Before you start to create a configuration in which Access Policy Manager^® (APM^®) acts as an explicit forward proxy to support Network Access clients, you must have completed these tasks.

• You need to have configured a working a Network Access configuration.
• You need a per-request policy configured for forward proxy.
• On a BIG-IP^® system with an SWG subscription, you must ensure that the URL database is downloaded. You can also configure any URL filters that you want to use in addition to, or instead of, the default URL filters.
• On a BIG-IP^® system without an SWG subscription, if you want to designate only a few URLs for specific handling, you probably do not need to configure user-defined URL categories and filters. However, if you need to control access to many URLs, for better performance and ease-of-use you should configure user-defined URL categories and filters.

Tasks for integrating a Network Access configuration with a configuration in which Access Policy Manager^® (APM)^®acts as an explicit forward proxy follow this order.

• First, if your Network Access configuration does not include a connectivity profile, create one and add it to the virtual server.
• Next, create a configuration in which APM acts as an explicit forward proxy. This configuration includes the per-request policy.
• Finally, in the Network Access configuration, update the access policy (so that it populates any session variables required for successful execution of the per-request policy) and update the Network Access resource for client proxy.

1. On the Main tab, click Access > Connectivity / VPN > Connectivity > Profiles .
   A list of connectivity profiles displays.
2. Click Add.
   The Create New Connectivity Profile popup screen opens and displays General Settings.
3. Type a Profile Name for the connectivity profile.
4. Select a Parent Profile from the list.
   APM^® provides a default profile, connectivity.
5. Click OK.
   The popup screen closes, and the Connectivity Profile List displays.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the name of the virtual server you want to modify.
3. Scroll down to the Access Policy area.
4. From the Connectivity Profile list, select the connectivity profile.
5. Click Update to save the changes.

1. On the Main tab, click Network > DNS Resolvers > DNS Resolver List .
   The DNS Resolver List screen opens.
2. Click Create.
   The New DNS Resolver screen opens.
3. In the Name field, type a name for the resolver.
4. Click Finished.

1. On the Main tab, click Network > DNS Resolvers > DNS Resolver List .
   The DNS Resolver List screen opens.
2. Click the name of the resolver you want to modify.
   The properties screen opens.
3. On the menu bar, click Forward Zones.
   The Forward Zones screen displays.
4. Click the Add button.
   Note: You add more than one zone to forward based on the needs of your organization.
5. In the Name field, type the name of a subdomain or type the fully qualified domain name (FQDN) of a forward zone.
   Note: To forward all requests (such as when creating an OAuth server), specify . (period) as the name.
   For example, either example or site.example.com would be valid zone names.
6. Add one or more nameservers:
   1. In the Address field, type the IP address of a DNS nameserver that is considered authoritative for this zone.
      Based on your network configuration, add IPv4 or IPv6 addresses, or both.
   2. Click Add.
      The address is added to the list.
   Note: The order of nameservers in the configuration does not impact which nameserver the system selects to forward a query to.
7. Click Finished.

