Product Guide Revision A. McAfee Client Proxy 2.3.2

Transcription

1 Product Guide Revision A McAfee Client Proxy 2.3.2

2 COPYRIGHT Copyright 2017 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Client Proxy Product Guide

3 Contents 1 Product overview 5 What is the Web Protection hybrid solution? How Client Proxy works Client Proxy metadata Integration with Endpoint Security Managing Client Proxy policies 9 Users and permission sets Configuring the policy areas How Client Proxy manages the proxy server list Configure the proxy server list Client configuration Configure the client settings Configure the bypass list Configure the block list Assign the policy to the endpoint computers Export the policy to an.xml or.opg file Working with end users View information about Client Proxy on a Windows-based computer View information about Client Proxy on an OS X computer Suspending policy enforcement Index 17 McAfee Client Proxy Product Guide 3

4 Contents 4 McAfee Client Proxy Product Guide

5 1 Product overview McAfee Client Proxy is endpoint client software for Microsoft Windows and Mac OS X that is an essential component of the McAfee Web Protection hybrid deployment solution. The Client Proxy technology allows you to apply your organization's web security policy to an endpoint computer, whether it is located inside or outside your network. Contents What is the Web Protection hybrid solution? How Client Proxy works Integration with Endpoint Security What is the Web Protection hybrid solution? The hybrid solution allows organizations to switch between the network-based and cloud-based security solutions provided by McAfee Web Gateway and McAfee Web Gateway Cloud Service (McAfee WGCS), respectively. Web gateways and other appliances do not protect equipment after it leaves your organization's network. For example, when users in your organization take laptops on business trips or work from home, they leave the network's secure zone. Client Proxy is installed on the computers of end users in your organization. Using the location-awareness settings that you configure, Client Proxy determines whether the computers are located inside or outside your network or are connected to your network by VPN. In a hybrid deployment, Client Proxy lets web requests sent by users working inside the network or connected to the network by VPN pass. These requests are automatically redirected for filtering to a Web Gateway appliance installed on the network. Web requests sent by users working outside the network, on the other hand, are redirected to McAfee WGCS for filtering. For more information about the hybrid solution, see the McAfee Web Protection Hybrid Deployment Guide. End-user computers are referred to as endpoint computers. McAfee Client Proxy Product Guide 5

6 1 Product overview How Client Proxy works How Client Proxy works Using location-awareness settings, Client Proxy protects the computers of end users in your organization, whether they are located inside or outside your network. Client Proxy software redirects, blocks, or lets pass web traffic and network communications according to the policy you configure and location of the endpoint computer. Figure 1-1 Client Proxy workflow When an end user is working inside your organization's network, Client Proxy software: 1 Recognizes that the end user is working inside your organization's network 2 Remains passive, allowing web traffic and network communications to pass to Web Gateway for filtering When an end user is working outside your organization's network, Client Proxy software: 1 Recognizes that the end user is working outside your organization's network 2 Redirects all web traffic and network communications to the McAfee WGCS service Client Proxy metadata When the Client Proxy software redirects HTTP/HTTPS traffic, it adds metadata to the requests. Proxy server administrators configure and apply policies based on the values in the metadata: 6 McAfee Client Proxy Product Guide

7 Product overview Integration with Endpoint Security 1 Authentication tokens User groups Authentication version Client IP address Customer ID Original destination IP address User ID The authentication version is the version of the metadata that Client Proxy shares with the proxy server. Integration with Endpoint Security Client Proxy is available as a standalone product or integrated with Endpoint Security. When integrated, Client Proxy joins the Endpoint Security family, including: McAfee Endpoint Security Threat Prevention McAfee Endpoint Security Firewall McAfee Endpoint Security Web Control Whether standalone or integrated, Client Proxy is managed using McAfee epo and the management tasks are the same. When Client Proxy is integrated with Endpoint Security: 1 The client software package is deployed to the endpoint and installed as a module on the Endpoint Solution Platform. 2 The administrator can configure Web Control so that it is disabled while Client Proxy is installed and running. On a Windows-based computer, you can view the integration status of Client Proxy by opening the About McAfee Client Proxy window. If EspMode is set to ON, Client Proxy is installed and running on the Endpoint Security Platform. McAfee Client Proxy Product Guide 7

8 1 Product overview Integration with Endpoint Security 8 McAfee Client Proxy Product Guide

9 2 2 Managing Client Proxy policies In the McAfee epo management console, you configure and manage Client Proxy policies. Contents Users and permission sets Configuring the policy areas Assign the policy to the endpoint computers Export the policy to an.xml or.opg file Working with end users Users and permission sets We recommend creating specific administrator roles and permissions in McAfee epo for the Client Proxy catalog administrator. McAfee epo defines roles and permissions in terms of Permission Sets. A default permission set installed with the product, MCP Catalog Admin, gives the Client Proxy administrator view and change permissions for policies and certain Common Catalog items and actions. You can also assign an auditor role by adding view permission to one of the existing reviewer permission sets, or by creating a new permission set. You assign users to permission sets using Active Directory. Configuring the policy areas Client Proxy policy configuration includes these areas: the proxy servers list, client configuration, the bypass list, and the block list. McAfee Client Proxy Product Guide 9

