Deployment Brief:
Explicit Proxy Access Method
Version 6.9.x/Doc Revision: 03/24/17
Blue Coat Web Security Service/Page 2
Page 3
Copyrights
Copyright © 2017 Symantec Corp. All rights reserved. Symantec, the Symantec Logo, the Checkmark Logo, Blue Coat, and
the Blue Coat logo are trademarks or registered trademarks of Symantec Corp. or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only
and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are
disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice.
THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS,
REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE
EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL
NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING,
PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS
DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.
Symantec Corporation
350 Ellis Street
Mountain View, CA 94043
www.symantec.com
Page 5
Web Security Service Access Method: Explicit Proxy
The Blue Coat Web Security Service solutions provide real-time protection against web-borne threats. As a cloud-based
product, the Web Security Service leverages Blue Coat's proven security technology as well as the WebPulse™ cloud community of over 75 million users.
With extensive web application controls and detailed reporting features, IT administrators can use the Web Security Service
to create and enforce granular policies that are instantly applied to all covered users, including fixed locations and roaming
users.
This document describes how to set up explicit proxy connections to the Web Security Service for security scanning and
policy checks on web-bound traffic.
This document contains topics collected from the Web Security Service online documentation. For the complete doc set,
see:
https://bto.bluecoat.com/documentation/All-Documents/Web Security Service
Table Of Contents
Copyrights
3
Web Security Service Access Method: Explicit Proxy
5
Table Of Contents
About the Explicit Proxy Access Method
5
7
Access From the Corporate Network
7
Access From Remote Users
8
Plan The Explicit Proxy Access Method
10
Select an Explicit Proxy Method
11
Pre-Deployment: Select Authentication Method
11
Automatic
11
Manual
11
Publish PAC File With WPAD
Next Step
Edit Browser to Explicitly Proxy
12
12
13
Edit Safari Proxy Setting
14
Verify Firewall Setting
14
Next Step
Edit Chrome Browser Proxy Setting
Verify Firewall Setting
Next Step
14
15
15
15
Blue Coat Web Security Service/Page 6
Edit IE Browser Proxy Setting
Verify Firewall Setting
Next Step
Edit Firefox Browser Proxy Setting
Verify Firewall Setting
Next Step
16
16
16
17
17
17
Prevent IP/Subnet From Routing to the Web Security Service
18
Add an Explicit Proxy Location
20
Verify Service Connectivity to Locations
22
All Locations
22
Additional Step For Remote Users
22
Windows
23
Mac
24
Verify Client Protection
Reference: Required Locations, Ports, and Protocols
Blue Coat Resource
24
26
26
Access Methods
26
Authentication
27
Cloud-to-Premises DLP
27
Reference: Sample PAC File for Explicit Proxy
28
About the Explicit Proxy Access Method/Page 7
About the Explicit Proxy Access Method
A proxy auto-config (PAC) file is a JavaScript that enables web browser requests from within a company firewall to bypass
the proxy server based on the IP address of the computer being used to access internal websites. Computers inside the
firewall are given access to sites on the corporate intranet without being routed through the Blue Coat Web Security Service. Requests for external websites or requests made by company-owned computers using an external IP address are
routed through the service. PAC files might also direct the web browser request to a specific proxy. The Web Security Service might restrict access based on the rules and restrictions governing web access.
Tips
n
To provide user identities or provide a backup to proxy forwarding, you can deploy trans-proxy, or Explicit Proxy
Over IPsec.
n
The Roaming Captive Portal feature allows you to authenticate explicitly proxied users
Access From the Corporate Network
Data Flow
A—All requests for external web content from IP addresses behind the firewall route through the Web Security Service.
B—The PAC file might include a list of sites (destinations by IP addresses) that bypass the Web Security Service.
C—The PAC file script identifies the internal IP address based on the RFC 1918 standard. Direct access to the internal
URL is granted.
Blue Coat Web Security Service/Page 8
Access From Remote Users
Data Flow—Split VPN
A—The PAC file script identifies the internal IP address based on the RFC 1918 standard. Direct access to the internal URL
is granted internal access through the firewall on the VPN connection.
B—All requests for external web content route directly through the Web Security Service (with the exception of bypassed IP
addresses listed in the PAC file).
