eZ Agent Administrator’s Guide Copyright This document is protected by the United States copyright laws, and is proprietary to Zscaler Inc. Copying, reproducing, integrating, translating, modifying, enhancing, recording by any information storage or retrieval system or any other use of this document, in whole or in part, by anyone other than the authorized employees, customers, users or partners (licensees) of Zscaler, Inc. without the prior written permission from Zscaler, Inc. is prohibited. Copyright© 2015 Zscaler Trademark Statements Zscaler and NanoLog are trademarks or registered trademarks of Zscaler, Inc. All other trademarked names used herein are the properties of their respective owners, and are used for identification purposes only. eZ Agent 2.1 Administrator’s Guide, Rev. B eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler -2- Contents eZ Agent Admin Guide ............................................................................................................... 4 About eZ Agent .......................................................................................................................... 5 Supported Systems ............................................................................................................................. 6 Configuring eZ Agent ................................................................................................................. 7 Defining and Managing eZ Agent Configuration Files ........................................................... 8 Loading a New Configuration File ..................................................................................................... 12 Downloading eZ Agent .............................................................................................................. 13 Installing eZ Agent on a Computer .......................................................................................... 14 Using the Installation Wizard ............................................................................................................. 14 Installing eZ Agent Automatically ...................................................................................................... 15 Installing and Managing eZ Agent on Multiple Computers ................................................... 16 Using eZ Agent on a Computer ................................................................................................. 19 Logging In to the Zscaler service ....................................................................................................... 19 Using the eZ Agent Icon ..................................................................................................................... 19 Troubleshooting eZ Agent......................................................................................................... 21 Uninstalling eZ Agent ................................................................................................................ 22 eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler -3- eZ Agent Admin Guide Use eZ Agent to set and enforce proxy settings in your users’ browsers, so their web traffic is always directed to the Zscaler service, regardless of their location. This guide provides an overview of eZ Agent version 2.1. It describes how to install eZ Agent on your organization’s computers and define its configuration settings from the Zscaler service portal. eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler -4- About eZ Agent eZ Agent is a lightweight application that automatically sets and enforces proxy settings in your users’ browsers, so their web traffic is forwarded to the Zscaler service even when they are outside your corporate network. eZ Agent ensures that the web traffic of your mobile users is protected against malicious content and that the corporate Internet usage policies that you defined in the security service are implemented. As shown in the following figure, you can use different mechanisms to forward your organization’s web traffic to the Zscaler service. In the illustration, the router forwards web traffic from the ZCustomer corporate network to the Zscaler service through a GRE tunnel, while eZ Agent enforces proxy settings on the mobile devices of users that are off the corporate network to ensure that the mobile devices forward web traffic to the Zscaler service as well. You can centrally define and manage eZ Agent configuration settings—such as the browser proxy settings, logging level and the passwords for disabling and uninstalling eZ Agent—from the admin portal, and then use the Group Policy Object (GPO) feature of Active Directory (AD) to install eZ Agent on all devices in your organization. eZ Agent is installed as a Microsoft Windows service that runs in the System Tray. It prevents tampering by automatically checking the browser’s proxy settings every few seconds, and resetting them if the user changes or disables them. The service itself is password-protected, so only the network administrator can temporarily disable or uninstall the agent. This ensures that your