Product Documentation
ADC
14.1 - Current Release 13.1 13.0 12.1
View PDF

Proxy modes

December 16, 2024
Contributed by: 
C C

NetScaler acts as a client’s proxy to connect to the internet and SaaS applications. As a proxy, it accepts all the traffic and determines the traffic’s protocol. Unless the traffic is HTTP or SSL, it is forwarded to the destination as is. When the appliance receives a request from a client, it intercepts the request and performs some actions, such as user authentication, site categorization, and redirection. It uses policies to determine which traffic to allow and which traffic to block.

The appliance maintains two different sessions, one between the client and the proxy and the other between the proxy and the origin server. The proxy relies on customer-defined policies to allow or block HTTP and HTTPS traffic. Therefore, it is important that you define policies to bypass sensitive data, such as financial information. The appliance offers a rich set of Layer 4 to Layer 7 traffic attributes and user-identity attributes to create traffic management policies.

For SSL traffic, the proxy verifies the origin server’s certificate and establishes a legitimate connection with the server. It then emulates the server certificate, signs it using a CA certificate installed on NetScaler, and presents the created server certificate to the client. You must add the CA certificate as a trusted certificate to the client’s browser for the SSL session to be successfully established.

The appliance supports the following transparent and explicit proxy modes:

  • explicit: In explicit proxy mode, the client must specify an IP address in their browser, unless the organization pushes the setting onto the client’s device. This address is the IP address of a proxy server that is configured on NetScaler. All client requests are sent to this IP address.

    For explicit proxy, you must configure a content switching virtual server of type PROXY and specify an IP address and a valid port number. Also, when the markconnReqInval parameter is set to ON globally on the default HTTP profile, then you must bind another HTTP profile with markconnReqInval set to OFF to the content switching virtual server.

    Example to bind a custom HTTP profile to the proxy content switching virtual server:

     add ns httpprofile custom_http_profile1 -markconnReqInval DISABLED
 set cs vserver swgVS -httpprofileName custom_http_profile1
 <!--NeedCopy-->

    Starting from 14.1-38.x release, NetScaler supports IPv6 DNS queries in the forward proxy for the domain that is hosted with only IPv6 address.

    Use the following command on the CLI to set the resolution order to first attempt an IPv4 (A) query, followed by an IPv6 (AAAA) query if the IPv4 query fails:

    set dns parameter -resolutionOrder AThenAAAAQuery

    In explicit mode, the NetScaler forward Proxy supports secure, encrypted communication between the client and the Forward Proxy entity. When configuring the Secure forward proxy on NetScaler, you must specify an IP address and port while choosing the SSL_PROXY type. This setup ensures that the client establishes an encrypted connection to the forward proxy entity. The client must manually specify the IP address and port in their browser unless the organization automates this configuration by pushing the settings to the client’s device. This process enables secure, encrypted communication between the client and the forward proxy.

    For more information, see Configure an SSL forward proxy in Secure mode by using the CLI and Configure an SSL forward proxy in Secure mode by using the GUI

  • transparent: A transparent proxy, as the name implies, is transparent to the client. That is, the clients might not be aware that a proxy server is mediating their requests. NetScaler is configured in an inline deployment, and transparently accepts all HTTP and HTTPS traffic. For transparent proxy, you must configure a content switching virtual server of type PROXY, with asterisks (* *) as the IP address and port. When using the SSL Forward Proxy Wizard in the GUI, you do not have to specify an IP address and port.

    Note

    To intercept protocols other than HTTP and HTTPS in transparent proxy mode, you must add a listen policy and bind it to the proxy server.

Configure an SSL forward proxy by using the CLI

At the command prompt, type:

add cs vserver <name> PROXY <ipaddress> <port>
<!--NeedCopy-->

Arguments:

Name:

Name for the proxy server. Must begin with an ASCII alphanumeric or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters. Cannot be changed after the CS virtual server is created.

The following requirement applies only to the CLI:

If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, “my server” or ‘my server’).

This argument is mandatory. Maximum Length: 127

IPAddress:

IP address of the proxy server.