Data Flow—Full VPN
C—All requests for external web content route back into the corporate firewall and then up to the Web Security Service
through the gateway configuration.
D—The PAC file script identifies the internal IP address based on the RFC 1918 standard. Direct access to the internal URL
is granted internal access through the firewall on the VPN connection.
Challenge-based Authentication (Captive Portal)
To provide user authentication for this method and also make user names available in reports and for custom policy creations, enable the Captive Portal option during configuration. When enabled, Captive Portal displays a challenge dialog to
users each time that they begin a new browser session (or 24 hours after the previous successful entry).
Why Select This Method?
n
Easy to deploy for demonstration or testing purposes.
n
Faster access for internal users to internal URLs.
About the Explicit Proxy Access Method/Page 9
n
Reduces traffic to the Web Security Service by allowing web requests to internal IP addresses to go directly to the
website.
What Are the Limitations of This Method?
n
Using PAC files with an IPsec split-tunnel configuration might allow requests for non-corporate sites to bypass the
Web Security Service.
n
Clients using IPsec with a full tunnel configuration might be allowed to bypass the Web Security Service because
all traffic is routed through an external VPN.
n
Client IP addresses are not visible to the Web Security Service.
Blue Coat Web Security Service/Page 10
Plan The Explicit Proxy Access Method
Complete the forms in the following sheet (one per location).
Information
Network
Comments
Values
PAC file deployment 5 Manual Browser Configuration
method:
5 WPAD Standard 8080
IP address range or subnet alllowed to bypass
proxy server:
Proxy server location:
Firewall port to open: 8080
Web Security Service PAC file URL
Point all browsers to https://portal.threatpulse.com/pac
this URL:
Internal Web
Address
Are all web requests 5 Yes
routed through the proxy
5 No
server?
VPN Tunnel Type
IPsec tunnel con5 Full Tunnel
figuration installed on the
5 Split Tunnel
client system. Blue Coat
recommends full tunnel if
your VPN is not compatible with the Web
Security Service.
Captive Portal
Enable challenge-based 5 Yes
auth?
5 No
Select an Explicit Proxy Method/Page 11
Select an Explicit Proxy Method
The following methods are available to explicitly proxy clients to the Web Security Service.
Pre-Deployment: Select Authentication Method
Before configuring the explicit proxy method, Blue Coat recommends deploying a user authentication method if the purpose is for production rather than perform a quick proof of concept or demonstration. If your solution requires Captive
Portal, an authentication method is required.
If you are not familiar with Web Security Service authentication, consult the documentation topics in the WebGuide.
Automatic
Use the Web Proxy Auto-Discovery (WPAD) protocol.
Manual
Manually configure a web browser's proxy setting to point to the Blue Coat Proxy Automatic Configuration (PAC) file.
Blue Coat Web Security Service/Page 12
Publish PAC File With WPAD
Enforce the use of a Proxy Automatic Configuration (PAC) file without manual web browser configuration by using the Web
Proxy Auto-Discovery (WPAD) protocol. WPAD offers two options to publish the location of the PAC file: Dynamic Host
Configuration Protocol (DHCP) and Domain Name System (DNS).
Tips
n
Verify that firewall port 8080 is open.
n
See here for an example PAC file.
DHCP Method
1. Before retrieving the first page, the web browser sends the local DHCP server a DHCPINFORM query.
2. The web browser uses the URL returned from the server to locate the PAC file.
3. If the DHCP server does not return the location of the PAC file, the DNS method is used.
DNS Method
1. Change the name of the PAC file located on the web server from proxy.pac to wpad.dat.
2. The web browser searches the web server for the PAC file using URLs based using the format
http://wpad.x.x.com/wpad.dat, until the proxy configuration file is found in the domain of the client. WPAD.dat is
the name for the PAC file and x is a part of the domain name.
Next Step
Proceed to "Prevent IP/Subnet From Routing to the Web Security Service" on page 18.
Edit Browser to Explicitly Proxy/Page 13
Edit Browser to Explicitly Proxy
Manually configure web browsers on client systems or a demonstration client to point to the location of the Blue Coat
Proxy Automatic Configuration (PAC), which provides the route to the Web Security Service.
