meet the requirements for publishing the necessary resource locations can be used.
    You just need to define the Edge information in topology builder and publish it. Then configure the server as defined in topology and install local configuration store, setup Lync components and assign certificate. Here is a topology that
    using private IP addresses and NAT.
    http://technet.microsoft.com/en-us/library/gg399001.aspx
    Here are other resource how to publish Lync Server web services
    http://blogs.technet.com/b/dodeitte/archive/2013/10/29/how-to-publish-lync-server-2013-web-services-with-windows-server-2012-r2-web-application-proxy.aspx
    https://social.technet.microsoft.com/wiki/contents/articles/9807.how-to-configure-forefront-tmg-2010-as-reverse-proxy-for-lync-server-2010.aspx
    Kent Huang
    TechNet Community Support

  • Service Connection error for ePrint -- needs web proxy & web port

    I'm trying to set up the ePrinter and rec'd an error message "The printer was unable to connect to the server.  Check the internet connection and try again or enter a proxy address" I am connected to the internet and have no idea what a web proxy address or port is.  Can someone help this dummy?

    I finally got this working.   I ended up buying a new router, but I was ready to upgrade anyway.  It works fine with this new router (D-Link DIR-860L).  
    Before I had an ASUS RT-N16 router running DD-WRT, but I loaded the latest ASUS firmware when I couldn't get that to work.  It didn't matter.  The router seemed to lock up after registering the printer with either firmware, so I decided it was the router along with the HP support line.
    Now everything works as documented.

Maybe you are looking for