ProxySG First Steps: Deploying an Explicit Proxy - … ·...

Blue Coat Security First StepsSolution for Deploying an Explicit Proxy

SGOS 6.5

Third Party Copyright Notices© 2014 Blue Coat Systems, Inc. All rights reserved. BLUE COAT, PROXYSG, PACKETSHAPER, CACHEFLOW,INTELLIGENCECENTER, CACHEOS, CACHEPULSE, CROSSBEAM, K9, DRTR, MACH5, PACKETWISE,POLICYCENTER, PROXYAV, PROXYCLIENT, SGOS, WEBPULSE, SOLERA NETWORKS, DEEPSEE, DSAPPLIANCE, SEE EVERYTHING. KNOW EVERYTHING., SECURITY EMPOWERS BUSINESS, BLUETOUCH, theBlue Coat shield, K9, and Solera Networks logos and other Blue Coat logos are registered trademarks or trademarks ofBlue Coat Systems, Inc. or its affiliates in the U.S. and certain other countries. This list may not be complete, and theabsence of a trademark from this list does not mean it is not a trademark of Blue Coat or that Blue Coat has stopped usingthe trademark. All other trademarks mentioned in this document owned by third parties are the property of their respectiveowners. This document is for informational purposes only.

BLUE COATMAKES NOWARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE INFORMATION INTHIS DOCUMENT. BLUE COAT PRODUCTS, TECHNICAL SERVICES, AND ANY OTHER TECHNICALDATAREFERENCED IN THIS DOCUMENT ARE SUBJECT TOU.S. EXPORT CONTROLAND SANCTIONS LAWS,REGULATIONS AND REQUIREMENTS, AND MAY BE SUBJECT TOEXPORTOR IMPORT REGULATIONS INOTHER COUNTRIES. YOU AGREE TOCOMPLY STRICTLY WITH THESE LAWS, REGULATIONS ANDREQUIREMENTS, AND ACKNOWLEDGE THAT YOU HAVE THE RESPONSIBILITY TOOBTAIN ANY LICENSES,PERMITS OR OTHER APPROVALS THATMAY BE REQUIRED IN ORDER TOEXPORT, RE-EXPORT, TRANSFERIN COUNTRY OR IMPORT AFTER DELIVERY TOYOU.

Americas:

Blue Coat Systems, Inc.

420 N. Mary Ave.

Sunnyvale, CA 94085

Rest of theWorld:

Blue Coat Systems International SARL

3a Route des Arsenaux

1700 Fribourg, Switzerland

Blue Coat Security First Steps

Contents

Third Party Copyright Notices 2

Solution: Deploy an Explicit Proxy 4

Set Up an Explicit Proxy 5

Set Services to Intercept - Explicit Proxy 6

Explicit Proxy Services 6

Manually Configure Explicit Proxy Settings in the Browser 7

Download Explicit Proxy Settings from a PAC File 12

Edit the Accelerated PAC File 12

Deploy the PAC File from the ProxySGAppliance 13

Serve the PAC File from aWeb Server 14

Specify the PAC File Location in the Browser 15

Allow Browsers to Auto-Detect Settings 20

Test Explicit Client Connections 21

List Active Sessions for a Proxy 23

Explicit Proxy Troubleshooting 24

Why are users experiencing slow browser performance? 24

Why are browsers connecting with outdated PAC settings? 24

Why are requests connecting directly instead of being redirected to proxy? 24

3

Deploy an Explicit Proxy

Solution: Deploy an Explicit ProxyYou can configure every client workstation in your network to direct their web requests to the ProxySG appliance. Thisdeployment type is called explicit proxy. After a client is configured for explicit proxy, all user requests are sent to the appli-ance rather than to the origin content server (OCS) . The appliance then determines whether to allow or deny the requestbased on web access policy.

Note: You can configure user agents such as browsers, e-mail clients, FTP clients, and client-sideapplications. Because browsers are by far themost widely used user agents in a typical network, this solution cov-ers how to configure them for explicit proxy.

For allowed transactions, the appliance either services the user's request from a cached version of the page stored on theappliance's disk, or it connects to the OCS to retrieve the content to cache and serve to the user.

Example of explicit proxy traffic flow - request allowed

1. A user enters a URL in the browser's address bar. (This browser has already been configured to send traffic to theappliance explicitly.)

2. The browser connects to the proxy service and sends the user request. The destination IP address is that of theProxySG appliance.

3. The appliance examines the request details (client IP, username/group if configured, URL, path, category) andcompares them against allow and deny policy. Based on proxy service and policy settings, the appliance allowsthis request.

