Proxy modes

The Citrix Secure Web Gateway (SWG) appliance acts as a client’s proxy to connect to the internet and SaaS applications. As a proxy, it accepts all the traffic and determines the traffic’s protocol. Unless the traffic is HTTP or SSL, it is forwarded to the destination as is. When the appliance receives a request from a client, it intercepts the request and performs some actions, such as user authentication, site categorization, and redirection. It uses policies to determine which traffic to allow and which traffic to block.

The appliance maintains two different sessions, one between the client and the proxy and the other between the proxy and the origin server. The proxy relies on customer defined policies to allow or block HTTP and HTTPS traffic. Therefore, it is important that you define policies to bypass sensitive data, such as financial information. The appliance offers a rich set of Layer 4 to Layer 7 traffic attributes and user-identity attributes to create traffic management policies.

For SSL traffic, the proxy verifies the origin server’s certificate and establishes a legitimate connection with the server. It then emulates the server certificate, signs it using a CA certificate installed on Citrix SWG, and presents the created server certificate to the client. You must add the CA certificate as a trusted certificate to the client’s browser in order for the SSL session to be successfully established.

The appliance supports transparent and explicit proxy modes. In explicit proxy mode, the client must specify an IP address in their browser, unless the organization pushes the setting onto the client’s device. This address is the IP address of a proxy server that is configured on the SWG appliance. All client requests are sent to this IP address. For explicit proxy, you must configure a content switching virtual server of type PROXY and specify an IP address and a valid port number.

Transparent proxy, as the name implies, is transparent to the client. That is, the clients might not be aware that a proxy server is mediating their requests. The SWG appliance is configured in an inline deployment, and transparently accepts all HTTP and HTTPs traffic. For transparent proxy, you must configure a content switching virtual server of type PROXY, with asterisks (* *) as the IP address and port. When using the Secure Web Gateway wizard in the GUI, you do not have to specify an IP address and port.

Note

To intercept protocols other than HTTP and HTTPS in transparent proxy mode, you must add a listen policy and bind it to the proxy server.

Configure SSL forward proxy by using the Citrix SWG CLI

At the command prompt, type:

add cs vserver <name> PROXY <ipaddress> <port>
<!--NeedCopy-->

Arguments:

Name:

Name for the proxy server. Must begin with an ASCII alphanumeric or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters. Cannot be changed after the CS virtual server is created.

The following requirement applies only to the CLI:

If the name includes one or more spaces, enclose the name in double or single quotation marks (for example, “my server” or ‘my server’).

This is a mandatory argument. Maximum Length: 127

IPAddress:

IP address of the proxy server.

port:

Port number for proxy server. Minimum value: 1

Example for explicit proxy:

add cs vserver swgVS PROXY 192.0.2.100 80
<!--NeedCopy-->

Example for transparent proxy:

add cs vserver swgVS PROXY * *
<!--NeedCopy-->

Add a listen policy to the transparent proxy server by using the Citrix SWG GUI

1. Navigate to Secure Web Gateway > Proxy Servers. Select the transparent proxy server and click Edit.
2. Edit Basic Settings, and click More.
3. In Listen priority, enter 1.

4. In Listen Policy Expression, enter the following expression:

   (CLIENT.TCP.DSTPORT.EQ(80)||CLIENT.TCP.DSTPORT.EQ(443))
   <!--NeedCopy-->
   

Note

This expression assumes standard ports for HTTP and HTTPS traffic. If you have configured different ports, for example 8080 for HTTP or 8443 for HTTPS, modify the above expression to specify those ports.