Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 24 replies
  • Subscribers 44 subscribers
  • Views 36500 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Use Transparent Proxy or Non-Transparent Proxy?

Dwayne Parker

What do you recommend?

Using Transparent or Non-Transparent Proxy mode?

 

Thanks in advance:

 

 

Dwayne Parker



This thread was automatically locked due to age.
Parents
  • 0

    manbearpig said:


    There is a difference between standard and transparent proxy in the "DNS handling" of the clients.Standard proxy = your client can only resolve the internet in the HTTP connect phase via proxy port. Transparent proxy = your client tries to resolve the target server via DNS port 53.


    Some of those Scenarios you describe can be solved also in transparent Proxy. There is a Flag called Pharming Protection to be found in Protect > Web > General Settings > Protection > Advanced Settings > Enable Pharming Protection.

    Big_Buck said:


    for example, From: LAN, 192.168.1.0/24, HTTP, HTTPS, FTP --- to --- WAN, ANY, HTTP, HTTPS, FTP --- port forward to --- 192.168.1.2.

    Where 192.168.1.2 is the arbitrary address of a WEB gateway.  And 192.168.1.0/24 being the internal network.  8 (eight) hours of Sophos professionnal service have proven unable to setup something as basic as that.  Easily done on $100 chinese firewalls.

    It could be possible in command line maybe ...



    Shouldn't this scenario be possible to solve with Policy Routing? The only limitation would be, that the Proxy-IP must be somewhere out of the 192.168.1.0/24 Range.



    Please send me Spam gueselkuebel@sg-utm.also-solutions.ch

  • 0 in reply to HuberChristian

    I don‘t understand the setup completely. 192.168.1.1 is the XG‘s LAN side and 192.168.1.2 is an alias of the XG on the same interface where all traffic should be routed to to act as what?

    Gruß / Regards,

    Kevin
    Sophos CE/CA (XG+UTM), Gold Partner

  • 0 in reply to kerobra_retired

    ok.  192.168.1.2 is actually a dedicated and separate appliance.  Could be virtual.  Could be hardware.  But the sole purpose of that appliance is to decrypt https, and scan http, https, ftp, socks traffic.  It is not the firewall, which, in my example is 192.168.1.1

    Typically, to make this work in non transparent proxy mode, you have to setup GPO in active directory, or in Window control panel's "Internet Option, Connection, Lan Setting".  In other words, you have to tell your computer that the way out of your network for those traffics is not the firewall, but the web proxy instead.

    In transparent proxy, your firewall takes care of this and redirect http, https, ftp, socks traffic towards that appliance in such a way no setup is required on desktops.

    In UTM it should be scan at the firewall level.  One might consider this as transparent proxy as well.  But I have yet to see a single firewall vendor achieving it it properly.

    Paul Jr

  • 0 in reply to Big_Buck

    Big_Buck said:
    Typically, to make this work in non transparent proxy mode, you have to setup GPO in active directory, or in Window control panel's "Internet Option, Connection, Lan Setting".  In other words, you have to tell your computer that the way out of your network for those traffics is not the firewall, but the web proxy instead.

    You could distribute a central proxy.pac- or wpad.dat-Link via DHCP or DNS to achieve that.

    Gruß / Regards,

    Kevin
    Sophos CE/CA (XG+UTM), Gold Partner

  • 0 in reply to kerobra_retired

    Yes.  Been there.  Done that.  But no one wants to maintain a java enabled server just for that archaic purpose that's very creative at failing.  Particularly on environments with many internal subnets, and one or more corporate VPN.  WEB browsers get confused on the real gateway, and exception in the "Internet Configuration" often fails.  And that requires unproductive baby-sitting.

Reply
  • 0 in reply to kerobra_retired

    Yes.  Been there.  Done that.  But no one wants to maintain a java enabled server just for that archaic purpose that's very creative at failing.  Particularly on environments with many internal subnets, and one or more corporate VPN.  WEB browsers get confused on the real gateway, and exception in the "Internet Configuration" often fails.  And that requires unproductive baby-sitting.

Children
No Data
Unfiltered HTML