UCPrimer
  • UCprimer
  • About

Configuring Web Proxy PAC file for MTR on Windows

4/9/2021

0 Comments

 
Picture
In a previous blogpost, a brief discussion on how to configure a static web proxy on MS Teams Room on Windows (MTRoW) devices was provided, However many organizations require the use of Web Proxy Automatic Configuration (PAC) files to determine which web proxy to use depending on what websites are requested. In this post, we walk through step-by-step on how to configure Web Proxy PAC on an MTRoW device. Note that Microsoft strongly recommends that Teams media traffic should bypass web proxies as stated in this official doc as it may impact the network performance for real-time media. Nonetheless, organizations that require the use of Web Proxy for MTRoW devices may do so for normal web traffic. However, its important to note that MTRoW does not support web proxy authentication.
For quite some time the MS docs website provided only guidance for configuring a static web proxy, however recently this has been updated to include web proxy PAC configuration as well: Prepare your Environment - Microsoft Teams | Microsoft Docs. As mentioned in the doc, the way to configure proxy settings for the Skype account used by MTRoW is to first login as the admin, run registry editor and load the hive for the Skype user and add the necessary fields before unloading the hive. For a web proxy PAC configuration, the required fields are:

[HKEY_USERS\Skype\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy"=dword:00000001
"ProxyEnable"=dword:00000001
"AutoConfigURL"=http://contosoproxy.corp.net/proxy.pac

In my lab environment I am using the Squid web proxy from Netgate and I have a Windows Server IIS hosting the proxy pac file and thus the URL is simply http://pfsense/wpad.dat. I've added the pfsense hostname and IP address to the hosts file locally on my MTRoW for it to resolve the IIS server. Note that only http is supported and the PAC filename can be proxy.pac as well if desired. The completed registry keys for the hive should look similar to the one shown below:
Picture
The Proxy PAC file is simply a Javascript file that describes what web proxy to use for which websites being requested. In my lab environment this file simpy returns a default proxy pointing to my Squid web proxy server:

function FindProxyForURL(url, host) {
// DEFAULT RULE: All other traffic, use below proxies, in fail-over order.
    return "PROXY 192.168.0.173:8080";
 }

After the registry settings have been completed. we can restart the MTRoW device and it will start to use the web proxy configured in the PAC file. For reference, below is the real-time logs that can been seen on my Squid web proxy server from the MTRoW device:

Squid - Access Logs
Date IP Status Address User Destination
05.04.2021 15:27:21 192.168.0.110 TCP_TUNNEL/200 as-api.asm.skype.com:443 - 52.114.14.47
05.04.2021 15:27:19 192.168.0.110 TCP_TUNNEL/200 as-prod.asyncgw.teams.microsoft.com:443 - 52.114.14.126
05.04.2021 15:27:18 192.168.0.110 TCP_TUNNEL/200 teams.events.data.microsoft.com:443 - 52.114.159.22
05.04.2021 15:27:18 192.168.0.110 TCP_TUNNEL/200 as-api.asm.skype.com:443 - 52.114.14.47
05.04.2021 15:27:17 192.168.0.110 TCP_TUNNEL/200 cdn.onenote.net:443 - 104.79.107.113
05.04.2021 15:27:15 192.168.0.110 TCP_TUNNEL/200 as-prod.asyncgw.teams.microsoft.com:443 - 52.114.14.126
05.04.2021 15:27:10 192.168.0.110 TCP_TUNNEL/200 webpoolsg20f12.infra.lync.com:443 - 52.113.64.154
05.04.2021 15:27:10 192.168.0.110 TCP_TUNNEL/200 webpoolsg20f12.infra.lync.com:443 - 52.113.64.154
05.04.2021 15:27:10 192.168.0.110 TCP_TUNNEL/200 webpoolsg20f12.infra.lync.com:443 - 52.113.64.154
05.04.2021 15:27:10 192.168.0.110 TCP_TUNNEL/200 outlook.office365.com:443 - 52.98.66.98
05.04.2021 15:27:10 192.168.0.110 TCP_TUNNEL/200 outlook.office365.com:443 - 52.98.66.98
05.04.2021 15:27:10 192.168.0.110 TCP_TUNNEL/200 outlook.office365.com:443 - 52.98.66.98
05.04.2021 15:27:10 192.168.0.110 TCP_TUNNEL/200 outlook.office365.com:443 - 52.98.66.98
05.04.2021 15:27:10 192.168.0.110 TCP_TUNNEL/200 outlook.office365.com:443 - 52.98.66.98
05.04.2021 15:27:10 192.168.0.110 TCP_TUNNEL/200 outlook.office365.com:443 - 52.98.66.98
05.04.2021 15:27:10 192.168.0.110 TCP_TUNNEL/200 webpoolsg20f12.infra.lync.com:443 - 52.113.64.154
05.04.2021 15:27:10 192.168.0.110 TCP_TUNNEL/200 webpoolsg20f12.infra.lync.com:443 - 52.113.64.154
05.04.2021 15:27:10 192.168.0.110 TCP_TUNNEL/200 outlook.office365.com:443 - 52.98.66.98
05.04.2021 15:27:10 192.168.0.110 TCP_TUNNEL/200 outlook.office365.com:443 - 52.98.66.98
05.04.2021 15:27:10 192.168.0.110 NONE/200 gameplayapi.intel.com:443 - -
05.04.2021 15:26:57 192.168.0.110 TCP_TUNNEL/200 df.trap.teams.microsoft.com:443 - 13.91.196.238
05.04.2021 15:26:57 192.168.0.110 TCP_TUNNEL/200 ic3.events.data.microsoft.com:443 - 40.77.18.167
05.04.2021 15:26:57 192.168.0.110 NONE/200 teams.microsoft.com:443 - -
05.04.2021 15:26:56 192.168.0.110 NONE/200 df.trap.teams.microsoft.com:443 - -
05.04.2021 15:26:56 192.168.0.110 NONE/200 fedsvr.ucprimer.com:443 - -
05.04.2021 15:26:56 192.168.0.110 NONE/200 ic3.events.data.microsoft.com:443 - -
05.04.2021 15:26:56 192.168.0.110 NONE/200 api.userstore.skype.com:443 - -
05.04.2021 15:26:56 192.168.0.110 NONE/200 config.teams.microsoft.com:443 - -
05.04.2021 15:26:56 192.168.0.110 NONE/200 go.trouter.teams.microsoft.com:443 - -
05.04.2021 15:26:56 192.168.0.110 NONE/200 login.microsoftonline.com:443 - -
05.04.2021 15:26:54 192.168.0.110 NONE/200 outlook.office.com:443 - -
05.04.2021 15:26:54 192.168.0.110 NONE/200 presence.teams.microsoft.com:443 - -
05.04.2021 15:26:54 192.168.0.110 NONE/200 accounts.google.com:443 - -
05.04.2021 15:26:54 192.168.0.110 NONE/200 japanwest-prod.notifications.teams.microsoft.com:443 - -
05.04.2021 15:26:53 192.168.0.110 NONE/200 teams.events.data.microsoft.com:443 - -
05.04.2021 15:26:53 192.168.0.110 NONE/200 as-prod.asyncgw.teams.microsoft.com:443 - -
05.04.2021 15:26:53 192.168.0.110 NONE/200 as-api.asm.skype.com:443 - -
05.04.2021 15:26:53 192.168.0.110 NONE/200 config.teams.microsoft.com:443 - -
05.04.2021 15:26:53 192.168.0.110 NONE/200 teams.events.data.microsoft.com:443 - -
05.04.2021 15:26:53 192.168.0.110 NONE/200 apac.ng.msg.teams.microsoft.com:443 - -
05.04.2021 15:26:53 192.168.0.110 NONE/200 as-api.asm.skype.com:443 - -
05.04.2021 15:26:53 192.168.0.110 NONE/200 as-prod.asyncgw.teams.microsoft.com:443 - -
05.04.2021 15:26:53 192.168.0.110 NONE/200 apis.google.com:443 - -
05.04.2021 15:26:51 192.168.0.110 NONE/200 teams.microsoft.com:443 - -
05.04.2021 15:26:51 192.168.0.110 NONE/200 teams.microsoft.com:443 - -
05.04.2021 15:26:50 192.168.0.110 NONE/200 fedsvr.ucprimer.com:443 - -
05.04.2021 15:26:50 192.168.0.110 TCP_MISS/200 http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEA%2FW5rPqm2P722ik%2Fu65OaA%3D - 117.18.237.29
05.04.2021 15:26:50 192.168.0.110 NONE/200 login.microsoftonline.com:443 - -
05.04.2021 15:26:49 192.168.0.110 TCP_TUNNEL/200 images.edge.messenger.live.com:443 - 104.45.226.98