corporate policy is enforced, regardless of a user’s location. Additionally, eZ Agent recognizes when users connect to “hot spots,” such as airports or coffee shops, where they are required to authenticate or pay before they can access the Internet, and enforces its proxy settings only after a predefined time period. eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler -5- Supported Systems This section lists the systems and browsers that eZ Agent supports: Supported Operating Systems (32-bit and 64-bit) Windows 8 Windows 7 Windows Vista Windows XP Supported Browsers Internet Explorer (6.0 and higher) Firefox (3.0 and higher) Chrome (1.0+) Safari (Windows only) eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler -6- Configuring eZ Agent Do the following to configure eZ Agent settings and install it on your users' computers: 1. The eZ Agent configuration file defines the settings of eZ Agent, such as debug level, number of days that logs are retained and how the browser is configured to forward web traffic— through a PAC file or manual proxy configuration. Zscaler provides one default configuration file and you can create up to 255 custom configuration files. See Defining and Managing Configuration Files. 2. Download eZ Agent from the Zscaler service portal. See Downloading eZ Agent. 3. Install eZ Agent on your users' computers. To install eZ Agent on one computer, see Installing eZ Agent on a Computer. To install eZ Agent on multiple computers, see Installing and Managing eZ Agent on Multiple Computers. eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler -7- Defining and Managing eZ Agent Configuration Files You can centrally define and manage eZ Agent configuration files from the Zscaler service portal. Zscaler provides one default configuration file and you can create up to 255 files. For example, you could create a configuration file for each department or user group in your organization. The eZ Agent configuration file specifies a number of settings, including how the browser is configured to forward web traffic—through a PAC file or manual proxy configuration. If you plan to use a PAC file, you must define it first so you can reference it when you configure eZ Agent. Viewing Configuration Files You can view the default configuration file, but you cannot edit or delete it. To view the default eZ Agent configuration file and any other files that you create: 1. Log in to the security service and go to Administration > Resources > eZ Agent Configurations. 2. In the eZ Agent Configurations page, point to the file and click the View icon. Creating a Configuration File To create a new configuration file: 1. Go to Administration > Resources > eZ Agent Configurations 2. Click Add. 3. In the Add eZ Agent Configuration window, type a Name and Description for the new eZ Agent configuration file and change the default settings as follows: Debug Level: eZ Agent generates a new log file whenever a computer is restarted. For more information on the log file, see Using the eZ Agent Icon. You can set the verbosity of the log file by entering a number from 0 through 10. By default, the debug level is set to 10. The higher the level, the more detailed the log. Log File Retention (days): You can specify the number of days that logs are retained. The default is two days. Disable Protection Password: You can define the password that is required to disable eZ Agent on a computer. The default password is ZSCALER. Uninstall Password: You can define the password that is required to uninstall eZ Agent on a computer. The default password is ZSCALER. Force Proxy Time-Out (sec): eZ Agent automatically recognizes when a user connects to a “hot spot,” such as an airport or hotel, for which authentication or payment is required. You can specify the time during which the proxy settings are not enforced to allow a user to authenticate or make a payment to a captive portal. For example, if this value is set to 300 seconds (5 minutes), eZ Agent’s proxy settings are ignored during that time. At the end of 300 seconds, the proxy settings are enforced regardless of whether eZ Agent can connect to the Zscaler service. The default is 0 seconds, which mean this field is not used. Proxy Type: Specify whether you are using a PAC file for the proxy server configuration, or if you are specifying the proxy configuration. eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler -8- o Use PAC File: When you select this option, you must specify the location of the PAC file. You can accept the default URL, which directs traffic to the ZEN closest to the user or you can type the PAC file URL. o Manual Proxy Configuration: When you select this option, the service displays additional fields where you specify the proxy settings for each type of traffic: HTTP Proxy: This value is entered in the browser’s HTTP proxy address field. You can specify a ZEN (for example, atl1.sme.zscaler.net) host name or accept the default value, which automatically directs traffic to the ZEN closest to the user. HTTP Proxy Port: This value is entered in the browser’s HTTP proxy port field. The default is port 