To configure specific, supported web browsers, navigate to the following topics:
n
"Edit Safari Proxy Setting" on page 14
n
"Edit Chrome Browser Proxy Setting" on page 15
n
"Edit IE Browser Proxy Setting" on page 16
n
"Edit Firefox Browser Proxy Setting" on page 17
Blue Coat Web Security Service/Page 14
Edit Safari Proxy Setting
Quickly connect to the Web Security Service by manually configuring the Safari browser to point to the Blue Coat Proxy
Automatic Configuration (PAC) file.
1. Select Apple menu > System Preferences.
2. Select the Internet and Network tab
3. Select an option:
n
If you are connected by cable to the network, select Ethernet.
n
If you are connected using WiFi, select the AirPort option.
4. Click Advanced. Enter the address of your PAC file in the Address field. For example,
https://portal.threatpulse.com/pac.
5. Click the Proxies tab.
a. Select Using a PAC file.
b. Enter the Web Security Service PAC file location in the Address
field: https://portal.threatpulse.com/pac.
6. Select Quit to exit System Preferences.
Verify Firewall Setting
The gateway firewall must allow port 8080. See "Reference: Required Locations, Ports, and Protocols" on page 26.
Next Step
n
Proceed to "Prevent IP/Subnet From Routing to the Web Security Service" on page 18.
Edit Chrome Browser Proxy Setting/Page 15
Edit Chrome Browser Proxy Setting
Quickly connect to the Web Security Service by manually configuring the Chrome browser to point to the Blue Coat Proxy
Automatic Configuration (PAC) file.
1. In the top-right corner of the browser, select the wrench .
2. From the drop-down list, select Options . The browser displays the Google Chrome Options dialog.
3. In the Network section, clickChange proxy settings. The browser displays the Internet Properties dialog.
4. Click the Connections tab.
5. In the Local Area Network (LAN) Settings section, click LAN settings. The Local Area Network (LAN) Settings
dialog displays.
a. In the Automatic configuration area, select Use automatic configuration script.
b. Enter the Web Security Service PAC file location in the Address
field: https://portal.threatpulse.com/pac.
6. Click OK and exit out of all open dialogs.
Verify Firewall Setting
The gateway firewall must allow port 8080. See "Reference: Required Locations, Ports, and Protocols" on page 26.
Next Step
n
Proceed to "Prevent IP/Subnet From Routing to the Web Security Service" on page 18.
Blue Coat Web Security Service/Page 16
Edit IE Browser Proxy Setting
Quickly connect to the Web Security Service by manually configuring the Internet Explorer browser to point to the Blue Coat
Proxy Automatic Configuration (PAC) file.
1. Select Tools > Internet Options.
2. Select the Connections tab.
3. If you are using a VPN connection, click Add to set up the connection wizard. If you are using a LAN connection,
click LAN settings
4. LAN settings dialog:
a. Select Automatically detect settings and Use automatic configuration script.
b. Enter the Web Security Service PAC file location in the Address
field: https://portal.threatpulse.com/pac.
5. Click OK and exit out of all open dialogs.
Verify Firewall Setting
The gateway firewall must allow port 8080. See "Reference: Required Locations, Ports, and Protocols" on page 26.
Next Step
n
Proceed to "Prevent IP/Subnet From Routing to the Web Security Service" on page 18.
Edit Firefox Browser Proxy Setting/Page 17
Edit Firefox Browser Proxy Setting
Quickly connect to the Web Security Service by manually configuring the Firefox browser to point to the Blue Coat Proxy
Automatic Configuration (PAC) file.
1. Select Tools > Options. The browser displays the Options dialog.
2. Select the Advanced > Network tab.
3. In the Connections area, click Settings.
4. Configure Connection Settings:
a. Select Automatic proxy configuration URL.
b. Enter the Web Security Service PAC file location in the Address
field: https://portal.threatpulse.com/pac.
5. Click OK and exit out of all open dialogs.
Verify Firewall Setting
The gateway firewall must allow port 8080. See "Reference: Required Locations, Ports, and Protocols" on page 26.
Next Step
n
Proceed to "Prevent IP/Subnet From Routing to the Web Security Service" on page 18.