4. The ProxySG forwards the user's request to the OCS. The source IP address of the request is that of theappliance.

5. When theOCS responds, the appliance adds the content to its cache and forwards the response to the user.

Example of explicit proxy traffic flow - request denied

4


1. A user enters a URL in the browser's address bar. (The browser has already been configured to send traffic to theappliance explicitly.)

2. The browser connects to the proxy service and sends the user request. The destination IP address is that of theProxySG appliance.

3. The appliance examines the request details (client IP, username/group if configured, URL, path, category) andcompares them against allow and deny policy. Based on proxy service and policy settings, the appliance deniesthis request.

4. The appliance sends the user an exception page providing details on why the request was denied.

Whether an explicit deployment is appropriate for your organization could depend on business and security policy. Youshould analyze your requirements to determine if explicit deployment is appropriate for you. For example, the deploymenttype that best suits your needs could depend on whether your organization has a "bring your own device" (BYOD) policy.

To configure your network for explicit proxy, select amethod to perform to deploy proxy settings to users, and then verifythat client connections are proxied explicitly.

1. Set Up an Explicit Proxy.2. Test Explicit Client Connections.

Set Up an Explicit Proxy

To set up your network for an explicit proxy, configure the SSL proxy service (if required), and then select one or moremethods to deploy proxy settings to the users in your network.

1. Configure the Explicit HTTP services to intercept. See Set Services to Intercept - Explicit Proxy for instructions.

2. Make sure that clients can access the Internet only by going through the appliance. Configure the firewall to restrictoutbound access to ports 80, 443, and 21 to the appliance's IP address.Refer to your firewall documentation if you require more information.

3. Determine whichmethod to use to set up the explicit proxy; refer to the following table.

5


Method Might be appropriate if... Refer to this topic

Configure browsers with the IP address andport of the ProxySG appliance.

l Your network is not too complex orthe number of client devices is notvery high.

l Some users occasionally uselaptops or other devices thatcannot download settings from aninternal web server.

Manually ConfigureExplicit Proxy Set-tings in the Browser

Download Proxy Auto-Configuration (PAC)information from an internal web server orload the file directly on the appliance.

l Your network has many devices oris complex.

l All devices in your network aresubject to the same policies andproxy configuration.

Download ExplicitProxy Settings from aPAC File

Configure the appliance to automaticallydetect explicit proxy settings.

l Youwant to avoid complex manualconfiguration.

Allow Browsers toAuto-Detect Settings

Tip Depending on your network configuration and users' requirements, youmight want to usemore than one of themethods described above to deploy proxy settings. For example, you could use a PAC file for all client work-stations in the network, but have users manually configure the browsers on their laptops.

Set Services to Intercept - Explicit Proxy

For explicit proxy deployments, client browsers direct all traffic to the appliance on the same port, (typically 80 or 8080).When explicit traffic is intercepted, the appliance uses an advanced protocol detectionmethod to identify the type oftraffic, (HTTP, HTTPS, RTMP, and so on) and handle it according to the standards for that traffic.

Explicit Proxy Services

1. In theManagement Console, select Configuration > Services > Proxy Services.2. Under Predefined Service Groups, expand the Standard group. A list of services displays.3. Locate Explicit HTTP, select it, and click Edit Service.4. Enable Detect Protocol.5. Under Listeners, set the explicit proxy ports (8080 and/or 80) to Intercept.

6


6. Click OK and Apply . The appliance confirms your changes.

Manually Configure Explicit Proxy Settings in the Browser

To set up an explicit proxy using the browser, configure the ProxySG appliance as the proxy server in each client browser.In a typical setup, enter the appliance's IP address and port on which the appliance listens for traffic (by default, 8080).

Select the appropriate browser for instructions. If users use a different version, instructions might differ slightly.

Microsoft Internet Explorer version 8.x

1. Open Internet Explorer.2. Select Tools > Internet Options > Connections > LAN settings. Youmight have tomake the Command Bar

visible first.The LAN Settings window appears.

7


3. Under Proxy server, select the option to use a proxy server.

4. In the Address field, enter the ProxySG IP address/hostname.5. (If applicable) In the Port field, enter the port (for example, 8080).6. Click OK > OK.

Mozilla Firefox version 24.0

1. Open Firefox.2. Select Tools > Options > Advanced > Network > Settings.

8


3. On the Connection Settings dialog that appears, select Manual proxy configuration.

4. In the HTTP Proxy field, enter the ProxySG IP address/hostname.5. (If applicable) In the Port field, enter the port (for example, 8080).6. Click OK > OK.