1. On the Main tab, click Local Traffic > Profiles > Services > HTTP .
   The HTTP profile list screen opens.
2. Click Create.
   The New HTTP Profile screen opens.
3. In the Name field, type a unique name for the profile.
4. From the Proxy Mode list, select Explicit.
5. For Parent Profile, retain the http-explicit setting.
6. Select the Custom check box.
7. Scroll down to the Explicit Proxy area.
8. From the DNS Resolver list, select the DNS resolver you configured previously.
9. In the Tunnel Name field, you can retain the default value, http-tunnel, or type the name of a tunnel if you created one.
   APM requires a tunnel with tcp-forward encapsulation to support SSL traffic for explicit forward proxy.
10. From the Default Connect Handling list, retain the default setting Deny.
    Any CONNECT traffic goes through the tunnel to the virtual server that most closely matches the traffic; if there is no match, the traffic is blocked.
11. Click Finished.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the Create button.
   The New Virtual Server screen opens.
3. In the Name field, type a unique name for the virtual server.
4. In the Destination Address field, type the IP address for a host virtual server.
   This field accepts an address in CIDR format (IP address/prefix). However, when you type the complete IP address for a host, you do not need to type a prefix after the address.
   Type a destination address in this format: 162.160.15.20.
5. In the Service Port field, type the port number to use for forward proxy traffic.
   Typically, the port number is 3128 or 8080.
6. From the Configuration list, select Advanced.
7. From the HTTP Profile list, select the HTTP profile you configured earlier.
8. Scroll down to the VLAN and Tunnel Traffic setting and select Enabled on.
9. For the VLANs and Tunnels setting, move the secure connectivity interface to the Selected list.
10. From the Source Address Translation list, select Auto Map.
11. In the Access Policy area, from the Access Profile list, select the access profile that you configured earlier.
12. In the Access Policy area, from the Per-Request Policy list, select the policy that you configured earlier.
13. Click Finished.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the Create button.
   The New Virtual Server screen opens.
3. In the Name field, type a unique name for the virtual server.
4. In the Destination Address field, type 0.0.0.0 to accept any IPv4 traffic.
5. In the Service Port field, type 80, or select HTTP from the list.
6. From the Configuration list, select Advanced.
7. From the HTTP Profile list, select http.
8. Scroll down to the VLAN and Tunnel Traffic setting and select Enabled on.
9. For the VLANs and Tunnels setting, move the tunnel to the Selected list.
   The tunnel name must match the tunnel specified in the HTTP profile for the forward proxy virtual server. The default tunnel is http-tunnel.
10. From the Source Address Translation list, select Auto Map.
11. Scroll down to the Port Translation setting and clear the Enabled check box.
12. In the Access Policy area, from the Access Profile list, select the access profile that you configured earlier.
13. In the Access Policy area, from the Per-Request Policy list, select the policy that you configured earlier.
14. Click Finished.

1. On the Main tab, click Local Traffic > Profiles > SSL > Client .
   The Client SSL profile list screen opens.
2. Click Create.
   The New Client SSL Profile screen opens.
3. In the Name field, type a unique name for the profile.
4. From the Parent Profile list, select clientssl.
5. To avoid issues with privacy concerns, you might need to enable SSL forward proxy bypass for URLs that expose personal user information, such as those for financial or government sites.
   1. Scroll down to the SSL Forward Proxy list, and select Advanced.
   2. Select the Custom check box for the SSL Forward Proxy area.
   3. From the SSL Forward Proxy list, select Enabled.
      You can update this setting later but only while the profile is not assigned to a virtual server.
   4. From the CA Certificate list, select a certificate.
   5. From the CA Key list, select a key.
   6. In the CA Passphrase field, type a passphrase.
   7. In the Confirm CA Passphrase field, type the passphrase again.
   8. In the Certificate Lifespan field, type a lifespan for the SSL forward proxy certificate in days.
   9. Optional: From the Certificate Extensions list, select Extensions List.
   10. Optional: For the Certificate Extensions List setting, select the extensions that you want in the Available extensions field, and move them to the Enabled Extensions field using the Enable button.
   11. From the SSL Forward Proxy Bypass list, select Enabled.
       You can update this setting later but only while the profile is not assigned to a virtual server.
       Additional settings display.
   12. For Default Bypass Action, retain the default value Intercept.
       You can override the value of this action on a case-by-case basis in the per-request policy for the virtual server.
       Note: Bypass and intercept lists do not work with per-request policies. Retain the setting None for the remainder of the fields.
6. Click Finished.

1. On the Main tab, click Local Traffic > Profiles > SSL > Server .
   The Server SSL profile list screen opens.
2. Click Create.
   The New Server SSL Profile screen opens.
3. In the Name field, type a unique name for the profile.
4. For Parent Profile, retain the default selection, serverssl.
5. From the Configuration list, select Advanced.
6. Select the Custom check box.
   The settings become available for change.
7. From the SSL Forward Proxy list, select Enabled.
   You can update this setting later, but only while the profile is not assigned to a virtual server.
8. From the SSL Forward Proxy Bypass list, select Enabled (or retain the default value Disabled).
   The values of the SSL Forward Proxy Bypass settings in the server SSL and the client SSL profiles specified in a virtual server must match. You can update this setting later but only while the profile is not assigned to a virtual server.
9. Scroll down to the Secure Renegotiation list and select Request.
10. Click Finished.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the Create button.
   The New Virtual Server screen opens.
3. In the Name field, type a unique name for the virtual server.
4. In the Destination Address field, type 0.0.0.0 to accept any IPv4 traffic.
5. In the Service Port field, type 443 or select HTTPS from the list.
6. From the Configuration list, select Advanced.
7. From the HTTP Profile list, select http.
8. For the SSL Profile (Client) setting, from the Available list, select the name of the Client SSL forward proxy profile you previously created, and using the Move button, move the name to the Selected list.
   Important: To enable SSL forward proxy functionality, you can either:

   • Disassociate existing Client SSL and Server SSL profiles from a virtual server and configure the SSL Forward Proxy settings.
   • Create new Client SSL and Server SSL profiles and configure the SSL Forward Proxy settings.

