F5 Logo MyF5
Search
  1. MyF5 Home
  2. Knowledge Centers
  3. BIG-IP APM
  4. BIG-IP Access Policy Manager: Secure Web Gateway Implementations
  5. Transparent Forward Proxy
Manual Chapter : Transparent Forward Proxy

Applies To:

Show Versions Show Versions

BIG-IP APM

  • 11.5.10, 11.5.9, 11.5.8, 11.5.7, 11.5.6, 11.5.5, 11.5.4, 11.5.3, 11.5.2, 11.5.1
Manual Chapter
Table of Contents | << Previous Chapter | Next Chapter >>

Overview: Configuring transparent forward proxy in inline mode

In transparent forward proxy, you configure your internal network to forward web traffic to the BIG-IP® system with Secure Web Gateway (SWG). This implementation describes an inline deployment. You place the BIG-IP system directly in the path of traffic, or inline, as the next hop after the gateway.

swg Secure Web Gateway transparent forward proxy inline deployment

The gateway sends traffic to the self-ip address of a VLAN configured on the BIG-IP system. Wildcard virtual servers listen on the VLAN and process the traffic that most closely matches the virtual server address. A wildcard virtual server is a special type of network virtual server designed to manage network traffic that is targeted to transparent network devices. SWG identifies users without using session management cookies, and applies a scheme that categorizes and filters URLs, controlling access.

Note: Transparent forward proxy provides the option to use a captive portal. To use this option, you need an additional virtual server, not shown in the figure, for the captive portal primary authentication server.

Before you begin

To use SWG, you must configure URL categorization. You might need to configure additional items depending on the other features that you decide to use.

URL categorization
To get a working SWG configuration, you must first download URL categories, configure URL filters, and configure schemes.
Transparent user identification
If you plan to identify users transparently, you must first download, install, and configure the F5® DC Agent.
Authentication
F5 recommends that you use NTLM or Kerberos authentication. If you plan to use authentication, ensure that you have what you need configured.
  • For NTLM, you need an NTLM Auth Configuration in Access Policy Manager® (APM®).
  • For Kerberos, you need a domain-joined Kerberos user account and a Kerberos AAA server configured in APM.
SSL intercept
To intercept SSL connections that are passing through the proxy, ensure that you have imported a valid subordinate CA certificate and key that is trusted by the endpoints behind the proxy.
Captive portal
If you plan to use the captive portal feature, make sure that a certificate and key with the proper common name is imported for use.

Task Summary

About the iApp for Secure Web Gateway configuration

When deployed as an application service, the Secure Web Gateway iApps® template can set up either an explicit or a transparent forward proxy configuration. You can download the template from the F5® DevCentral™ iApp Codeshare wiki at (http://devcentral.f5.com/wiki/iapp.Codeshare.ashx).

About ways to configure user identification for SWG

User identification configuration requires a method setting in the access profile and an access policy configured to support the setting. Based on user identification, you can determine which scheme to assign in the access policy so that Secure Web Gateway (SWG) filters URLs appropriately.

Depending on the access profile type, you can select one of these user identification methods: by IP address (for SWG-Explicit or SWG-Transparent access profile types) or by credentials (for SWG-Explicit type).

Identification by IP address

When you identify users by IP address, you can employ any of these methods.

Note: Identify users by IP address only when IP addresses are unique and can be trusted.
transparent user identification
Transparent user identification makes a best effort to identify users without requesting credentials. It queries domain controllers and stores a mapping of IP addresses to user names in an IF-MAP server.
Note: To identify users transparently, you must first install and configure the F5® DC Agent.
explicit user identification
You can present a logon page in an access policy to request user credentials and validate them. SWG maintains an internal mapping of IP addresses to user names. (You can present the appropriate logon page for the access policy type. For explicit forward proxy, you can present a 407 page. For transparent forward proxy, you can present a 401 page.)
source IP ranges or subnets
You can forego actually identifying the user and base the choice of which scheme to apply on whether the IP address is in a source IP range or on a subnet. SWG maintains an internal mapping of IP addresses to sessions.
single scheme
You can apply the same scheme to all users. SWG maintains an internal mapping of IP addresses to sessions.

Identification by credentials

When you choose to identify users by credentials, SWG maintains an internal mapping of credentials to sessions. To support this choice, you need an NTLM Auth Configuration object and you should check the result of NTLM authentication in the access policy.

