Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Proxy modes

December 16, 2024
Contributed by: 
C S S

The Citrix ADC appliance acts as a client’s proxy to connect to the internet and SaaS applications. As a proxy, it accepts all the traffic and determines the traffic’s protocol. Unless the traffic is HTTP or SSL, it is forwarded to the destination as is. When the appliance receives a request from a client, it intercepts the request and performs some actions, such as user authentication, site categorization, and redirection. It uses policies to determine which traffic to allow and which traffic to block.

The appliance maintains two different sessions, one between the client and the proxy and the other between the proxy and the origin server. The proxy relies on customer defined policies to allow or block HTTP and HTTPS traffic. Therefore, it is important that you define policies to bypass sensitive data, such as financial information. The appliance offers a rich set of Layer 4 to Layer 7 traffic attributes and user-identity attributes to create traffic management policies.

For SSL traffic, the proxy verifies the origin server’s certificate and establishes a legitimate connection with the server. It then emulates the server certificate, signs it using a CA certificate installed on Citrix ADC, and presents the created server certificate to the client. You must add the CA certificate as a trusted certificate to the client’s browser for the SSL session to be successfully established.

The appliance supports transparent and explicit proxy modes. In explicit proxy mode, the client must specify an IP address in their browser, unless the organization pushes the setting onto the client’s device. This address is the IP address of a proxy server that is configured on the ADC appliance. All client requests are sent to this IP address. For explicit proxy, you must configure a content switching virtual server of type PROXY and specify an IP address and a valid port number. Also, when the markconnReqInval parameter is set to ON globally on the default HTTP profile, then you must bind another HTTP profile with markconnReqInval set to OFF to the content switching virtual server.

Example to bind a custom HTTP profile to the proxy content switching virtual server:

add ns httpprofile custom_http_profile1 -markconnReqInval DISABLED
set cs vserver swgVS -httpprofileName custom_http_profile1
<!--NeedCopy-->

Transparent proxy, as the name implies, is transparent to the client. That is, the clients might not be aware that a proxy server is mediating their requests. The ADC appliance is configured in an inline deployment, and transparently accepts all HTTP and HTTPS traffic. For transparent proxy, you must configure a content switching virtual server of type PROXY, with asterisks (* *) as the IP address and port. When using the SSL Forward Proxy Wizard in the GUI, you do not have to specify an IP address and port.

Note

To intercept protocols other than HTTP and HTTPS in transparent proxy mode, you must add a listen policy and bind it to the proxy server.

Configure SSL forward proxy by using the CLI

At the command prompt, type:

add cs vserver <name> PROXY <ipaddress> <port>
<!--NeedCopy-->

Arguments:

Name:

Name for the proxy server. Must begin with an ASCII alphanumeric or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters. Cannot be changed after the CS virtual server is created.

The following requirement applies only to the CLI:

If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, “my server” or ‘my server’).

This argument is mandatory. Maximum Length: 127

IPAddress:

IP address of the proxy server.

Port:

Port number for the proxy server. Minimum value: 1

Example for explicit proxy:

add cs vserver swgVS PROXY 192.0.2.100 80
<!--NeedCopy-->

Example for transparent proxy:

add cs vserver swgVS PROXY * *
<!--NeedCopy-->

Add a listen policy to the transparent proxy server by using the GUI

  1. Navigate to Security > SSL Forward Proxy > Proxy Virtual Servers. Select the transparent proxy server and click Edit.
  2. Edit Basic Settings, and click More.
  3. In Listen priority, enter 1.

  4. In Listen Policy Expression, enter the following expression:

    (CLIENT.TCP.DSTPORT.EQ(80)||CLIENT.TCP.DSTPORT.EQ(443))
<!--NeedCopy-->

Note

This expression assumes standard ports for HTTP and HTTPS traffic. If you have configured different ports, for example 8080 for HTTP or 8443 for HTTPS, modify the preceding expression to specify those ports.

Proxy modes
December 16, 2024
Contributed by: 
C S S
December 16, 2024
Contributed by: 
C S S

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.