   Then with either option, select the Client SSL and Server SSL profiles on a virtual server. You cannot modify existing Client SSL and Server SSL profiles while they are selected on a virtual server to enable SSL forward proxy functionality.
9. For the SSL Profile (Server) setting, from the Available list, select the name of the Server SSL forward proxy profile you previously created, and using the Move button, move the name to the Selected list.
   Important: To enable SSL forward proxy functionality, you can either:

   • Disassociate existing Client SSL and Server SSL profiles from a virtual server and configure the SSL Forward Proxy settings.
   • Create new Client SSL and Server SSL profiles and configure the SSL Forward Proxy settings.

   Then with either option, select the Client SSL and Server SSL profiles on a virtual server. You cannot modify existing Client SSL and Server SSL profiles while they are selected on a virtual server to enable SSL forward proxy functionality.
10. Scroll down to the VLAN and Tunnel Traffic setting and select Enabled on.
11. For the VLANs and Tunnels setting, move the tunnel to the Selected list.
    The tunnel name must match the tunnel specified in the HTTP profile for the forward proxy virtual server. The default tunnel is http-tunnel.
12. From the Source Address Translation list, select Auto Map.
13. Scroll down to the Port Translation setting and clear the Enabled check box.
14. For the Address Translation setting, clear the Enabled check box.
15. In the Access Policy area, from the Access Profile list, select the access profile that you configured earlier.
16. In the Access Policy area, from the Per-Request Policy list, select the policy that you configured earlier.
17. Click Finished.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. Click the name of the access profile that you want to edit.
   The properties screen opens.
3. In the General Properties area, click the Edit Access Policy for Profile profile_name link.
   The visual policy editor opens the access policy in a separate screen.
4. Click the (+) icon anywhere in the access policy to add a new item.
   Note: Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
   A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
5. To supply LDAP group information for use in the per-request policy, add an LDAP Query item anywhere in the policy and configure its properties:
   1. From the Server list, select an AAA LDAP server.
      An LDAP Query uses SSL connections when you select an LDAP AAA server that is configured for LDAPS.
   2. Specify the SearchDN, and SearchFilter settings.
      SearchDN is the base DN from which the search is done.
   3. Click Save.
   This item populates the session.ldap.last.attr.memberOf session variable.
6. To supply Active Directory groups for use in the per-request policy, add an AD Query item anywhere in the policy and configure its properties:
   1. From the Server list, select an AAA AD server.
   2. Select the Fetch Primary Group check box.
      The value of the primary user group populates the session.ad.last.attr.primaryGroupID session variable.
   3. Click Save.
7. To supply RADIUS class attributes for use in the per-request policy, add a RADIUS Auth item anywhere in the policy and configure its properties:
   1. From the Server list, select an AAA RADIUS server.
   2. Click Save.
   This item populates the session.radius.last.attr.class session variable.
8. To supply local database groups for use in the per-request policy, add a Local Database item anywhere in the policy and configure its properties:
   1. From the LocalDB Instance list, select a local user database.
   2. In the User Name field, retain the default session variable.
   3. Click Add new entry
      A new line is added to the list of entries with the Action set to Read and other default settings.
   4. In the Destination column Session Variable field, type session.localdb.groups.
      If you type a name other than session.localdb.groups, note it. You will need it when you configure the per-request access policy.
   5. In the Source column from the DB Property list, select groups.
   6. Click Save.
   This item populates the session.localdb.groups session variable.