Google Chrome version 30.x

1. Open Chrome.2. Select Settings. If the option is present, select Show Advanced Settings.3. Under Network, click Change proxy settings. The Internet Properties window appears.4. On the Connections tab, click LAN settings.

The LAN Settings window appears.

9




Apple Safari version 5.1.7 (Windows)

1. Open Safari.2. Select the settings menu, selectPreferences, and then click Advanced.

3. Click Change Settings.The Internet Properties pane opens.

4. Click LAN Settings.The LAN Settings window appears.

10




Apple Safari (Mac)

1. Open Safari.2. From the Applemenu, select Preferences.3. From the Settings menu, select Preferences.4. Click Advanced.

5. Beside Proxies, click Change Settings.

6. Click the Advanced button.

7. From the Applemenu, select Preferences.

8. (If necessary) Select your active network interface (usually Ethernet orWi-Fi).

9. Select Advanced.

10. Click Proxies.

11. Select Internet & Wireless > Network.

12. Select Advanced > Proxies.

13. Click Web Proxy (HTTP).

14. UnderWeb Proxy Server, enter the ProxySG appliance IP address and port.

11


15. Click OK.

Next Step: Test Explicit Client Connections

Download Explicit Proxy Settings from a PAC File

You can specify that browsers download explicit proxy settings from a Proxy Auto-Configuration (PAC) file. A PAC file isa JavaScript file that defines a FindProxyForURL function, which tells the browser to either redirect to a proxy server orconnect directly to the URL.

Two PAC files ship with the ProxySG appliance:

l a read-only default PAC file, which specifies to use the appliance as the proxy server:http://<ProxySG_IP_address>:<port>/proxy_pac_file

l an editable PAC file, which specifies when to use the appliance as the proxy and which ports to use for specifictypes of requests, as well as when to connect directly to the origin content server (OCS):http://<ProxySG_IP_address>:<port>/accelerated_pac_base.pac

For information on configuring the PAC file, refer to http://en.wikipedia.org/wiki/Proxy_auto-config.

Next Step: Edit the Accelerated PAC File

Edit the Accelerated PAC File

You can use the basic Proxy Auto-Configuration (PAC) file that ships with the ProxySG appliance, but if you want to cre-ate custom PAC settings for your deployment, you can edit the accelerated PAC file.

12

http://en.wikipedia.org/wiki/Proxy_auto-config


Caution: The PAC file is written in JavaScript. You should be familiar with JavaScript functions before attemptingto edit the file.

1. Download the PAC file from the appliance:http://<ProxySG_IP_address>:<port>/accelerated_pac_base.pac

2. Open the PAC file in a text editor such as Notepad.3. Edit the file as appropriate for your deployment.

If you are setting up the network for explicit proxy for the first time, it is a good idea to create a relatively simplePAC file for testing.

Refer to this example of an edited PAC file. The PAC file contents in the example are as follows:

l If the hostnamematches yourdomain.com anywhere in the URL, redirect requests to 198.51.100.0; if the proxycan't be reached, go direct

l take the same action if the URLmatches the specified ftp, images, or graphics URLsl If the request contains aWindows Media protocol (mms or rtsp) redirect to 198.51.100.1 or 198.51.100.2respectively; if the proxy can't be reached, go direct

l If the request is for streamingmedia on yourdomain.com, redirect to 198.51.100.3; if the proxy can't be reached, godirect

l If the hostname is not a fully-qualified domain name (FQDN), is an internal FQDN, or is any host in thealtyourdomain.com domain, go direct

l If none of the previous conditions apply, redirect to 198.51.100.10; if the proxy can't be reached, go direct

After you edit the accelerated PAC file you can load it directly on the appliance; see Deploy the PAC File from theProxySGAppliance.

Alternatively, you can deploy PAC information in the following ways:

n Serve the PAC File from aWeb Server - Upload the file to an internal web server, and then download the file to theappliance.

n Specify the PAC File Location in the Browser - Upload the file to an internal web server, and then instruct users tospecify the URL to the file in the browser.

Deploy the PAC File from the ProxySG Appliance

Use this method if you plan to create your own PAC file and deploy it from the appliance.

1. Open the edited PAC file in a text editor such as Notepad.2. Edit the file as appropriate for your deployment and then copy the file contents.3. Log into the ProxySG command line interface (CLI).4. Enter enablemode.5. In enablemode, enter:

#inline accelerated-pac EOF#<PAC_file_contents>#<eof>

where:

n <PAC_file_contents> is the PAC file contents you copied in step 3; paste the contents heren <eof> is an end-of-file marker; choose one that does not match any string in the PAC file itself

6. The CLI responds ok.

Example of PAC file pasted in the CLI

13


For an explanation of the contents of the file in this example, see Edit the Accelerated PAC File.