80. HTTPS Proxy: This value is entered in the browser’s Secure proxy address field. You can specify a ZEN host name (for example, atl1.sme.zscaler.net) or accept the default value, which automatically directs traffic to the ZEN closest to the user. HTTPS Proxy Port: This value is entered in the browser’s Secure proxy port field. You can change the default value of 80 to 9443 - a port that ZENs listen to so they can decrypt SSL traffic. This allows the users’ HTTPS traffic to be examined for enforcement of your corporate policies. (If port 9443 is used, browsers must have Zscaler’s Intermediate SSL Certificate installed, so security certificate warnings do not appear in your browsers. FTP Proxy: This value is entered in the browser’s FTP proxy address field. You can specify a ZEN host name (for example, atl1.sme.zscaler.net) or accept the default value, which automatically directs traffic to the ZEN closest to the user. FTP Proxy Port: This value is entered in the browser’s FTP proxy port field. The default is port 80. SOCKS Proxy and SOCKS Proxy Port: You can leave these fields blank. Zscaler is NOT a SOCKS proxy. SOCKS traffic to ZENs are bypassed and allowed Proxy Bypass: Enter the IP addresses of specific hosts or URLs for which you want to bypass the proxies. The values of this parameter are populated in the Exceptions field of Internet Explorer, Mozilla Firefox and Chrome. For example, you can use this option to bypass internal networks. These values must be comma-separated in a single line. Hide Tray Icon: By default, the eZ Agent icon is displayed in the system tray of each user. Select Yes to hide the icon. Configuration Fetch Time (min): This parameter specifies the interval at which eZ Agent checks the service portal for an updated configuration file and downloads it, if there is one. The default is 60 minutes. When you download an eZ Agent configuration file, eZ Agent stores the path to the location of the configuration file. So when you update the configuration in the admin portal, the service uses this path information to replace the existing configuration file with the updated version. If there are multiple configuration files, eZ Agent only replaces the file with the same name. Process Kill-List: You can enter a comma-separated list of programs or processes that are not allowed to run on your users’ computers. Opera is on the kill-list by default. If a user tries to use Opera, a message appears indicating that Opera is not allowed by the organization’s policy. The kill-list is resilient to attempts at evasion where users change file names or locations. eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler -9- Unsupported Browsers: This is a predefined list of web browsers and version numbers that are blocked by the agent. It prevents users from bypassing the Zscaler service by exploiting certain browser versions that may have proxy related bugs. The default value of this field is the following CSV list: firefox 4.0b7, firefox 4.0b8, firefox 4.0b9, firefox 4.0b10, firefox 4.0b11 (these beta releases of Firefox had a proxy setting bug). Protect HOSTS File: This is a Windows file that contains IP address to hostname mappings. Click Yes to prevent users from trying to bypass the proxy servers by adding hostname and IP address pairs to this file. Change Test Connection Settings: These are the settings that eZ Agent uses when it tests connectivity to the Zscaler service. Users can also test connectivity from the eZ Agent icon in the system tray. Zscaler recommends that you do not change these settings. o If you click Yes to change the settings, the service displays additional fields: Test Connection Host: The host to which eZ Agent sends the HTTP request. The default value is gateway.zscaler.net. Test Connection Port: The port to which eZ Agent sends the HTTP request. The default value is port 80. Test Connection Request Data: eZ Agent sends an HTTP request for this data. The default is admin.zscaler.net. Test Connection Response Data: Expected location header of the HTTP response. The default is https://admin.zscaler.net. eZ Agent sends an HTTP request for the value in Test Connection Request Data to the Test Connection Host on the Test Connection Port, and it must receive an HTTP response with the value in Test Connection Response Data in the location header. Gateway Health Monitor Interval (sec): eZ Agent checks whether the Zscaler service gateway is reachable every 30 seconds. You can change this default value. Disable Protection if Gateway Unreachable: eZ Agent disables protection and allows web traffic to bypass the Zscaler service gateway when it is unreachable. You can click No to block access to the Internet until the Zscaler gateway is reachable. 4. Click Save, and then activate the change. 