Port:

Port number for the proxy server. Minimum value: 1

Example for explicit proxy:

add cs vserver swgVS PROXY 192.0.2.100 80
<!--NeedCopy-->

Example for transparent proxy:

add cs vserver swgVS PROXY * *
<!--NeedCopy-->

Add a listen policy to the transparent proxy server by using the GUI

  1. Navigate to Security > SSL Forward Proxy > Proxy Virtual Servers. Select the transparent proxy server and click Edit.
  2. Edit Basic Settings, and click More.
  3. In Listen priority, enter 1.

  4. In Listen Policy Expression, enter the following expression:

    (CLIENT.TCP.DSTPORT.EQ(80)||CLIENT.TCP.DSTPORT.EQ(443))
<!--NeedCopy-->

Note:

This expression assumes standard ports for HTTP and HTTPS traffic. If you have configured different ports, for example 8080 for HTTP or 8443 for HTTPS, modify the preceding expression to specify those ports.

Configure an SSL forward proxy in Secure mode by using the CLI

At the command prompt, type:

add cs vserver <name> SSL_PROXY <ipaddress> <port>

Bind ssl vserver <name> -certkeyName server_certkey
<!--NeedCopy-->

Arguments:

Name:

Name for the proxy server. Must begin with an ASCII alphanumeric or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters. Cannot be changed after the CS virtual server is created.

The following requirement applies only to the CLI:

If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, “my server” or ‘my server’).

This argument is mandatory. Maximum Length: 127

IPAddress:

IP address of the proxy server.

Port:

Port number for the proxy server. Minimum value: 1

serviceType:

The protocol type used by the virtual server. Choose SSL_PROXY.

Configure an SSL forward proxy in Secure mode by using the GUI

When using the SSL Forward Proxy Wizard in the GUI,

  1. Navigate to Configuration > Security > SSL Forward Proxy.
  2. In the Getting Started section, click the SSL Forward Proxy Wizard link.
  3. In the SSL Forward Proxy wizard, click Get Started and click Continue.
  4. In Protocol, choose SSL_PROXY and in Capture Mode, choose Explicit.
  5. Fill in other details and click Continue.
  6. Choose to add or edit the SSL profile and SSL certificate key pair, and click Continue.

Note:

SSL Interception is not supported with this SSL_PROXY in explicit mode.

Block privileged upstream ports

To block privileged upstream ports (<1024) access except ports 80 and 443 using forward proxy, bind the following responder policy to the forward proxy content switching virtual server in explicit mode.

Using the CLI

At the command prompt, type:

add responder policy web_only "(HTTP.REQ.METHOD.EQ(CONNECT) && (HTTP.REQ.HOSTNAME.PORT.LT(1024) && HTTP.REQ.HOSTNAME.PORT.NE(\":80\") && HTTP.REQ.HOSTNAME.PORT.NE(\":443\") && HTTP.REQ.HOSTNAME.PORT.LENGTH.NE(0))  || (HTTP.REQ.URL.AFTER_STR(\":\").TYPECAST_NUM_AT.NE(80) && 
HTTP.REQ.URL.AFTER_STR(\":\").TYPECAST_NUM_AT.NE(443) && HTTP.REQ.URL.AFTER_STR(\":\").TYPECAST_NUM_AT.LE(1024) ) )" RESET
bind cs vserver <proxy_vs_name> -policyName web_only -priority 9 -gotoPriorityExpression END -type REQUEST
<!--NeedCopy-->

Using the GUI

  1. Navigate to Security > SSL Forward Proxy > Proxy Virtual Servers.
  2. Add a proxy virtual server or select a virtual server and click Edit.
  3. In Advanced Settings, click Policies.
  4. In Choose Policy, select Responder. Click Continue.
  5. Click Add Binding.
  6. In Policy Binding, click Click to select.
  7. Click Add to add a new policy.
  8. Give the policy name, select the action as RESET, and update the expression accordingly for the GUI.
  9. Click Create.
  10. Click Select.
  11. Under Policy Binding, assign a priority and click Bind.
  12. Click Close.
  13. Click Done.
Proxy modes
December 16, 2024
Contributed by: 
C C
December 16, 2024
Contributed by: 
C C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.