Serve the PAC File from a Web Server

You can upload the edited PAC file to your internal web server and then instruct the ProxySG appliance to download itfrom the web server.

Note: Before proceeding, ensure that read permissions are set on the web server so the appliance can read thePAC file.In addition, configure the web server with one of theMIME types for PAC files:application/x-ns-proxy-autoconfigapplication/x-javascript-config

If theMIME type is not configured for .pac extensions, users may experience connection issues.

14


1. Open the edited PAC file in a text editor such as Notepad.2. Edit the file as appropriate for your deployment.3. Upload the edited PAC file to your internal web server.


Specify the PAC File Location in the Browser

If you want certain users or groups of users to use the same PAC file, you can instruct them to specify the location of thePAC file in their browsers.

Note: Configure the web server with one of theMIME types for PAC files:application/x-ns-proxy-autoconfigapplication/x-javascript-config

If theMIME type is not configured for .pac extensions, users may experience connection issues.

1. Configure the ProxySG appliance's TCP port 80 to accept explicit connections.

The browser can retrieve the PAC file URL via DHCP option 252 if your DHCP server is configured to send option252 and the host is using DHCP (as opposed to a host configured with a static IP address.) For someDHCPservers, youmight have to add the entry for option 252.


3. Open the edited PAC file in a text editor such as Notepad.4. Edit the file as appropriate for your deployment.5. Upload the edited PAC file to your internal web server and note the path to the file.6. Configure the browser with the PAC file URL.

Select the appropriate browser for instructions. If users use a different version, instructions might differ slightly.

Microsoft Internet Explorer version 8.x

1. Open Internet Explorer.2. Select Tools > Internet Options.3. Click the Connections tab and then click LAN Settings.

15


4. On the dialog, select Use automatic configuration script.

5. Enter the PAC URL in the Address field.6. Select OK > OK.

Mozilla Firefox version 24.0

1. Open Firefox.2. Select Tools > Options.3. Select Advanced > Network.4. In the Connection section, click Settings.

16


5. On the dialog, select Automatic proxy configuration URL.

6. In the field, enter the PAC URL.7. Select OK > OK.

Google Chrome version 30.x

1. Open Chrome.2. In the Chromemenu, select Settings.3. Click Show advanced settings.4. Scroll down. Under Network, click Change proxy settings.

17



6. Enter the PAC URL in the Address field.7. Select OK > OK.

Apple Safari version 5.1.7 (Windows)

1. Open Safari.2. From the Settings menu, select Preferences.3. Click Advanced.


5. Click the Advanced button.The Internet Properties window appears.

6. Click the Connections tab and then click LAN Settings.

18



8. Enter the PAC URL in the Address field.9. Select OK > OK

Apple Safari version 6.0.5 (Mac)

1. Open Safari.2. From the Settings menu, select Preferences.3. Click Advanced.


5. Click the Advanced button.

6. From the Applemenu, select Preferences.

7. (If necessary) Select your active network interface (usually Ethernet orWi-Fi).

8. Select Advanced.

9. Click Proxies.

10. Select Automatic Proxy Configuration .

11. Enter the URL of the hosted PAC file in the URL field.

19


12. Select OK.

Tip If you want users' browsers to determine the location of the PAC file using DNS, youmust use theWeb ProxyAuto-Discovery Protocol (WPAD)method. See Allow Browsers to Auto-Detect Settings.


Allow Browsers to Auto-Detect Settings

If you want all devices in your network to use the same proxy settings, you can configure the ProxySG appliance to allowbrowsers to auto-detect settings. UsingWeb Proxy Auto-Discovery Protocol (WPAD) allows you to enforce the same set-tings for all users. Use this method if you want all users' browsers to determine the location of the PAC file through DNS.


2. Open the edited PAC file in a text editor such as Notepad.3. Edit the file as appropriate for your deployment. See Edit the Accelerated PAC File.4. Upload the renamed file to the root directory of your internal web server.5. Add a DNS record to your internal DNS server to resolve theWPAD hostname to the ProxySG appliance

IP address.For example, if the local domain is yourdomain.com, add a record resolving wpad.yourdomain.com to the applianceIP address.

6. Configure an explicit HTTP proxy service to allow browsers to receive theWPAD requests. In theManagementConsole, select Configuration > Services > Proxy Services.

20


Tip The appliancemust be actively listening on whatever port you specify in the service. Port 80 is thedefault and thus does not have to be specified in browsers; however, if you want to use a different port, youmust enable it for listening and then specify the port when configuring the explicit HTTP service. Forinstructions, see Set Services to Intercept - Explicit Proxy .