05.04.2021 15:26:49 192.168.0.110 TCP_TUNNEL/200 webpoolsg20f12.infra.lync.com:443 - 52.113.64.154
05.04.2021 15:26:49 192.168.0.110 TCP_TUNNEL/200 webpoolsg20f12.infra.lync.com:443 - 52.113.64.154
05.04.2021 15:26:49 192.168.0.110 NONE/200 outlook.office365.com:443 - -
05.04.2021 15:26:49 192.168.0.110 NONE/200 outlook.office365.com:443 - -
05.04.2021 15:26:49 192.168.0.110 NONE/200 outlook.office365.com:443 - -
05.04.2021 15:26:49 192.168.0.110 NONE/200 outlook.office365.com:443 - -
05.04.2021 15:26:49 192.168.0.110 NONE/200 outlook.office365.com:443 - -
05.04.2021 15:26:49 192.168.0.110 NONE/200 outlook.office365.com:443 - -
05.04.2021 15:26:49 192.168.0.110 NONE/200 outlook.office365.com:443 - -
05.04.2021 15:26:49 192.168.0.110 NONE/200 outlook.office365.com:443 - -
05.04.2021 15:26:48 192.168.0.110 NONE/200 outlook.office365.com:443 - -
05.04.2021 15:26:48 192.168.0.110 NONE/200 webpoolsg20f12.infra.lync.com:443 - -
05.04.2021 15:26:48 192.168.0.110 NONE/200 outlook.office365.com:443 - -
05.04.2021 15:26:48 192.168.0.110 NONE/200 webpoolsg20f12.infra.lync.com:443 - -
05.04.2021 15:26:48 192.168.0.110 NONE/200 webpoolsg20f12.infra.lync.com:443 - -
05.04.2021 15:26:48 192.168.0.110 NONE/200 images.edge.messenger.live.com:443 - -
05.04.2021 15:26:47 192.168.0.110 NONE_ABORTED/200 sippoolsg20f12.infra.lync.com:443 - -
05.04.2021 15:26:47 192.168.0.110 TCP_TUNNEL_ABORTED/200 sipfed0f.online.lync.com:443 - 52.113.64.147
05.04.2021 15:26:46 192.168.0.110 NONE/200 webpoolsg20f12.infra.lync.com:443 - -
05.04.2021 15:26:46 192.168.0.110 NONE/200 outlook.office365.com:443 - -
05.04.2021 15:26:46 192.168.0.110 NONE/200 webpoolsg20f12.infra.lync.com:443 - -
05.04.2021 15:26:44 192.168.0.110 NONE/200 outlook.office365.com:443 - -
05.04.2021 15:26:44 192.168.0.110 NONE/200 login.windows.net:443 - -
05.04.2021 15:26:41 192.168.0.110 NONE/200 pipe.skype.com:443 - -
05.04.2021 15:26:40 192.168.0.110 NONE/200 fedsvr.ucprimer.com:443 - -
05.04.2021 15:26:40 192.168.0.110 NONE/200 webpoolsg20f12.infra.lync.com:443 - -
05.04.2021 15:26:40 192.168.0.110 NONE/200 webpoolsg20f12.infra.lync.com:443 - -
05.04.2021 15:26:40 192.168.0.110 TCP_MISS/200 http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEA%2FW5rPqm2P722ik%2Fu65OaA%3D - 117.18.237.29
05.04.2021 15:26:39 192.168.0.110 NONE/200 sipfed0f.online.lync.com:443 - -
05.04.2021 15:26:39 192.168.0.110 NONE/200 login.microsoftonline.com:443 - -
05.04.2021 15:26:39 192.168.0.110 TCP_TUNNEL/200 pipe.skype.com:443 - 52.114.75.79
05.04.2021 15:26:38 192.168.0.110 NONE/200 pipe.skype.com:443 - -
05.04.2021 15:26:20 192.168.0.110 TCP_TUNNEL/200 nexusrules.officeapps.live.com:443 - 52.109.8.19
05.04.2021 15:26:19 192.168.0.110 TCP_TUNNEL/200 licensing.mp.microsoft.com:443 - 52.184.80.179
05.04.2021 15:26:18 192.168.0.110 NONE/200 nexusrules.officeapps.live.com:443 - -
05.04.2021 15:26:17 192.168.0.110 NONE/200 licensing.mp.microsoft.com:443 - -
05.04.2021 15:26:17 192.168.0.110 TCP_MISS/200 http://tile-service.weather.microsoft.com/en-GB/livetile/preinstall? - 23.219.132.23
05.04.2021 15:26:17 192.168.0.110 NONE/200 cdn.onenote.net:443 - -
05.04.2021 15:26:15 192.168.0.110 TCP_TUNNEL/200 cdn.onenote.net:443 - 104.79.107.113
05.04.2021 15:26:14 192.168.0.110 TCP_TUNNEL/200 v20.events.data.microsoft.com:443 - 52.114.77.33
05.04.2021 15:26:14 192.168.0.110 NONE/200 cdn.onenote.net:443 - -
05.04.2021 15:26:14 192.168.0.110 TCP_MISS/200 http://tile-service.weather.microsoft.com/en-GB/livetile/preinstall? - 23.219.132.23
05.04.2021 15:26:14 192.168.0.110 TCP_TUNNEL/200 watson.telemetry.microsoft.com:443 - 13.64.90.137
05.04.2021 15:26:13 192.168.0.110 NONE/200 v20.events.data.microsoft.com:443 - -
05.04.2021 15:26:13 192.168.0.110 NONE/200 watson.telemetry.microsoft.com:443 - -
05.04.2021 15:25:40 192.168.0.110 TCP_TUNNEL_ABORTED/200 www.bing.com:443 - 13.107.21.200
05.04.2021 15:25:40 192.168.0.110 NONE/200 www.bing.com:443 - -
05.04.2021 15:24:11 192.168.0.110 TCP_TUNNEL/200 fp-vs.azureedge.net:443 - 117.18.232.200
05.04.2021 15:23:19 192.168.0.110 TCP_TUNNEL/200 www.bing.com:443 - 13.107.21.200
05.04.2021 15:23:17 192.168.0.110 TCP_TUNNEL/200 spo-ring.msedge.net:443 - 13.107.136.254
05.04.2021 15:23:17 192.168.0.110 TCP_TUNNEL/200 fp.msedge.net:443 - 204.79.197.222
Squid Cache Table

