If the Microsoft Internet Security and Acceleration (ISA) Server 2004 Firewall Client program is configured for auto-discovery, you may experience the following symptoms:

If Microsoft Internet Explorer is not configured to use a proxy or to detect a proxy, you cannot access a Web pages when you use Internet Explorer. Additionally, you receive the following error message:
Cannot find server or DNS Error

A red “X” appears over the Firewall Client icon. You can find the Firewall Client icon in the notification area at the far right of the taskbar. If you pause the mouse pointer on the Firewall Client icon, you receive the following error message:
Disabled: Cannot authenticate to ISA Server server_name

If you try to configure the ISA Server 2004 Firewall Client program for auto-discovery, you may experience the following symptoms:

If you try to configure the Firewall Client program to use auto-discovery by clicking Detect Now under Automatically detect ISA Server on the General tab, you receive the following error message:
Failed to detect ISA Server

A red “X” appears over the Firewall Client icon. You can find the Firewall Client icon in the notification area at the far right of the taskbar. If you pause the mouse pointer on the Firewall Client icon, you receive the following error message:
Disabled: ISA Server could not be detected

This issue occurs if the IFPCEEWebProxy.SkipAuthenticationForRoutingInformation property is set to FALSE in ISA Server 2004. This problem occurs when the following conditions are true:
The Firewall Client program is configured to use auto-discovery.
The Require all users to authenticate Web Proxy setting is configured for the internal network object on the ISA Server 2004 computer.

Note The Require all users to authenticate setting is available when you click Authentication on the Web Proxy tab when you view the properties of the internal network object.

These conditions cause this problem because the Firewall Client program cannot perform HTTP authentication. When the Require all users to authenticate setting is enabled for the internal network object, the request to the Winsock Proxy Autodetect (WSPAD) port must be authenticated also. However, the Firewall Client program does not handle the "401 Authentication Required" response. Therefore, when the Firewall Client program tries to retrieve the Wspad.dat file from the Web Proxy Automatic Discovery (WPAD) server during the auto-discovery process, the auto-discovery process fails.

Check out http://support.microsoft.com/default.aspx?scid=kb;...885683 for the fix.

HTH,

Tom

Thomas W Shinder, M.D.

Site: www.isaserver.org

Blog: http://blogs.isaserver.org/shinder/

Book: http://tinyurl.com/3xqb7

MVP — ISA Firewalls