Creating a VLAN for transparent forward proxy

You need a VLAN on which the forward proxy can listen. For increased security, the VLAN should directly face your clients.
  1. On the Main tab, click Network > VLANs. The VLAN List screen opens.
  2. Click Create. The New VLAN screen opens.
  3. In the Name field, type a unique name for the VLAN.
  4. For the Interfaces setting, click an interface number from the Available list, and use the Move button to add the selected interface to the Untagged list. Repeat this step as necessary.
  5. Click Finished. The screen refreshes, and displays the new VLAN from the list.
The new VLAN appears in the VLAN list.

Assigning a self IP address to a VLAN

Assign a self IP address to a VLAN on which the forward proxy listens.
  1. On the Main tab, click Network > Self IPs. The Self IPs screen opens.
  2. Click Create. The New Self IP screen opens.
  3. In the Name field, type a unique name for the self IP.
  4. In the IP Address field, type the IP address of the VLAN. The system accepts IPv4 and IPv6 addresses.
  5. In the Netmask field, type the network mask for the specified IP address.
  6. From the VLAN/Tunnel list, select the VLAN.
  7. Click Finished. The screen refreshes, and displays the new self IP address.

Creating an access profile for SWG transparent forward proxy

You create an access profile to provide the access policy configuration for a virtual server that establishes a secured session.
  1. On the Main tab, click Access Policy > Access Profiles. The Access Profiles List screen opens.
  2. Click Create. The New Profile screen opens.
  3. Type a name for the access profile.
  4. From the Profile Type list, select SWG-Transparent. With this type, only the access policy items that are valid for Secure Web Gateway (SWG) transparent forward proxy are available in the visual policy editor.
  5. Select the Custom check box for Settings. The settings become available.
  6. Optional: To use NTLM authentication before a session starts, from the NTLM Auth Configuration list select a configuration. In the case of a shared machine, an IP address might already be associated with a user or a session. Using NTLM authentication ensures that the system can associate the IP address with the correct session (new or existing) or with a new user each time a user logs on to the shared machine.
  7. Optional: To direct users to a captive portal, for Captive Portal select Enabled and, in the Primary Authentication URI field, type the URI. You might specify the URI of your primary authentication server if you use single sign-on across multiple domains. Users can then access multiple back-end applications from multiple domains and hosts without needing to re-enter their credentials, because the user session is stored on the primary domain. For example, you might type https://logon.siterequest.com in the field.
  8. In the Language Settings area, add and remove accepted languages, and set the default language. A browser uses the highest priority accepted language. If no browser language matches the accepted languages list, the browser uses the default language.
  9. Click Finished. The Access Profiles list screen displays.
  10. To enable Secure Web Gateway event logging for this access profile, add log settings.
    1. Click the name of the access profile that you just created. The Properties screen displays.
    2. On the menu bar, click Logs. The General Properties screen displays.
    3. In the Log Settings area, move log settings from the Available list to the Selected list.
    You can configure log settings in the Access Policy Event Logs area of the product.
This creates an access profile with a default access policy.

Configuring an access policy for transparent forward proxy

You configure an access policy for Secure Web Gateway (SWG) transparent forward proxy to assign a scheme for filtering URLs. You can also add access policy items to collect credentials and to authenticate a user or you can add items to transparently identify the user without requesting credentials.
Note: If you include authentication in your access policy and the first site that a user accesses uses HTTP instead of secure HTTP, passwords are passed as clear text. To prevent this from happening, F5® recommends using Kerberos or NTLM authentication.
  1. On the Main tab, click Access Policy > Access Profiles. The Access Profiles List screen opens.
  2. Click the (+) icon anywhere in the access policy to add a new action item. A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
  3. Optional: If you specified an NTLM Auth configuration in the access profile, verify that authentication succeeded.
    1. Type NTLM in the search field.
    2. Select NTLM Auth Result from the results list.
    3. Click Add Item. A properties popup screen opens.
    4. Click Save. The Properties screen closes. The visual policy editor displays.
  4. Optional: To identify a user transparently, perform these substeps. To use transparent user identification, you must have installed and configured the F5® DC Agent.
    1. On an access policy branch, click the plus symbol (+) to add an item to the access policy.
    2. From the Authentication tab, select Transparent Identity Import and click Add Item. The transparent identity import access policy item searches the database in the IF-MAP server for the client source IP address. By default, this access policy item has two branches: associated and fallback. A properties screen opens.
    3. Click Save. The visual policy editor displays.
    4. Add any additional access policy items to the fallback or associated branches. You might add Kerberos authentication on the fallback branch. On the associated branch, you might assign a scheme.
  5. Optional: To add Kerberos authentication to the access policy, perform these substeps:
    1. On an access policy branch, click the plus symbol (+) to add an item to the access policy.
    2. On the Logon tab, select HTTP 401 Response and click Add Item. A Properties screen opens.
    3. From the HTTP Auth Level list, select negotiate and click Save. The properties screen closes.
    4. Click the (+) icon on the negotiate branch. A popup screen opens.
    5. Type ker in the search field, select Kerberos Auth from the results, and click Add Item. A properties screen opens.
    6. From the AAA Server list, select an existing server.
    7. From the Request Based Auth list, select Disabled.
    8. Click Save. The properties screen closes and the visual policy editor is displayed.
  6. Optional: To assign a scheme that categorizes and filters URLs, perform these substeps:
    1. Click the (+) icon anywhere in the access policy to add a new action item.
    2. On the Assignment tab, select SWG Scheme Assign and click Add Item. A Properties screen opens.
    1. To display the available schemes, click the Add/Delete link.
    2. Select one scheme and click Save. The Properties screen closes and the visual policy editor displays.
  7. Click the Apply Access Policy link to apply and activate the changes to the access policy.
To put an access policy into effect, you must assign it to a virtual server.