5. Click Download beside the newly created configuration file to download it to your computer. If you have not yet downloaded eZ Agent from the service portal, go to Downloading eZ Agent. If you have downloaded eZ Agent and want to load the new configuration file to your existing eZ Agent, see Loading a New Configuration File. eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler - 10 - Modifying and Deleting Configuration Files Do the following: To edit any admin-defined configuration file, point to the file and click the Edit icon. After you make changes to the file, the service automatically downloads the updated file after the configured time period and distributes it to all the agents. To delete an admin-defined eZ Agent configuration file, point to the file and click the Edit icon. Then click Delete at the bottom on the dialog. If you inadvertently delete a configuration file that is in use, you can create a new file with the same name and use it again. eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler - 11 - Loading a New Configuration File Follow this procedure if you have downloaded eZ Agent and want to load a new configuration file to your existing eZ Agent. If you have not yet downloaded eZ Agent from the service portal, go to Downloading eZ Agent. 1. From the Zscaler service portal, go to Administration > Resources > eZ Agent Configurations, and click Download eZ Agent to download the encrypted configuration file to a folder on your local computer. 2. On your computer, right-click the eZ Agent icon and click Load new configuration file. 3. When the password prompt appears, enter the Disable password that you set in the current configuration file. 4. Navigate to the new configuration file and select it. eZ Agent displays a message indicating that the new configuration file was loaded. If you created multiple configuration files, download each file to its respective user group or department folder that contains the eZ Agent files. You can then install eZ Agent with the new configuration file on your users’ computers. For more information, see Installing and Managing eZ Agent on Multiple Computers. eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler - 12 - Downloading eZ Agent To download eZ Agent: 1. From the Zscaler service portal, go to Administration > Resources > eZ Agent Configurations. 2. Click Download beside the file that you want to download. The eZ_Agent.zip file contains the following files: eZSetup: Use this file to run the installation wizard and install eZ Agent on a local computer. The wizard provides several options for installing eZ Agent. You can also run the wizard to make changes to an existing eZ Agent installation. See Using the Installation Wizard. Silent_Setup.bat: Use this file to install eZ Agent in silent mode or on multiple computers using the Active Directory GPO feature. You can also use this file to automatically install eZ Agent on a local computer without running the installation wizard. Note: You can use either the eZSetup.msi or the Silent_Setup.bat file to install eZ Agent on multiple computers using GPO. Zscaler recommends that you use the Silent_Setup.bat file. Uninstall.bat: Use this file to uninstall eZ Agent on a local computer. See Uninstalling eZ Agent on a Computer. config.dat: This file contains the eZ Agent configuration settings. When you first download the eZ Agent zip file, this file contains the default configuration settings. You can define a new configuration file and download it to replace the default configuration file. See Defining and Managing eZ Agent Configuration Files. eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler - 13 - Installing eZ Agent on a Computer You can install eZ Agent on individual computers or on multiple computers using the Active Directory GPO feature. If you have an earlier version of eZ Agent installed, Zscaler recommends that you uninstall it before installing a new version. For information on uninstalling eZ Agent, see Uninstalling eZ Agent. You can use either the eZ Agent Setup Wizard or the Silent.bat file to install eZ Agent on a computer. Use the wizard to customize the installation settings or to update the settings of an existing installation. The Silent.bat file automatically installs the agent on your computer without presenting any options. Using the Installation Wizard To use the eZ Agent Setup Wizard: 1. On your computer, navigate to the eZsetup.msi file and double-click it. 2. Click Next when the Welcome dialog appears. 3. Select I accept the terms in the License Agreement when the End User License Agreement appears. 4. In the Custom Setup window, select where the eZ Agent binaries and configuration file are saved. By default, both files are saved on your hard drive. If you are re-installing eZ Agent and selected different settings, click Reset. The disk requirements for the binaries and configuration file appear when you select them. To check whether you have enough space in your disk drives, click Disk Usage to view the available and required disk space. eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler - 14 - 5. Click Install to begin the installation. 6. Click Finish after the installation is completed. The eZ Agent icon appears in the system tray. See Using the eZ Agent Icon. Installing eZ Agent Automatically To use the Silent_Setup.bat file to automatically install eZ Agent on an individual computer: 1. Open the Windows command prompt and navigate to the eZ Agent folder. 