7. Configure a redirect policy to convert the client’s request forhttp://wpad.yourdomain.com/wpad.datto a request forhttp://<ProxySG_IP_Address>:<port>/accelerated_pac_base.pac.

The following is an example:

<Proxy>

ALLOW url.path.exact=/wpad.dat action.ReturnRedirect1(yes)

define action ReturnRedirect1

request_redirect( 302, ".*", "http://wpad.yourdomain.com/accelerated_pac_base.pac" )

end

When the user launches a browser, the browser attempts to detect proxy settings and issues an HTTP GET request to thehostname on the internal DNS server. The browser then installs the PAC file.


Test Explicit Client Connections

After you have configured the network for explicit proxy, you should test client connections and verify that they are goingthrough the proxy server explicitly.

1. Set a Deny policy.a. In theManagement Console, select Configuration > Policy > Policy Options.b. Under Default Proxy Policy, select Deny.c. Click Apply.

2. Go to various web pages using the browser. You should receive exception pages stating that access is denied dueto policy.

3. Set an Allow policy.a. In theManagement Console, select Configuration > Policy > Policy Options.b. Under Default Proxy Policy, select Allow.c. Click Apply.

4. Go to various web pages using the browser. You should be able to access the web pages.5. Use one of the followingmethods to verify that connections are being proxied:

l View active sessions1. Go to various web pages using the browser.2. View Active Sessions statistics and verify that they show explicit HTTP connections. See List

Active Sessions for a Proxy for instructions,

21


3. In the Client column, look for HTTP connections originating from the IP address of the ProxySGappliance.

Requests sent to the origin content server (OCS) on behalf of the client display the ProxySGappliance IP address in the Client column.

l View the access log in real time1. If access logging is disabled, enable it. In theManagement Console, select Configuration > Access

Logging > General. Select Enable Access Logging and then click Apply.2. Start the access log tail. Select Statistics > Access Logging > Log Tail. Click Start Tail.3. Go to various web pages using the browser.4. To stop the log tail, click Stop Tail.5. On the Log Tail tab, look for events pertaining to the web pages you visited. They display as

originating from the IP address of the ProxySG appliance.

The access log tail shows events in real time.

22


List Active Sessions for a Proxy

The Active Sessions report provides an immediate picture of the client-server sessions and the associated protocols, ser-vices, bytes, savings, and other statistics.

1. In theManagement Console, select Statistics > Sessions > Active Sessions > Proxied Sessions.2. From the Filter drop-down list, select Proxy.

3. Select a proxy name from the drop-down list.

4. Click Show to see the list of connections for the selected proxy.

23


Explicit Proxy Troubleshooting

Why are users experiencing slow browser performance? 24

Why are browsers connecting with outdated PAC settings? 24

Why are requests connecting directly instead of being redirected to proxy? 24

Why are users experiencing slow browser performance?

Problem:Users report slow browser performance.

Resolution: This problem has more than one possible solution.

Solution 1: The PAC file is large and has toomany lines. Each line in the PAC file, including comments, is parsed eachtime the browser encounters a URL on an HTML page. If your PAC file has extraneous lines, try to rewrite it to make itmore efficient.

Solution 2: The Proxy Auto-Configuration (PAC) file location was specified using a hostname, which could cause a per-formance hit due to excessive DNS lookups. If you suspect this could be the cause of the issue, use an IP address for thePAC file location.

Why are browsers connecting with outdated PAC settings?

Problem: Browsers connect using outdated Proxy Auto-Configuration (PAC) settings.

Resolution: You updated the PAC file, but some users' browsers cached the previous PAC settings. Instruct users to doone of the following:

l Clear the browser cache.l Start a new browser session.

Why are requests connecting directly instead of being redir-ected to proxy?

Problem: Users' requests are connecting directly to the origin content server (OCS) instead of the proxy server. You havespecified in the proxy auto-configuration (PAC) file that these requests should be sent to proxy server.

Tip You can verify that requests are connecting directly by using a network monitoring utility such as TCPView.exeto determine where the browser is redirecting.

Resolution: This problem has more than one possible solution.

Solution 1: If the PAC file specifies that requests go direct if the proxy server cannot be reached, verify that the proxy inquestion is reachable.

Solution 2: Debug the JavaScript in the PAC file. Look for incorrect syntax and other errors.

24

Date post:	27-Aug-2018
Category:	Documents
Upload:	phungdiep
View:	231 times
Download:	2 times

ProxySG First Steps: Deploying an Explicit Proxy - … ·...

Documents