Creating a custom Client SSL forward proxy profile

Creating a Client SSL forward proxy profile makes it possible for client and server authentication, while still allowing the BIG-IP® system to perform data optimization, such as decryption and encryption. This profile applies to client-side SSL forward proxy traffic only.

  1. On the Main tab, click Local Traffic > Profiles > SSL > Client. The Client profile list screen opens.
  2. Click Create. The New Client SSL Profile screen opens.
  3. In the Name field, type a unique name for the profile.
  4. From the Parent Profile list, select clientssl.
  5. From the SSL Forward Proxy list, select Advanced.
  6. Select the Custom check box for the SSL Forward Proxy area.
  7. Modify the SSL Forward Proxy settings.
    1. From the SSL Forward Proxy list, select Enabled. You can update this setting later but only while the profile is not assigned to a virtual server.
    2. From the CA Certificate list, select a certificate.
    3. From the CA Key list, select a key.
    4. In the CA Passphrase field, type a passphrase.
    5. In the Confirm CA Passphrase field, type the passphrase again.
    6. In the Certificate Lifespan field, type a lifespan for the SSL forward proxy certificate in days.
    7. Optional: From the Certificate Extensions list, select Extensions List.
    8. Optional: For the Certificate Extensions List setting, select the extensions that you want in the Available extensions field, and move them to the Enabled Extensions field using the Enable button.
    9. From the SSL Forward Proxy Bypass list, select Enabled. You can update this setting later but only while the profile is not assigned to a virtual server. Additional settings display.
    10. For Default Bypass Action, retain the default value Intercept. You can change this setting, as well as add and update intercept and bypass lists at any time. If you set the value to Bypass without specifying lists, you might introduce a security risk to your system. If you set the value to Intercept without specifying lists, the system intercepts and examines all SSL traffic.
  8. Click Finished.
The custom Client SSL forward proxy profile now appears in the Client SSL profile list screen.

Creating a custom Server SSL profile

Create a custom server SSL profile to support SSL forward proxy.
  1. On the Main tab, click Local Traffic > Profiles > SSL > Server. The SSL Server profile list screen opens.
  2. Click Create. The New Server SSL Profile screen opens.
  3. In the Name field, type a unique name for the profile.
  4. For Parent Profile, retain the default selection, serverssl.
  5. From the Configuration list, select Advanced.
  6. Select the Custom check box. The settings become available for change.
  7. From the SSL Forward Proxy list, select Enabled. You can update this setting later, but only while the profile is not assigned to a virtual server.
  8. From the SSL Forward Proxy Bypass list, select Enabled. You can update this setting later but only while the profile is not assigned to a virtual server.
  9. Scroll down to the Secure Renegotiation list and select Request.
  10. Click Finished.
The custom Server SSL profile is now listed in the SSL Server profile list.