1. On the Main tab, click Access > Connectivity / VPN > Network Access (VPN) > Network Access Lists .
   The Network Access Lists screen opens.
2. In the Name column, click the name of the network access resource you want to edit.
3. On the menu bar, click Network Settings.
4. For Client Settings, select Advanced.
5. Scroll down and select Client Proxy Settings.
   Additional settings display.
6. If the Traffic Options setting specifies Force all traffic through tunnel, configure these additional settings:
   1. In the Client Proxy Address field, type the IP address of the explicit forward proxy virtual server.
   2. In the Client Proxy Port field, type the port number of the explicit forward proxy virtual server.
      Typically, the port number is 3128 or 8080; it might be different in your configuration.
7. If the Traffic Options setting specifies Use split tunneling for traffic, in the Client Proxy Autoconfig Script field, type the URL for a proxy auto-configuration script.
8. Click the Update button.
   Your changes are saved and the page refreshes.

The configuration in which Access Policy Manager^® (APM^®) acts as an explicit forward proxy is ready to process web traffic from network access clients.

When you configure Access Policy Manager^® (APM^®) to act as an explicit forward proxy for use by Network Access clients, you might want to understand how these objects fit into the overall configuration.

Secure connectivity interface

In a Network Access configuration, a connectivity profile on the virtual server specifies a secure connectivity interface for traffic from the client. The virtual server configured as the explicit forward proxy server must listen on the secure connectivity interface for traffic from Network Access clients.

Tunnel

The virtual server configured as the explicit forward proxy server must specify an HTTP profile that specifies the name of a tunnel of tcp-forward encapsulation type. You can use the default tunnel, http-tunnel, or create another tunnel and use it.

Per-request policy

In any APM forward proxy configuration, the determination of whether a user can access a URL must be made in a per-request policy. A per-request policy determines whether to block or allow access to a request based on time or date or group membership or other criteria that you configure.

Access policies

The access policy in the Network Access configuration continues to authenticate users, assign resources, and evaluate ACLs, if any. In addition, this access policy must populate any session variables used in the per-request policy. An access profile of the SWG-Explicit type is required in the forward proxy configuration; however, it is not necessary to include any items in the access policy.

This table lists per-request policy items that read session variables and lists the access policy items that populate the variables.

Before you start to create an Access Policy Manager^® (APM^®) transparent forward proxy configuration to support remote access clients, you must have completed these tasks.

• You must have a working Network Access, Portal Access, or Application Access configuration.
• You need a per-request policy configured for forward proxy.
• On a BIG-IP^® system with an SWG subscription, you must ensure that the URL database is downloaded. You can also configure any URL filters that you want to use in addition to, or instead of, the default URL filters.
• On a BIG-IP^® system without an SWG subscription, if you want to designate only a few URLs for specific handling, you probably do not need to configure user-defined URL categories and filters. However, if you need to control access to many URLs, for better performance and ease-of-use you should configure user-defined URL categories and filters.

Tasks for integrating an Access Policy Manager^® (APM^®) remote access configuration with a transparent forward proxy configuration for APM follow this order.

• First, update the existing application access, network access, or portal access configuration to add a secure connectivity profile to the virtual server if one is not already specified.
• Next, create a transparent forward proxy configuration for APM. The per-request policy is part of this configuration.
• Finally, update the access policy in the existing application access, network access, or portal access configuration if needed. If the per-request policy uses group or class lookup items, add queries to the access policy to populate the session variables on which the lookup items rely.

1. On the Main tab, click Access > Connectivity / VPN > Connectivity > Profiles .
   A list of connectivity profiles displays.
2. Click Add.
   The Create New Connectivity Profile popup screen opens and displays General Settings.
3. Type a Profile Name for the connectivity profile.
4. Select a Parent Profile from the list.
   APM^® provides a default profile, connectivity.
5. Click OK.
   The popup screen closes, and the Connectivity Profile List displays.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the name of the virtual server you want to modify.
3. Scroll down to the Access Policy area.
4. From the Connectivity Profile list, select the connectivity profile.
5. Click Update to save the changes.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. Click Create.
   The New Profile screen opens.
3. In the Name field, type a name for the access profile.
   Note: An access profile name must be unique among all per-session profile and per-request policy names.
4. From the Profile Type list, select SWG-Transparent.
   Additional fields display set to default values.
5. In the Language Settings area, add and remove accepted languages, and set the default language.
   A browser uses the highest priority accepted language. If no browser language matches the accepted languages list, the browser uses the default language.
6. Click Finished.
   The Access Profiles list screen displays.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the Create button.
   The New Virtual Server screen opens.
3. In the Name field, type a unique name for the virtual server.
4. In the Destination Address field, type 0.0.0.0 to accept any IPv4 traffic.
5. In the Service Port field, type 80, or select HTTP from the list.
6. From the Configuration list, select Advanced.
7. From the HTTP Profile list, select http.
8. Scroll down to the VLAN and Tunnel Traffic setting and select Enabled on.
9. For the VLANs and Tunnels setting, move the secure connectivity interface to the Selected list.
10. From the Source Address Translation list, select Auto Map.
11. Scroll down to the Port Translation setting and clear the Enabled check box.
12. In the Access Policy area, from the Access Profile list, select the access profile that you configured earlier.
13. In the Access Policy area, from the Per-Request Policy list, select the policy that you configured earlier.
14. Click Finished.

