About Proxy Mode

Your Web Gateway acts as the proxy server for your network and you configure it to work in either Explicit or Transparent mode.

With Explicit (sometimes known as standard) mode, you configure your Web Gateway and client machines with a standard proxy address. The client machine request is directly routed to the proxy server.

There are two types of transparent mode:

• Policy Based Routing (PBR)

• Web Cache Control Protocol (WCCP)

To enable transparency, you need to have a router configured to use the particular mode and a Web Gateway located on your network. Client requests are intercepted by the router and then redirected and encapsulated to the proxy server using specific protocols. For WCCP, the router needs to be a CISCO router that supports WCCP.

You complete configuration for each mode from the Proxy Mode page.

Tell me about...

• Key features supported by each mode

  Feature	Mode
  	Explicit	WCCP	PBR
  Load Balancing	Yes, with PAC Script	Yes	No
  Failover	Yes, with PAC Script	Yes	No
  Browser FTP	Yes	No	No
  Authentication	Yes	Yes	Yes
  Requires CISCO Router	No	Yes	No
  Requires Web Server to host PAC	Yes	No	No

• The benefits of using a transparent proxy

  As transparency is implemented at the network layer, it is difficult to bypass. Any device with an IP address can be transparently redirected.

  Another benefit of a transparent proxy set up over an explicit configuration is that client software can access remote servers with no modification to the client machine. For example, an explicit setup requires that each client machine on a company network would need to have the proxy detail manually configured or supplied by means of a PAC or WPAD file. By using a transparent proxy, this requirement is removed.

  Manual configuration is required if you plan to use HTTPS. To ensure that internal web applications function correctly, we recommended that intranet traffic is not intercepted by the transparent proxy. We recommend that you do not attempt to perform administration tasks on the Gateway if your browser is currently using transparency.

• PBR

  You might enable PBR if you want certain packets to be routed some way other than the obvious shortest path. Some possible applications for PBR are to provide equal access, protocol-sensitive routing, source-sensitive routing, routing based on interactive versus batch traffic, or routing based on dedicated links.

  To use this mode, you need a router on your network configured to use PBR. You then use the Proxy Mode User Interface to provide further configuration options and enable the mode.

• WCCP

  WCCP is a content routing protocol developed by Cisco that provides a mechanism to redirect traffic flows in real time.

  WCCP offers:

  • Security

    By password protecting the WCCP service group, you can ensure that only authorised Gateways can join. Access Control Lists (ACLs) on the router can be configured to restrict access to specific Gateways.

  • Flexibility

    You can control what traffic to redirect and how to redirect it, and filter traffic using ACLs.

  To use this mode, you need a router on your network, configured to use WCCP. You then use the Proxy Mode User Interface to provide further configuration options and enable the mode.

  Show me a basic Gateway WCCP exchange

  

  1. The client sends a request to the Web Server.
  2. The WCCP enabled router intercepts the request and redirects it to the Gateway.
  3. The Gateway determines what to do with the request depending on what has been configured for the traffic type. If the request cannot be managed by the Gateway (for example, by returning a local page cache), it will be sent to the Web Server.
  4. The Web Server response is routed back to the Gateway
  5. The Gateway forwards the response to the client.

  We recommend that you use WCCP v2. This version has increased capabilities including support for both HTTP and HTTPS traffic. Due to variations in the level of support provided by WCCP-capable routers, please refer to your router documentation for specific details of supported features.

• Redirecting inbound and outbound router traffic when using WCCP

  When you configure your router and Gateway within a group, you define how traffic is intercepted and redirected. Traffic can intercepted by configuring Access Control Lists (ACLs) on your router, and by defining specific ports on the WCCP settings on your Gateway. Without any configuration, all traffic is redirected.

• Authenticating users in transparent mode

  You can authenticate users for both HTTP and HTTPS requests when your proxy is configured in transparent mode. There are two authentication types:

  • IP Address
  • Cookie

  The cookie solution has the following advantages over the IP Address method:

  • Cookies are stored for each user. Therefore, if multiple users use the same machine, they will be treated as separate users as opposed to a single IP address
  • If NATing is used, the IP address could change when traffic flows through the NATing device and would cause all users to have the same IP address. This problem does not occur with cookies
  • If DHCP is used, the IP address of a client has no impact on the cookies being used

  However, there are some disadvantages to using cookies as they can be turned off and the handling of cookies can vary across browsers. You might need to consider your organization's cookie policy when considering which method to use.

  Most tablet applications do not support cookie authentication. When authenticating tablet applications you should either: Use IP address authentication Add a machine list and route for all tablets so no authentication takes place

• What happens if I have peered Gateways

  Explicit and Transparent mode settings will be peered to all Gateways.

• Restrictions I might encounter when accessing applications from tablet devices using transparent mode

  When considering the varying nature of how applications allow access, alongside different tablet devices and their operating systems, you might encounter problems and restrictions with access to some applications when using transparent mode with certain authentication configurations.

  The following table includes detail of popular devices and applications with associated restrictions.

  Note that this list of devices and applications is not exhaustive. When considering the evolving nature of devices and how applications allow access, these details are subject to change.

  Operating System	Will not work	Will work (with possible limitations)
  Android	Accessing applications using cookie authentication will not work. Accessing applications using netbios resolution or Kerberos will not work	No authentication and HTTPS disabled: Many popular applications including Facebook, Skype, and Twitter will work. No authentication and HTTPS enabled Many popular applications including Skype, Instagram, and Spotify will work. Facebook and Twitter will not work. NTLM, LDAP authentication with HTTPS disabled Many popular applications including Facebook, Skype, and Twitter will work. This configuration requires user authentication in the browser before running the application. NTLM, LDAP authentication with HTTPS enabled Many popular applications including Skype, Instagram, and Spotify will work provided user authentication in the browser before running the application. Facebook and Twitter will not work.
  Windows Surface RT	Accessing applications using cookie authentication will not work.	No authentication and HTTPS disabled: Many popular applications including Facebook, Skype, and Twitter will work. No authentication and HTTPS enabled A limited number of applications will work with this configuration. NTLM, LDAP authentication with HTTPS disabled Many popular applications including Facebook, Skype, and Twitter will work. NTLM, LDAP authentication with HTTPS enabled A limited number of applications will work with this configuration.
  iOS	Accessing applications using cookie authentication will not work.	No authentication and HTTPS disabled: Many popular applications including Facebook, Skype, and Twitter will work. No authentication and HTTPS enabled Many popular applications including Skype, Instagram, and Spotify will work. Facebook and Twitter will not work. NTLM, LDAP authentication with HTTPS disabled Many popular applications including Facebook, Skype, and Twitter will work. This configuration requires user authentication in the browser before running the application. NTLM, LDAP authentication with HTTPS enabled Many popular applications including Skype, Instagram, and Spotify will work provided user authentication in the browser before running the application. Facebook and Twitter will not work. This configuration requires user authentication in the browser before running the application.

How do I...

• Configure my router and Gateway to use Explicit proxy mode?

  For steps on how to configure Explicit proxy mode using the Proxy Mode page, see the Configuring Proxy Mode topic.

• Configure my router and Gateway to use Transparent proxy mode?

  For information including configuring WCCP, setting up service groups, and configuration options on the Proxy Mode page, see the Configuring Proxy Mode topic.