Creating a virtual server for forward proxy SSL traffic

You configure a virtual server to handle SSL web traffic.
  1. On the Main tab, click Local Traffic > Virtual Servers. The Virtual Server List screen opens.
  2. Click the Create button. The New Virtual Server screen opens.
  3. In the Name field, type a unique name for the virtual server.
  4. For the Destination setting, select Network, and type 0.0.0.0 in the Address field and 0.0.0.0 in the Mask field.
  5. In the Service Port field, type 443 or select HTTPS from the list.
  6. From the HTTP Profile list, select http.
  7. For the SSL Profile (Client) setting, from the Available list, select the name of the Client SSL forward proxy profile you previously created, and using the Move button, move the name to the Selected list.
    Important: To enable SSL forward proxy functionality, you can either:
    • Disassociate existing Client SSL and Server SSL profiles from a virtual server and configure the SSL Forward Proxy settings.
    • Create new Client SSL and Server SSL profiles and configure the SSL Forward Proxy settings.
    Then with either option, select the Client SSL and Server SSL profiles on a virtual server. You cannot modify existing Client SSL and Server SSL profiles while they are selected on a virtual server to enable SSL forward proxy functionality.
  8. For the SSL Profile (Server) setting, from the Available list, select the name of the Server SSL forward proxy profile you previously created, and using the Move button, move the name to the Selected list.
    Important: To enable SSL forward proxy functionality, you can either:
    • Disassociate existing Client SSL and Server SSL profiles from a virtual server and configure the SSL Forward Proxy settings.
    • Create new Client SSL and Server SSL profiles and configure the SSL Forward Proxy settings.
    Then with either option, select the Client SSL and Server SSL profiles on a virtual server. You cannot modify existing Client SSL and Server SSL profiles while they are selected on a virtual server to enable SSL forward proxy functionality.
  9. For the VLAN and Tunnel Traffic setting, retain the default value All VLANs and Tunnels list.
  10. From the Source Address Translation list, select Auto Map.
  11. If you are using a captive portal , in the Access Policy area from the Access Profile list, select the access profile that you configured for transparent forward proxy.
  12. Click Finished.
The virtual server now appears in the Virtual Server List screen.

Creating a virtual server for forward proxy traffic

You configure a virtual server to handle web traffic going to port 80.
  1. On the Main tab, click Local Traffic > Virtual Servers. The Virtual Server List screen opens.
  2. Click the Create button. The New Virtual Server screen opens.
  3. In the Name field, type a unique name for the virtual server.
  4. For the Destination setting, select Network, and type 0.0.0.0 in the Address field and 0.0.0.0 in the Mask field.
  5. In the Service Port field, type 80, or select HTTP from the list.
  6. From the HTTP Profile list, select http.
  7. For the VLAN and Tunnel Traffic setting, retain the default value All VLANs and Tunnels list.
  8. From the Source Address Translation list, select Auto Map.
  9. In the Access Policy area, from the Access Profile list, select the access profile.
  10. Click Finished.
The virtual server now appears in the Virtual Server List screen.

Creating a forwarding virtual server

For Secure Web Gateway transparent forward proxy in inline mode, you create a forwarding virtual server to intercept IP traffic that is not going to ports 80 or 443.
  1. On the Main tab, click Local Traffic > Virtual Servers. The Virtual Server List screen opens.
  2. Click the Create button. The New Virtual Server screen opens.
  3. In the Name field, type a unique name for the virtual server.
  4. From the Type list, select Forwarding (IP).
  5. In the Source field, type 0.0.0.0/0.
  6. For the Destination setting, select Network, and type 0.0.0.0 in the Address field and 0.0.0.0 in the Mask field.
  7. In the Service Port field, type * or select * All Ports from the list.
  8. From the Protocol list, select * All Protocols.
  9. From the VLAN and Tunnel Traffic list, retain the default selection, All VLANs and Tunnels.
  10. From the Source Address Translation list, select Auto Map.
  11. Click Finished.

Creating a Client SSL profile for a captive portal

You create a Client SSL profile when you want the BIG-IP® system to authenticate and decrypt/encrypt client-side application traffic. You create this profile if you enabled Captive Portals in the access profile and if you want to use SSL.

  1. On the Main tab, click Local Traffic > Profiles > SSL > Client. The Client profile list screen opens.
  2. Click Create. The New Client SSL Profile screen opens.
  3. In the Name field, type a unique name for the profile.
  4. For the Parent Profile list, retain the default value, clientssl.
  5. Select the Custom check box.
  6. In the Certificate Key Chain area, select a certificate and key combination to use for SSL encryption for the captive portal. This certificate should match the FQDN configured in the SWG-Transparent access profile to avoid security warnings, and should be generated by a certificate authority that your browser clients trust.
    Note: If the key is encrypted, type a passphrase. Otherwise, leave the Passphrase field blank.
  7. Click Finished.
After creating the Client SSL profile and assigning the profile to a virtual server, the BIG-IP system can apply SSL security to the type of application traffic for which the virtual server is configured to listen.