1. On the Main tab, click Local Traffic > Profiles > SSL > Client .
   The Client SSL profile list screen opens.
2. Click Create.
   The New Client SSL Profile screen opens.
3. In the Name field, type a unique name for the profile.
4. From the Parent Profile list, select clientssl.
5. To avoid issues with privacy concerns, you might need to enable SSL forward proxy bypass for URLs that expose personal user information, such as those for financial or government sites.
   1. Scroll down to the SSL Forward Proxy list, and select Advanced.
   2. Select the Custom check box for the SSL Forward Proxy area.
   3. From the SSL Forward Proxy list, select Enabled.
      You can update this setting later but only while the profile is not assigned to a virtual server.
   4. From the CA Certificate list, select a certificate.
   5. From the CA Key list, select a key.
   6. In the CA Passphrase field, type a passphrase.
   7. In the Confirm CA Passphrase field, type the passphrase again.
   8. In the Certificate Lifespan field, type a lifespan for the SSL forward proxy certificate in days.
   9. Optional: From the Certificate Extensions list, select Extensions List.
   10. Optional: For the Certificate Extensions List setting, select the extensions that you want in the Available extensions field, and move them to the Enabled Extensions field using the Enable button.
   11. From the SSL Forward Proxy Bypass list, select Enabled.
       You can update this setting later but only while the profile is not assigned to a virtual server.
       Additional settings display.
   12. For Default Bypass Action, retain the default value Intercept.
       You can override the value of this action on a case-by-case basis in the per-request policy for the virtual server.
       Note: Bypass and intercept lists do not work with per-request policies. Retain the setting None for the remainder of the fields.
6. Click Finished.

1. On the Main tab, click Local Traffic > Profiles > SSL > Server .
   The Server SSL profile list screen opens.
2. Click Create.
   The New Server SSL Profile screen opens.
3. In the Name field, type a unique name for the profile.
4. For Parent Profile, retain the default selection, serverssl.
5. From the Configuration list, select Advanced.
6. Select the Custom check box.
   The settings become available for change.
7. From the SSL Forward Proxy list, select Enabled.
   You can update this setting later, but only while the profile is not assigned to a virtual server.
8. From the SSL Forward Proxy Bypass list, select Enabled (or retain the default value Disabled).
   The values of the SSL Forward Proxy Bypass settings in the server SSL and the client SSL profiles specified in a virtual server must match. You can update this setting later but only while the profile is not assigned to a virtual server.
9. Scroll down to the Secure Renegotiation list and select Request.
10. Click Finished.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the Create button.
   The New Virtual Server screen opens.
3. In the Name field, type a unique name for the virtual server.
4. In the Destination Address field, type 0.0.0.0 to accept any IPv4 traffic.
5. In the Service Port field, type 443 or select HTTPS from the list.
6. From the Configuration list, select Advanced.
7. From the HTTP Profile list, select http.
8. For the SSL Profile (Client) setting, from the Available list, select the name of the Client SSL forward proxy profile you previously created, and using the Move button, move the name to the Selected list.
   Important: To enable SSL forward proxy functionality, you can either:

   • Disassociate existing Client SSL and Server SSL profiles from a virtual server and configure the SSL Forward Proxy settings.
   • Create new Client SSL and Server SSL profiles and configure the SSL Forward Proxy settings.