Blue Coat Web Security Service/Page 18
Prevent IP/Subnet From Routing to the Web Security Service
Some source IP addresses or subnets do not require Blue Coat Web Security Service processing. For example, you want to
exclude test networks. Configure the service to ignore these connections.
Notes
n
The Web Security Service allows an unlimited number of bypassed IP addresses/subnets. The exception is Client
Connector, which only bypasses the first 256 entries.
n
The setting is global; that is, it applies to every location/client in your Web Security Service account.
n
Each time that a Unified Agent reconnects to the Web Security Service (for example, a user who takes a laptop off
campus and connects through a non-corporate network), the client checks against any updates to the list.
Manually Add IP Addresses
1. In Service Mode, select the Network > Bypassed Sites > Bypassed IP/Subnets tab.
2. Click Add Bypass IP(s). The service displays a dialog.
a. Enter an IP/Subnet.
b. (Optional) Enter a Comment.
c. (Optional) Click the + icon to add another row for another entry.
d. Click Add Bypass IP(s).
The new entries display in the tab view. You can edit or delete any entry from here.
Prevent IP/Subnet From Routing to the Web Security Service/Page 19
Import IP Address Entries From a Saved List
This procedure assumes that you have already created an accessible list (text file) of IP addresses to be bypassed. Each
entry in the file must be on its own line.
1. In Service Mode, select the Network > Bypassed Sites > Bypassed IP/Subnets tab.
2. Click Add Bypass IP(s). The service displays the Add Bypass IP Address/Subnet dialog.
3. Click Add Bypass IP(s). The portal displays a dialog.
a. Select Import From File.
b. Click Browse. The service displays the File Upload dialog. Navigate to the file location and Open it.
c. Click Add Bypass IP(s).
All of the new entries display in the tab view. You can edit or delete any entry from here.
Blue Coat Web Security Service/Page 20
Add an Explicit Proxy Location
When configuring Explicit Proxy as the access method, each gateway IP address defined in a PAC file requires an equivalent Blue Coat Web Security Service location configuration.
Furthermore, you have the option to require users to enter their network credentials for each browser-type session. This
allows for usernames and group information to be viewable in reports and available in custom policy choices
1. In Service Mode, select Network > Locations.
2. Click Add Location.
3. Complete the Location dialog.
a. Name the location. For example, use the fixed geographical location or organization name.
b. Select Explicit Proxy as the Access Method.
c. Enter the IP/Subnet that forwards web traffic to the Web Security Service.
d. This step is optional unless you are integrating SAML authentication. To require users to enter network
credentials at each browser-type session, select Captive Portal: Enable. This option requires deployment of
the Auth Connector application, which integrates with your Active Directory to provides username and group
information.
e. Select the Estimated User range that will be sending web requests through this gateway interface. Blue Coat
uses this information to ensure proper resources.
Add an Explicit Proxy Location/Page 21
f. Select a Time Zone, fill out location information, and (optional) enter comments.
g. Click Save.
Blue Coat Web Security Service/Page 22
Verify Service Connectivity to Locations
After configuring access to the Blue CoatWeb Security Service, verify that the service is receiving and processing content
requests.
All Locations
1. Click the Service link (upper-right corner).
2. Select Network > Locations.
3. Verify the status of each location.
Various icons represent the connection status.
Icon
Connection Status Description
The Web Security Service recognizes the location and accepts web traffic.
A location has been configured, but the Web Security Service cannot connect. Verify that the
web gateway device is properly configured to route traffic.
A previously successful web gateway to Web Security Service configuration is currently not
connected.
n
n
Firewall/VPN
n
Verify your firewall’s public gateway address.
n
Verify the Preshared Key (PSK) in the portal matches that of your firewall
configuration.
n
Verify that the server authentication mode is set to PSK.
Explicit Proxy
n
Verify the PAC file installation and deployment.
n
Verify that your network allows outbound requests on port 8080.
n
Do not attempt to use Explicit Proxy in conjunction with the Unified Agent– the
client will detect that a proxy is in effect, assume a man-in-the-middle attack, and
fail (open or closed depending on the settings).
n
Proxy Forwarding—Verify the gateway address in the forwarding host is correct.
n
Remote Users—Verify the Unified Agent/Client Connector installation. See the section
below for more information.