Creating a virtual server for a captive portal

You configure a virtual server to use as a captive portal if you enabled the Captive Portals setting in the access profile.
Note: If you do not plan to use client-side SSL, select a service port other than 443 and do not select a SSL (Client) profile.
  1. On the Main tab, click Local Traffic > Virtual Servers. The Virtual Server List screen opens.
  2. Click the Create button. The New Virtual Server screen opens.
  3. In the Name field, type a unique name for the virtual server.
  4. For the Destination setting, select Host and in the Address field, type the IP address for the virtual server.
  5. In the Service Port field, type 443 or select HTTPS from the list.
  6. From the HTTP Profile list, select http.
  7. For the SSL Profile (Client) setting, move the profile you configured previously from the Available list to the Selected list.
  8. Scroll down to the Access Policy area.
  9. From the Access Profile list, select the access profile you configured previously.
  10. Click Finished.
The HTTPS virtual server appears in the Virtual Server List screen.

Implementation result

Web traffic that originates from your enterprise networks is now inspected and controlled by F5® Secure Web Gateway forward proxy.

Overview: Configuring transparent forward proxy

In transparent forward proxy, you configure your internal network to forward web traffic to the BIG-IP® system with Secure Web Gateway (SWG). Use this implementation when your topology includes a router on which you can configure policy-based routing or Web Cache Communication Protocol (WCCP) to send any traffic for ports 80 and 443 to the BIG-IP system.

This implementation describes only the configuration required on the BIG-IP system.

swg Secure Web Gateway transparent forward proxy deployment

The router sends traffic to the self-ip address of a VLAN configured on the BIG-IP system. Virtual servers listen on the VLAN and process the traffic that most closely matches the virtual server address. Secure Web Gateway identifies users without using session management cookies, and applies a scheme that categorizes and filters URLs, controlling access.

Note: Transparent forward proxy provides the option to use a captive portal. To use this option, you need an additional virtual server, not shown in the figure, for the captive portal primary authentication server.

Before you begin

To use SWG, you must configure URL categorization. You might need to configure additional items depending on the other features that you decide to use.

URL categorization
To get a working SWG configuration, you must first download URL categories, configure URL filters, and configure schemes.
Transparent user identification
If you plan to identify users transparently, you must first download, install, and configure the F5® DC Agent.
Authentication
F5 recommends that you use NTLM or Kerberos authentication. If you plan to use authentication, ensure that you have what you need configured.
  • For NTLM, you need an NTLM Auth Configuration in Access Policy Manager® (APM®).
  • For Kerberos, you need a domain-joined Kerberos user account and a Kerberos AAA server configured in APM.
SSL intercept
To intercept SSL connections that are passing through the proxy, ensure that you have imported a valid subordinate CA certificate and key that is trusted by the endpoints behind the proxy.
Captive portal
If you plan to use the captive portal feature, make sure that a certificate and key with the proper common name is imported for use.

Task Summary

About the iApp for Secure Web Gateway configuration

When deployed as an application service, the Secure Web Gateway iApps® template can set up either an explicit or a transparent forward proxy configuration. You can download the template from the F5® DevCentral™ iApp Codeshare wiki at (http://devcentral.f5.com/wiki/iapp.Codeshare.ashx).

About ways to configure user identification for SWG

User identification configuration requires a method setting in the access profile and an access policy configured to support the setting. Based on user identification, you can determine which scheme to assign in the access policy so that Secure Web Gateway (SWG) filters URLs appropriately.

Depending on the access profile type, you can select one of these user identification methods: by IP address (for SWG-Explicit or SWG-Transparent access profile types) or by credentials (for SWG-Explicit type).

Identification by IP address

When you identify users by IP address, you can employ any of these methods.

Note: Identify users by IP address only when IP addresses are unique and can be trusted.
transparent user identification
Transparent user identification makes a best effort to identify users without requesting credentials. It queries domain controllers and stores a mapping of IP addresses to user names in an IF-MAP server.
Note: To identify users transparently, you must first install and configure the F5® DC Agent.
explicit user identification
You can present a logon page in an access policy to request user credentials and validate them. SWG maintains an internal mapping of IP addresses to user names. (You can present the appropriate logon page for the access policy type. For explicit forward proxy, you can present a 407 page. For transparent forward proxy, you can present a 401 page.)
source IP ranges or subnets
You can forego actually identifying the user and base the choice of which scheme to apply on whether the IP address is in a source IP range or on a subnet. SWG maintains an internal mapping of IP addresses to sessions.
single scheme
You can apply the same scheme to all users. SWG maintains an internal mapping of IP addresses to sessions.

Identification by credentials

When you choose to identify users by credentials, SWG maintains an internal mapping of credentials to sessions. To support this choice, you need an NTLM Auth Configuration object and you should check the result of NTLM authentication in the access policy.