In closing, if the web proxy configuration is no longer required, then simply set the registry keys back to the original values and the MTRoW device will no longer use the web proxy:

​[HKEY_USERS\Skype\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy"=dword:00000001
"ProxyEnable"=dword:00000000
"AutoConfigURL"=<blank>
0 Comments

Your comment will be posted after it is approved.


Leave a Reply.

    UCPrimer

    Picture
    Picture
    Picture

    Important Links

    Microsoft Teams Docs
    Microsoft Learn
    ​Microsoft MVP Blogs
    Michael Tressler’s Blog
    Michael’s MTR Quick Tip Videos
    Jimmy Vaughan’s Blog
    Jeff Schertz
    Adam Jacobs
    James Cussen
    ​Damien Margaritis

    Archives

    July 2024
    May 2024
    April 2024
    March 2024
    February 2024
    December 2023
    November 2023
    October 2023
    September 2023
    July 2023
    March 2023
    February 2023
    January 2023
    November 2022
    October 2022
    September 2022
    August 2022
    July 2022
    March 2022
    February 2022
    January 2022
    December 2021
    November 2021
    October 2021
    September 2021
    August 2021
    June 2021
    April 2021
    March 2021
    December 2020
    October 2020
    September 2020
    August 2020
    April 2020
    March 2020
    February 2020
    January 2020
    December 2019
    November 2019
    October 2019
    September 2019
    August 2019
    July 2019
    March 2019
    November 2018
    October 2018
    September 2018
    August 2018
    June 2018
    March 2018
    February 2018
    January 2018
    December 2017
    November 2017
    August 2017
    July 2017
    April 2017
    March 2017
    February 2017
    January 2017
    November 2016
    October 2016
    September 2016
    August 2016
    July 2016
    June 2016
    May 2016
    April 2016
    March 2016
    January 2016
    November 2015
    October 2015
    September 2015
    August 2015
    July 2015
    June 2015
    May 2015
    April 2015
    March 2015
    February 2015
    January 2015
    December 2014
    November 2014
    October 2014
    September 2014
    August 2014
    July 2014
    June 2014
    May 2014
    April 2014
    March 2014
    February 2014
    January 2014
    December 2013
    November 2013
    October 2013
    September 2013
    August 2013
    July 2013
    June 2013
    May 2013
    April 2013
    March 2013
    February 2013
    January 2013
    December 2012
    November 2012
    September 2012
    August 2012

    Categories

    All
    Edge
    Exchange 2013
    Hybrid
    Lpe
    Lync 2010
    Lync 2013
    Mobility
    Oauth
    Office365
    Polycom
    Ucs

    RSS Feed

    This website uses marketing and tracking technologies. Opting out of this will opt you out of all cookies, except for those needed to run the website. Note that some products may not work as well without tracking cookies.

    Opt Out of Cookies