   Then with either option, select the Client SSL and Server SSL profiles on a virtual server. You cannot modify existing Client SSL and Server SSL profiles while they are selected on a virtual server to enable SSL forward proxy functionality.
9. For the SSL Profile (Server) setting, from the Available list, select the name of the Server SSL forward proxy profile you previously created, and using the Move button, move the name to the Selected list.
   Important: To enable SSL forward proxy functionality, you can either:

   • Disassociate existing Client SSL and Server SSL profiles from a virtual server and configure the SSL Forward Proxy settings.
   • Create new Client SSL and Server SSL profiles and configure the SSL Forward Proxy settings.

   Then with either option, select the Client SSL and Server SSL profiles on a virtual server. You cannot modify existing Client SSL and Server SSL profiles while they are selected on a virtual server to enable SSL forward proxy functionality.
10. Scroll down to the VLAN and Tunnel Traffic setting and select Enabled on.
11. For the VLANs and Tunnels setting, move the secure connectivity interface to the Selected list.
12. From the Source Address Translation list, select Auto Map.
13. Scroll down to the Port Translation setting and clear the Enabled check box.
14. For the Address Translation setting, clear the Enabled check box.
15. In the Access Policy area, from the Access Profile list, select the access profile that you configured earlier.
16. In the Access Policy area, from the Per-Request Policy list, select the policy that you configured earlier.
17. Click Finished.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. Click the name of the access profile that you want to edit.
   The properties screen opens.
3. In the General Properties area, click the Edit Access Policy for Profile profile_name link.
   The visual policy editor opens the access policy in a separate screen.
4. Click the (+) icon anywhere in the access policy to add a new item.
   Note: Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
   A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
5. To supply LDAP group information for use in the per-request policy, add an LDAP Query item anywhere in the policy and configure its properties:
   1. From the Server list, select an AAA LDAP server.
      An LDAP Query uses SSL connections when you select an LDAP AAA server that is configured for LDAPS.
   2. Specify the SearchDN, and SearchFilter settings.
      SearchDN is the base DN from which the search is done.
   3. Click Save.
   This item populates the session.ldap.last.attr.memberOf session variable.
6. To supply Active Directory groups for use in the per-request policy, add an AD Query item anywhere in the policy and configure its properties:
   1. From the Server list, select an AAA AD server.
   2. Select the Fetch Primary Group check box.
      The value of the primary user group populates the session.ad.last.attr.primaryGroupID session variable.
   3. Click Save.
7. To supply RADIUS class attributes for use in the per-request policy, add a RADIUS Auth item anywhere in the policy and configure its properties:
   1. From the Server list, select an AAA RADIUS server.
   2. Click Save.
   This item populates the session.radius.last.attr.class session variable.
8. To supply local database groups for use in the per-request policy, add a Local Database item anywhere in the policy and configure its properties:
   1. From the LocalDB Instance list, select a local user database.
   2. In the User Name field, retain the default session variable.
   3. Click Add new entry
      A new line is added to the list of entries with the Action set to Read and other default settings.
   4. In the Destination column Session Variable field, type session.localdb.groups.
      If you type a name other than session.localdb.groups, note it. You will need it when you configure the per-request access policy.
   5. In the Source column from the DB Property list, select groups.
   6. Click Save.
   This item populates the session.localdb.groups session variable.

A transparent forward proxy configuration is ready to process web traffic from remote access clients.

When you configure the BIG-IP^®system so that Access Policy Manager^® (APM^®) can act as a transparent forward proxy for use by remote access clients, you might want to understand how these objects fit into the overall configuration.

Secure connectivity interface

In a remote access configuration, a connectivity profile is required on the virtual server to specify a secure connectivity interface for traffic from the client. In the APM configuration, wildcard virtual servers must listen on the secure connectivity interface for traffic from remote access clients.

Per-request policy

In any APM forward proxy configuration, the determination of whether a user can access a URL must be made in a per-request access policy. A per-request access policy determines whether to block or allow access to a request based on time or date or group membership or other criteria that you configure.

Access policies

The access policy in the remote access configuration continues to authenticate users, assign resources, and evaluate ACLs, if any. In addition, this access policy must populate any session variables used in the per-request policy. An access profile of the SWG-Transparent type is required; however, it is not necessary to include any items in the access policy.

This table lists per-request policy items that read session variables and lists the access policy items that populate the variables.