Creating a VLAN for transparent forward proxy

You need a VLAN on which the forward proxy can listen. For increased security, the VLAN should directly face your clients.
  1. On the Main tab, click Network > VLANs. The VLAN List screen opens.
  2. Click Create. The New VLAN screen opens.
  3. In the Name field, type a unique name for the VLAN.
  4. For the Interfaces setting, click an interface number from the Available list, and use the Move button to add the selected interface to the Untagged list. Repeat this step as necessary.
  5. Click Finished. The screen refreshes, and displays the new VLAN from the list.
The new VLAN appears in the VLAN list.

Assigning a self IP address to a VLAN

Assign a self IP address to a VLAN on which the forward proxy listens.
  1. On the Main tab, click Network > Self IPs. The Self IPs screen opens.
  2. Click Create. The New Self IP screen opens.
  3. In the Name field, type a unique name for the self IP.
  4. In the IP Address field, type the IP address of the VLAN. The system accepts IPv4 and IPv6 addresses.
  5. In the Netmask field, type the network mask for the specified IP address.
  6. From the VLAN/Tunnel list, select the VLAN.
  7. Click Finished. The screen refreshes, and displays the new self IP address.

Creating an access profile for SWG transparent forward proxy

You create an access profile to provide the access policy configuration for a virtual server that establishes a secured session.
  1. On the Main tab, click Access Policy > Access Profiles. The Access Profiles List screen opens.
  2. Click Create. The New Profile screen opens.
  3. Type a name for the access profile.
  4. From the Profile Type list, select SWG-Transparent. With this type, only the access policy items that are valid for Secure Web Gateway (SWG) transparent forward proxy are available in the visual policy editor.
  5. Select the Custom check box for Settings. The settings become available.
  6. Optional: To use NTLM authentication before a session starts, from the NTLM Auth Configuration list select a configuration. In the case of a shared machine, an IP address might already be associated with a user or a session. Using NTLM authentication ensures that the system can associate the IP address with the correct session (new or existing) or with a new user each time a user logs on to the shared machine.
  7. Optional: To direct users to a captive portal, for Captive Portal select Enabled and, in the Primary Authentication URI field, type the URI. You might specify the URI of your primary authentication server if you use single sign-on across multiple domains. Users can then access multiple back-end applications from multiple domains and hosts without needing to re-enter their credentials, because the user session is stored on the primary domain. For example, you might type https://logon.siterequest.com in the field.
  8. In the Language Settings area, add and remove accepted languages, and set the default language. A browser uses the highest priority accepted language. If no browser language matches the accepted languages list, the browser uses the default language.
  9. Click Finished. The Access Profiles list screen displays.
  10. To enable Secure Web Gateway event logging for this access profile, add log settings.
    1. Click the name of the access profile that you just created. The Properties screen displays.
    2. On the menu bar, click Logs. The General Properties screen displays.
    3. In the Log Settings area, move log settings from the Available list to the Selected list.
    You can configure log settings in the Access Policy Event Logs area of the product.
This creates an access profile with a default access policy.

Configuring an access policy for transparent forward proxy

You configure an access policy for Secure Web Gateway (SWG) transparent forward proxy to assign a scheme for filtering URLs. You can also add access policy items to collect credentials and to authenticate a user or you can add items to transparently identify the user without requesting credentials.
Note: If you include authentication in your access policy and the first site that a user accesses uses HTTP instead of secure HTTP, passwords are passed as clear text. To prevent this from happening, F5® recommends using Kerberos or NTLM authentication.
  1. On the Main tab, click Access Policy > Access Profiles. The Access Profiles List screen opens.
  2. Click the (+) icon anywhere in the access policy to add a new action item. A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
  3. Optional: If you specified an NTLM Auth configuration in the access profile, verify that authentication succeeded.
    1. Type NTLM in the search field.
    2. Select NTLM Auth Result from the results list.
    3. Click Add Item. A properties popup screen opens.
    4. Click Save. The Properties screen closes. The visual policy editor displays.
  4. Optional: To identify a user transparently, perform these substeps. To use transparent user identification, you must have installed and configured the F5® DC Agent.
    1. On an access policy branch, click the plus symbol (+) to add an item to the access policy.
    2. From the Authentication tab, select Transparent Identity Import and click Add Item. The transparent identity import access policy item searches the database in the IF-MAP server for the client source IP address. By default, this access policy item has two branches: associated and fallback. A properties screen opens.
    3. Click Save. The visual policy editor displays.
    4. Add any additional access policy items to the fallback or associated branches. You might add Kerberos authentication on the fallback branch. On the associated branch, you might assign a scheme.
  5. Optional: To add Kerberos authentication to the access policy, perform these substeps:
    1. On an access policy branch, click the plus symbol (+) to add an item to the access policy.
    2. On the Logon tab, select HTTP 401 Response and click Add Item. A Properties screen opens.
    3. From the HTTP Auth Level list, select negotiate and click Save. The properties screen closes.
    4. Click the (+) icon on the negotiate branch. A popup screen opens.
    5. Type ker in the search field, select Kerberos Auth from the results, and click Add Item. A properties screen opens.
    6. From the AAA Server list, select an existing server.
    7. From the Request Based Auth list, select Disabled.
    8. Click Save. The properties screen closes and the visual policy editor is displayed.
  6. Optional: To assign a scheme that categorizes and filters URLs, perform these substeps:
    1. Click the (+) icon anywhere in the access policy to add a new action item.
    2. On the Assignment tab, select SWG Scheme Assign and click Add Item. A Properties screen opens.
    1. To display the available schemes, click the Add/Delete link.
    2. Select one scheme and click Save. The Properties screen closes and the visual policy editor displays.
  7. Click the Apply Access Policy link to apply and activate the changes to the access policy.
To put an access policy into effect, you must assign it to a virtual server.