2. Run the Silent_Setup.bat file as Administrator. This .bat file runs the eZSetup file and loads your custom config.dat file settings. The eZ Agent icon appears in the system tray after it is installed. If you reinstalled eZ Agent on a computer, you are prompted to restart your computer after the installation. eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler - 15 - Installing and Managing eZ Agent on Multiple Computers Use the Active Directory (AD) Group Policy (GPO) feature to automate installing eZ Agent on multiple computers. Before you do, you must log in to the AD server as an Administrator and copy the eZ Agent files to a shared folder on the server. This section describes how to use the AD GPO feature on a Windows 2003, 2000, and XP Professional server. For more information on Active Directory or its features, refer to the Windows Active Directory documentation. To install eZ Agent on multiple computers: Step 1: On the AD server, go to the Properties window. 1. Log in to the Active Directory server as an Administrator. 2. Click Start > Administrative Tools to open the Active Directory Users and Computers console tree. Then, click Active Directory Users and Computers. 3. In the Active Directory Users and Computers console tree, right-click your domain, and then click Properties, to open the Properties window which displays the properties of your domain. Step 2: Create a new GPO In the Properties window, do the following: 1. Click Group Policy, and then click New. 2. Enter the name of the new GPO. 3. Click Properties to view the properties of the new GPO. 4. In the New GPO Properties window, do the following: a. Click Security. b. Select Allow Group Policy to apply the GPO to the appropriate groups. c. Click OK, and then click Close to exit the window. Step 3: Assign eZ Agent to multiple computers. In the Properties window, do the following: 1. Click Group Policy. 2. Select the newly created GPO, and then click Edit. 3. Go to Computer Configuration > Software Settings to assign the eZ Agent package. 4. Under Software Settings, do the following: a. Right-click Software Installation. b. Click New > Package. c. In the New GPO Properties window, do the following: o Enter the path of the eZ Agent files. eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler - 16 - For example: \\GPO control server\shared folder\eZAgent.msi. 5. o Click Open to open the installer package. o Click Assigned to assign eZ Agent to the computers. Click OK. The eZ Agent installer package appears in the Group Policy section in the right pane. 6. Click Close to exit the Properties window. 7. Close the Active Directory Users and Computers window. When end users start their computers, the Silent_Setup.bat file automatically runs the eZSetup.msi file using the values in the configuration file, and then launches eZ Agent. You can also do the following: Redeploy eZ Agent You can easily redeploy eZ Agent when you need to upgrade to the latest version. To redeploy the assigned eZ Agent package, navigate to the Properties window and do the following: 1. Click Group Policy. 2. Select the GPO used for the eZ Agent deployment, and then click Edit. 3. Click Software Settings. 4. Click the eZ Agent software installation item that contains the eZ Agent installation package. 5. When the Group Policy window appears, do the following: a. Right-click eZ Agent. b. Click All Tasks > Redeploy application. A warning message appears stating that the package will be reinstalled on all devices on which it was previously installed. c. Click Yes in the warning message. d. Click Close to exit the window. 6. Click OK. 7. Close the Active Directory Users and Computers window. Remove eZ Agent To remove eZ Agent, navigate to the Properties window and do the following: 1. Click Group Policy. 2. Select the GPO used for the eZ Agent package deployment and click Edit. 3. Click Software Settings. 4. Click the eZ Agent software installation item that contains the eZ Agent installation package. The Group Policy window appears. 5. In the Group Policy window, do the following: a. Right-click eZ Agent. eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler - 17 - b. Click All Tasks > Remove, and then select one of the following options: o Immediately uninstall the software from users and computers o Allow users to continue to use the software but prevent new installation 6. Click OK, and then click Close to exit the window. 7. Click OK. 8. Close the Active Directory Users and Computers window. eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler - 18 - Using eZ Agent on a Computer After eZ Agent is installed on a computer, the user is required to log in to the Zscaler security service before accessing any site on the Internet. eZ Agent also displays an icon on the system tray, which provides certain functions. This section describes how to log in to the Zscaler service and how to use the eZ Agent icon. Logging In to the Zscaler service After eZ Agent is installed on a computer, the user must log in to the Zscaler service as follows: 1. Browse to any external site (for example, www.zscaler.com). The Zscaler service displays a Login window where you are prompted to authenticate. 