Additional Step For Remote Users
To further verify that Unified Agent running on remote clients is communicating with the Web Security Service, click (or
double-click) the application icon in the menu bar and click Status.
Verify Service Connectivity to Locations/Page 23
Windows
If the system detects a corporate network that provides web access and security, the Unified Agent enters into passive
mode.
Blue Coat Web Security Service/Page 24
Mac
If the system detects a corporate network that provides web access and security, the Unified Agent enters into passive
mode.
Verify Client Protection
From a client system that has web access (or the specific test client if so configured), browse to the following site:
test.threatpulse.com
The test is successful if you see the following webpage.
Verify Service Connectivity to Locations/Page 25
Blue Coat Web Security Service/Page 26
Reference: Required Locations, Ports, and Protocols
Depending on your configured Blue Coat Web Security Service Access Methods, some ports, protocols, and locations
must be opened on your firewalls to allow connectivity to the various cloud service components and data centers.
Blue Coat Resource
bto.bluecoat.com
HTTPS/TCP 443
Support site links to support tools and documentation.
Access Methods
Access Method
Port(s)
Protocol
199.19.250.192
Web Security Service IP
addresses
Firewall/VPN (IPsec)
Resolves To
199.116.168.192
80/443
IPsec/ESP
UDP 500 (ISAKMP)
Proxy Forwarding
8080/8443
HTTP/HTTPS
8084*
Port 8080 to proxy.threatpulse.net
Port 8443 to proxy.threatpulse.net
*Port 8084 to proxy.threatpulse.net
*If this forwarding host is configured for
local SSL interception.
Explicit Proxy
To proxy.threatpulse.net
8080
https://portal.threatpulse.com/pac
Trans-Proxy
8080 (VPN Tunnel)
ep.threatpulse.net resolves to the following pseudo address.
199.19.250.205
Unified Agent
443
SSL
Port 443 to client.threatpulse.net
Port 443 to proxy.threatpulse.net
Port 443 to portal.threatpulse.net
(199.19.250.192)
MDM (registered iOS and
Android devices)
UDP 500 (ISAKMP)
Roaming Captive Portal
8080
UDP 4500 (NAT-T)
IPSec/ESP
Reference: Required Locations, Ports, and Protocols/Page 27
Authentication
Auth Method
Port(s)
Protocol
Resolves To
Auth Connector
443
SSL
to auth.threatpulse.net:
199.19.250.193
199.116.168.193
portal.threatpulse.net:
199.19.250.19
Additional Required
Information: Reference:
Authentication IP
Addresses.
Auth Connector to Active
Directory
SAML
139,445
TCP
389
LDAP
3268
ADSI LDAP
135
Location Services
88
Kerberos
8443
Explicit and IPSec
Cloud-to-Premises DLP
n
comm.threatpulse.com
Blue Coat Web Security Service/Page 28
Reference: Sample PAC File for Explicit Proxy
The following is sample text that makes up a Proxy Automatic Configuration (PAC) file from which Web browsers receive
routing instructions. The PAC file redirects all non-internal traffic to the Blue Coat Web Security Service.
function FindProxyForURL(url, host) {
// If URL has no dots in host name, send traffic direct.
if (isPlainHostName(host)) return "DIRECT";
// If specific URL needs to bypass proxy, send traffic direct.
if (shExpMatch(url,"*bluecoat.com*") ||
shExpMatch(url,"*cacheflow.com*"))
return "DIRECT";
// If IP address is internal send direct.
if (isInNet(host, "10.0.0.0", "255.0.0.0") ||
isInNet(host, "172.16.0.0", "255.240.0.0") ||
isInNet(host, "192.168.0.0", "255.255.0.0") ||
isInNet(host, "216.52.23.0", "255.255.255.0") ||
isInNet(host, "127.0.0.0", "255.255.255.0") ||
isInNet(host, "192.41.79.240", "255.255.255.255"))
return "DIRECT";
// All other traffic uses below proxies, in fail-over order.
return "PROXY proxy.threatpulse.net:8080; DIRECT";
return "PROXY 199.19.250.164:8080; DIRECT"; }