Creating a custom Client SSL forward proxy profile

Creating a Client SSL forward proxy profile makes it possible for client and server authentication, while still allowing the BIG-IP® system to perform data optimization, such as decryption and encryption. This profile applies to client-side SSL forward proxy traffic only.

  1. On the Main tab, click Local Traffic > Profiles > SSL > Client. The Client profile list screen opens.
  2. Click Create. The New Client SSL Profile screen opens.
  3. In the Name field, type a unique name for the profile.
  4. From the Parent Profile list, select clientssl.
  5. From the SSL Forward Proxy list, select Advanced.
  6. Select the Custom check box for the SSL Forward Proxy area.
  7. Modify the SSL Forward Proxy settings.
    1. From the SSL Forward Proxy list, select Enabled. You can update this setting later but only while the profile is not assigned to a virtual server.
    2. From the CA Certificate list, select a certificate.
    3. From the CA Key list, select a key.
    4. In the CA Passphrase field, type a passphrase.
    5. In the Confirm CA Passphrase field, type the passphrase again.
    6. In the Certificate Lifespan field, type a lifespan for the SSL forward proxy certificate in days.
    7. Optional: From the Certificate Extensions list, select Extensions List.
    8. Optional: For the Certificate Extensions List setting, select the extensions that you want in the Available extensions field, and move them to the Enabled Extensions field using the Enable button.
    9. From the SSL Forward Proxy Bypass list, select Enabled. You can update this setting later but only while the profile is not assigned to a virtual server. Additional settings display.
    10. For Default Bypass Action, retain the default value Intercept. You can change this setting, as well as add and update intercept and bypass lists at any time. If you set the value to Bypass without specifying lists, you might introduce a security risk to your system. If you set the value to Intercept without specifying lists, the system intercepts and examines all SSL traffic.
  8. Click Finished.
The custom Client SSL forward proxy profile now appears in the Client SSL profile list screen.

Creating a custom Server SSL profile

Create a custom server SSL profile to support SSL forward proxy.
  1. On the Main tab, click Local Traffic > Profiles > SSL > Server. The SSL Server profile list screen opens.
  2. Click Create. The New Server SSL Profile screen opens.
  3. In the Name field, type a unique name for the profile.
  4. For Parent Profile, retain the default selection, serverssl.
  5. From the Configuration list, select Advanced.
  6. Select the Custom check box. The settings become available for change.
  7. From the SSL Forward Proxy list, select Enabled. You can update this setting later, but only while the profile is not assigned to a virtual server.
  8. From the SSL Forward Proxy Bypass list, select Enabled. You can update this setting later but only while the profile is not assigned to a virtual server.
  9. Scroll down to the Secure Renegotiation list and select Request.
  10. Click Finished.
The custom Server SSL profile is now listed in the SSL Server profile list.

