Configuring Proxy and Authenticated Proxy per Web Application on Mobile Access Gateway

Product: Mobile Access / SSL VPN
Version: R77.20 (EOS), R77.30 (EOS), R80.10 (EOS), R80.20 (EOS), R80.30 (EOS), R80.40 (EOS), R81 (EOS), R81.10 (EOS), R81.20
OS: Gaia
Last Modified: 2023-06-06

Solution

Prerequisites:

1. In SmartConsole, configure the Host object that represents the Proxy Server.
2. If the proxy server listens on a non-standard port, then configure the applicable TCP service object.

Procedure:
01. Back up the Security Management Server / Domain Management Server.

Refer to:
- sk108902 - Best Practices - Backup on Gaia OS
- sk91400 - System Backup and Restore feature in Gaia
- sk98153 - How to take a snapshot of Endpoint Security Management Server database
02. Close all SmartConsole windows.

Verify by running the " cpstat mg" command on the Security Management Server / in the context of each Domain Management Server.

3. Connect with Database Tool (GuiDBedit Tool) to the Security Management Server / Domain Management Server.

4. In the upper left pane, go to Table > Other > network_applications.

5. In the upper right pane, select the applicable Web Application object (Class Name "connectra_web_application).

6. Press CTRL+F (or go to Search menu > Find) > paste proxy_server > click Find Next.

7. In the lower pane, below the attribute proxy_server, configure the applicable values in the nested attributes:

Notes:
- To edit an attribute value:
1. Right-click the attribute > select Edit
2. Enter or select the applicable value
3. Click OK
- Available attributes when configuring an Authenticated HTTP / HTTPS Proxy per Web Application:

| Attribute | Description | | --- | --- | | use_the_gw_general_proxy_settings | Specifies whether this Web Application uses the proxy settings on the Mobile Access Gateway (this is the main "on-off" switch):
- Value " true" specifies to ignore all other nested attributes in the attribute proxy_server.
- Value " false" specifies to use the configured proxy server settings. | | http_proxy_credentials | Configures the Proxy Server Credentials.
Important - If below the attribute http_proxy_credentials, there are no nested attributes password and username, then:
1. Right-click the attribute http_proxy_credentials > select Edit
2. Do not edit the default value
3. Just click OK
Notes:
- To use credentials for an HTTP Proxy, you must configure the value true for the attribute use_credentials_for_http_proxy.
- To use credentials for an HTTPS Proxy, you must configure the value true for the attribute use_credentials_for_https_proxy.
- To configure the password in plain-text:
1. Right-click the attribute password > select Edit
2. Enter the applicable password
3. Click OK
- To configure the password as an obfuscated string:
1. Connect to the command line on the Mobile Access Gateway / each Mobile Access cluster member.
2. Log in to the Expert mode.
3. Get the obfuscated string for your password:

$CVPNDIR/bin/obfuscate_password <Proxy Server Password in plain-text>
4. Right-click the attribute password > select Edit
5. Enter the applicable password as an obfuscated string
6. Click OK
- To configure the username:
1. Right-click the attribute username > select Edit
2. Enter the applicable username
3. Click OK | | use_http_proxy | Specifies whether this Web Application uses the configured HTTP proxy:
- Value " true" specifies to use the configured HTTP proxy.
- Value " false" specifies not to use the configured HTTP proxy, even if it is configured on the Mobile Access Gateway. | | use_https_proxy | Specifies whether this Web Application uses the configured HTTPS proxy:
- Value " true" specifies to use the configured HTTPS proxy.
- Value " false" specifies not to use the configured HTTPS proxy, even if it is configured on the Mobile Access Gateway. | | http_proxy_host | Specifies the HTTP Proxy Server.
1. In the Table field, select network_objects.

2. In the Object field, select the applicable host object (you created earlier in SmartConsole) that represents this HTTP Proxy Server.

Note: If the field is empty, then enter the host object name exactly as it appears in SmartConsole. | | https_proxy_host | Specifies the HTTPS Proxy Server.
1. In the Table field, select network_objects.

2. In the Object field, select the applicable host object (you created earlier in SmartConsole) that represents this HTTPS Proxy Server.

Note: If the field is empty, then enter the host object name exactly as it appears in SmartConsole. | | http_proxy_service | Specify the port on the HTTP Proxy Server.
1. In the Table field, select services.

2. In the Object field, select the applicable service object.

Note: If the field is empty, then enter the service object name exactly as it appears in SmartConsole. | | https_proxy_service | Specify the port on the HTTPS Proxy Server.
1. In the Table field, select services.

2. In the Object field, select the applicable service object.

Note: If the field is empty, then enter the service object name exactly as it appears in SmartConsole. | | use_credentials_for_http_proxy | Specifies whether to use login credentials for the configured HTTP Proxy Server:
- Value " true" specifies to use the login credentials.
- Value " false" specifies not to use the login credentials. | | use_credentials_for_https_proxy | Specifies whether to use login credentials for the configured HTTPS Proxy Server:
- Value " true" specifies to use the login credentials.
- Value " false" specifies not to use the login credentials. | 08. Save the changes: go to the File menu > click Save All.

9. Close the Database Tool (GuiDBedit Tool).

10. Connect with SmartConsole to the Security Management Server / Domain Management Server.

11. Install the Access Control Policy onto the applicable Mobile Access Gateway / Cluster object.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access Level: General
Status: Approved by TAC
Date Created: 2008-04-16
Last Modified: 2023-06-06