Hello,
we are running the security management software sam by secova. In our internal network it is no problem to access the browser based application.
Now I want to make the application available worldwide without putting the server out to the web with no protection. So I want to use WAF to protect the server. So far, so easy. I know the RULZ and the UTM is running smoothly at the newest version. We already have some other webservers protected by WAF which is running smoothly as well.
With our security management software I'm facing the issue, that the authentication page (the first page a user sees) is not loaded. I asked the support of secova if they have experiences with WAF and Sophos UTM or web proxies in general and the answer was as follows:
Running the server that is hosting the application behind a web proxy is not a problem. They had some general hints for me.
1. Do not change paths. If the Software shall be available under a subfolder from the web (e.g. http://sam.contoso.com/lessons ) than the internal path should be the same (http://sam.intern.local/lessons ). In our case, the application is provided without subfolders.
2. Contents must not be changed by the WAF.
3. Changing domains from external to internal is no problem. We are using different external and internal domains.
4. If the external side uses https but the internal does not, there has to be a header X-Forwarded-Proto set for the internal request. It is necessary for the application to know about the encryption. Since we are using encryption on the internal side as well, the header is not necessary.
Now I need your help to get this done with the firewall rules and the other settings there are in WAF. So far we used trial and error to sort out what works with the protected applications, but as sam is very dynamic application and constantly exchanges information with the client system, I'm stuck with our former approach.
Thanks a lot for your help!
Tim
This thread was automatically locked due to age.