Creating a virtual server for forward proxy SSL traffic

You configure a virtual server to handle SSL web traffic.
  1. On the Main tab, click Local Traffic > Virtual Servers. The Virtual Server List screen opens.
  2. Click the Create button. The New Virtual Server screen opens.
  3. In the Name field, type a unique name for the virtual server.
  4. For the Destination setting, select Network, and type 0.0.0.0 in the Address field and 0.0.0.0 in the Mask field.
  5. In the Service Port field, type 443 or select HTTPS from the list.
  6. From the HTTP Profile list, select http.
  7. For the SSL Profile (Client) setting, from the Available list, select the name of the Client SSL forward proxy profile you previously created, and using the Move button, move the name to the Selected list.
    Important: To enable SSL forward proxy functionality, you can either:
    • Disassociate existing Client SSL and Server SSL profiles from a virtual server and configure the SSL Forward Proxy settings.
    • Create new Client SSL and Server SSL profiles and configure the SSL Forward Proxy settings.
    Then with either option, select the Client SSL and Server SSL profiles on a virtual server. You cannot modify existing Client SSL and Server SSL profiles while they are selected on a virtual server to enable SSL forward proxy functionality.
  8. For the SSL Profile (Server) setting, from the Available list, select the name of the Server SSL forward proxy profile you previously created, and using the Move button, move the name to the Selected list.
    Important: To enable SSL forward proxy functionality, you can either:
    • Disassociate existing Client SSL and Server SSL profiles from a virtual server and configure the SSL Forward Proxy settings.
    • Create new Client SSL and Server SSL profiles and configure the SSL Forward Proxy settings.
    Then with either option, select the Client SSL and Server SSL profiles on a virtual server. You cannot modify existing Client SSL and Server SSL profiles while they are selected on a virtual server to enable SSL forward proxy functionality.
  9. For the VLAN and Tunnel Traffic setting, retain the default value All VLANs and Tunnels list.
  10. From the Source Address Translation list, select Auto Map.
  11. If you are using a captive portal , in the Access Policy area from the Access Profile list, select the access profile that you configured for transparent forward proxy.
  12. Click Finished.
The virtual server now appears in the Virtual Server List screen.

Creating a virtual server for forward proxy traffic

You configure a virtual server to handle web traffic going to port 80.
  1. On the Main tab, click Local Traffic > Virtual Servers. The Virtual Server List screen opens.
  2. Click the Create button. The New Virtual Server screen opens.
  3. In the Name field, type a unique name for the virtual server.
  4. For the Destination setting, select Network, and type 0.0.0.0 in the Address field and 0.0.0.0 in the Mask field.
  5. In the Service Port field, type 80, or select HTTP from the list.
  6. From the HTTP Profile list, select http.
  7. For the VLAN and Tunnel Traffic setting, retain the default value All VLANs and Tunnels list.
  8. From the Source Address Translation list, select Auto Map.
  9. In the Access Policy area, from the Access Profile list, select the access profile.
  10. Click Finished.
The virtual server now appears in the Virtual Server List screen.

Creating a Client SSL profile for a captive portal

You create a Client SSL profile when you want the BIG-IP® system to authenticate and decrypt/encrypt client-side application traffic. You create this profile if you enabled Captive Portals in the access profile and if you want to use SSL.

  1. On the Main tab, click Local Traffic > Profiles > SSL > Client. The Client profile list screen opens.
  2. Click Create. The New Client SSL Profile screen opens.
  3. In the Name field, type a unique name for the profile.
  4. For the Parent Profile list, retain the default value, clientssl.
  5. Select the Custom check box.
  6. In the Certificate Key Chain area, select a certificate and key combination to use for SSL encryption for the captive portal. This certificate should match the FQDN configured in the SWG-Transparent access profile to avoid security warnings, and should be generated by a certificate authority that your browser clients trust.
    Note: If the key is encrypted, type a passphrase. Otherwise, leave the Passphrase field blank.
  7. Click Finished.
After creating the Client SSL profile and assigning the profile to a virtual server, the BIG-IP system can apply SSL security to the type of application traffic for which the virtual server is configured to listen.

Creating a virtual server for a captive portal

You configure a virtual server to use as a captive portal if you enabled the Captive Portals setting in the access profile.
Note: If you do not plan to use client-side SSL, select a service port other than 443 and do not select a SSL (Client) profile.
  1. On the Main tab, click Local Traffic > Virtual Servers. The Virtual Server List screen opens.
  2. Click the Create button. The New Virtual Server screen opens.
  3. In the Name field, type a unique name for the virtual server.
  4. For the Destination setting, select Host and in the Address field, type the IP address for the virtual server.
  5. In the Service Port field, type 443 or select HTTPS from the list.
  6. From the HTTP Profile list, select http.
  7. For the SSL Profile (Client) setting, move the profile you configured previously from the Available list to the Selected list.
  8. Scroll down to the Access Policy area.
  9. From the Access Profile list, select the access profile you configured previously.
  10. Click Finished.
The HTTPS virtual server appears in the Virtual Server List screen.

Implementation result

Web traffic that originates from your enterprise networks is now inspected and controlled by F5® Secure Web Gateway forward proxy.

Table of Contents | << Previous Chapter | Next Chapter >>
Contact Support Contact Support

Have a Question?

Support and Sales >

About F5

Education

F5 Sites

Support Tasks




©2023 F5 Networks, Inc. All rights reserved.


Trademarks Policies Privacy California Privacy Do Not Sell My Personal Information