Web Gateway 7.1.5 Product Guide - McAfee

3
Proxies and caching
Reverse HTTPS proxy configuration
Reverse HTTPS proxy configuration
You can use a reverse HTTPS proxy configuration to prevent clients from uploading unwanted data,
such as malware or particular media types, to particular web servers under the HTTPS protocol. This
section explains such a configuration and tells you how to set it up.
In a reverse HTTPS proxy configuration, HTTPS traffic is redirected to the appliance, which serves as a
proxy that inspects the traffic and eventually forwards or blocks it, according to the rules that are
implemented.
You can configure this in the following ways:
• A transparent bridge or router configuration
• A DNS configuration that points directly to the appliance when access to a particular web server is
requested
Note: The redirection to the appliance can also be achieved by configuring proxy-aware connections relying
on the use of CONNECT headers.
However, this method would require an additional network device to assemble these headers for incoming
requests, so it is not recommended and further explained here.
In addition to configuring your network in one of these ways, you need to configure the handling of SSL
certificates. Optionally, you can configure some additional settings that are not SSL-related to ensure a
smooth operation of the reverse HTTPS proxy configuration.
Redirect HTTPS traffic in a transparent bridge or router configuration
In a transparent bridge or router configuration, you can use a port redirect rule to direct HTTPS traffic
to the proxy port on the appliance.
Note: The term port forwarding rule is also used for a port redirect rule.
Furthermore, you need to ensure that the redirected requests are treated as SSL-secured
communication.
1 Go to Configuration | Appliances.
2 On the appliances tree, go to the appliance you want to redirect traffic to and select Proxies
(HTTP(S), FTP, ICAP, and IM).
3 In the Network Setup section, select Transparent bridge (or Transparent router). The section
with the transparent bridge (or router) settings appears.
4 Under Port redirects, click Add. The Add Port Redirects window opens.
5 Configure the following for the new port redirect rule:
• Protocol name — http
Note: This setting covers connections under both the HTTP and HTTPS protocols.
• Original destination ports — 443
Note: If the web servers that are the destinations for requests can be reached under the HTTP protocol
as well, you can add port 80 here (separated by a comma). This type of traffic is then also directed to
the appliance.
• Destination proxy port — 9090
Note: This is by default the proxy port on the appliance.
6 Click OK. The window closes and the new port redirect rule is added to the list.
7 Under HTTP proxy port, make sure Enable HTTP proxy is selected and click Add. The Add HTTP
Proxy Port window opens.
60 McAfee Web Gateway 7.1.5 Product Guide