2. Enter your user name and click Submit. 3. Enter your password and click Login. The Zscaler service allows the user to continue to the site. Then, as the browser retrieves web pages, the Zscaler service scans them for a range of malware threats and delivers clean traffic. Using the eZ Agent Icon After eZ Agent is installed on a computer, its icon appears in the system tray, as shown in the following figure. Users can right-click the icon to view its available options, as shown in the following figure. They can do the following: Select Test Gateway Connection to test the connection to the Zscaler security service. After eZ Agent confirms the connection, it displays a message indicating that it's enabled. eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler - 19 - Select Disable protection to temporarily bypass the Zscaler security service. Users must enter the password that was specified in the configuration file. The eZ Agent icon changes and displays a warning message indicating that eZ Agent is disabled. Users must close the browser and reopen it to remove the proxy settings configured by eZ Agent. To reactivate eZ Agent, right-click and select Re-enable the protection. No password is required to re-enable the agent. Select Load new configuration file to upload a new eZ Agent configuration file. Users must enter the disable password that was specified in the configuration file, and download it to the desired location. eZ Agent displays a message indicating that a new file was loaded. Select Export Logs to File to download logs to a file for debugging purposes. Click this option and navigate to where you want to store the log files. After the export, eZ Agent displays a message confirming the export. To view the eZ Agent log, double-click the eZ Agent icon. A log window appears. eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler - 20 - Troubleshooting eZ Agent Following are some guidelines for troubleshooting eZ Agent: Can I add two configuration files with the same name? An organization cannot add two configuration files with the same name. I am unable to delete the default configuration file. You can delete any configuration file except the default configuration file. I deleted a configuration file that is in use. Create a new configuration file with the same name. How many configuration files can I add? You can add a maximum of 255 configuration files. eZ Agent does not recognize the disable or uninstall password Your configuration file might be corrupted. In this situation, enter Z$C@1ER to uninstall eZ Agent, and then download a new configuration file. Error – “<Mandatory File Name> is mandatory.” This error appears when you create a new configuration file without any name. You cannot leave the File Name field blank, when creating a new configuration file. Error – “<Mandatory Description> is mandatory.” This error appears when you create a new configuration file without a description. You cannot leave the Description field blank, when creating a new configuration file. There are many eZ Agent configuration files in the security service. Which configuration file will eZ Agent fetch? eZ Agent will fetch the configuration file you used during the installation. If you want to use another configuration file, download it from the security service and upload it manually by rightclicking the systray icon. I deleted some configuration files from the security service and created some new files, but the changes are not reflected. eZ Agent tries to fetch the changes from a configuration file that has the name same as the one it is using. So, if you deleted the configuration file that eZ Agent is using, it will continue to use the existing configuration. You can avoid this situation by making your changes in the existing configuration files, or creating a new configuration file with the same name. Alternatively, you can download the configuration file from the security service, and let the user upload it manually by right-clicking the systray icon. Note: Zscaler recommends that you always delete configuration files that are no longer in use. eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler - 21 - Uninstalling eZ Agent To uninstall eZ Agent: 1. From the Start menu, click Control Panel. 2. In the Control Panel window, select the option for installing/uninstalling programs. In Windows XP, click Add/Remove Programs. In Windows 7, click Programs and Features. 3. From the list of programs, select eZ Agent. 4. When you are prompted for a password, enter the uninstall password that was specified in the configuration file. If you are using the default configuration file, enter ZSCALER. Alternatively, to run the Silent_Setup.bat and Uninstall.bat files: 1. Search for cmd in the Start menu. 2. Right-click cmd and select Run as Administrator to open the command prompt. 3. Enter the location of the .bat file in the command prompt. 4. Type uninstall.bat and press Enter. eZ Agent 2.1, Rev. B Copyright © 2015 Zscaler - 22 -
© Copyright 2026 Paperzz