10 2 Managing Client Proxy policies Configuring the policy areas Tasks How Client Proxy manages the proxy server list on page 10 When configuring proxy servers for a Client Proxy policy, consider how Client Proxy manages the proxy server list. Configure the proxy server list on page 11 To redirect web requests to a proxy server, configure the proxy server list and rules. Client configuration on page 12 Client Proxy uses the Client Configuration settings to identify the customer and determine whether endpoint computers are located inside or outside the network. Configure the client settings on page 12 Configure the settings that Client Proxy uses to identify the customer and determine whether endpoint computers are located inside or outside the network. Configure the bypass list on page 12 Configure the McAfee Common Catalog instance that Client Proxy uses to determine which network traffic is allowed to bypass the proxy server. Configure the block list on page 13 Configure the list of processes running on endpoint computers that are blocked from accessing the network. How Client Proxy manages the proxy server list When configuring proxy servers for a Client Proxy policy, consider how Client Proxy manages the proxy server list. The Client Proxy software maintains an ordered list of proxy servers. The proxy server with the fastest response time is placed at the top of the list. The software updates the list from time to time. For example, the list is updated when the user starts the computer or the Client Proxy policy changes. It is also updated if the VPN connection breaks or a proxy server fails to respond. At these times, the software tests the connections to all proxy servers and reorders the list based on response times. If redirection to the proxy server at the top of the list fails, the software tries redirecting to the second proxy server in the list. At the same time, the software tests the proxy server connections again and updates the list. When configuring how the Client Proxy software selects the next proxy server from the list, you have these options: connect to the first accessible Proxy Server based on their order in the list below The software selects the next proxy server from the list that you configure. connect to the Proxy Server that has the fastest response time The software selects the next proxy server from the list that it maintains, which is based on response time. Auto proxy switchover When this option is enabled, the software checks the proxy server list at the interval you specify. If a higher priority proxy server is available, the software automatically switches to it. The auto proxy switchover option is only available when connect to the first accessible Proxy Server based on their order in the list below is selected. 10 McAfee Client Proxy Product Guide

11 Managing Client Proxy policies Configuring the policy areas 2 Configure the proxy server list To redirect web requests to a proxy server, configure the proxy server list and rules. When Client Proxy is deployed on-premise, you configure one or more Web Gateway appliances installed on your network as the proxy servers. To save the policy, you must configure at least one proxy server, and the configuration must include an IP address or host name and a port number. Task 1 From the McAfee epo menu, select Policy Policy Catalog. 2 From the Product drop-down list, select the current version of Client Proxy. 3 To configure a policy, click the policy's name. 4 From the Client Proxy Settings menu, select Proxy Servers. 5 To specify how Client Proxy selects a proxy server from the list, choose an option: connect to the first accessible Proxy Server based on their order in the list below connect to the Proxy Server which has the fastest response time 6 To add proxy servers to the Proxy Server List, configure these settings, then click Add. Proxy Server Address Specify the IP address or host name of the proxy server. Proxy Port Specify the port number of the proxy server. HTTP/HTTPS Select this checkbox to redirect all web requests sent to ports 80 and 443 to a proxy server. Non-HTTP/HTTPS Redirected Ports Specify the port numbers of protocols other than HTTP/HTTPS whose requests you want redirected. Verify that the proxy server supports these protocols. Using the icons in the Actions column, you can edit, delete, or change the order of the proxy servers in the list. 7 Select Enable Auto proxy switch over to enable this option, then specify a value for the Polling interval in this range: seconds. Recommended value: 60 seconds The auto proxy switchover option is only available when connect to the first accessible Proxy Server based on their order in the list below is selected. 8 In the Specify additional ports that you would like to redirect as HTTP/HTTPS traffic field, specify the numbers of other ports whose web requests you want redirected like HTTP/HTTPS traffic. For example, you can redirect requests sent to an application the same as requests sent to a web browser. 9 Deselect Bypass proxy server for local addresses to redirect all web requests, including those sent to local addresses inside your organization's network, to a proxy server. 10 Click Save. The configured proxy server list and redirection rules are saved. McAfee Client Proxy Product Guide 11

12 2 Managing Client Proxy policies Configuring the policy areas Client configuration Client Proxy uses the Client Configuration settings to identify the customer and determine whether endpoint computers are located inside or outside the network. Customer Identifier Client Proxy uses the customer ID and shared password to identify the customer and apply the customer's policy. Traffic Redirection Settings Client Proxy uses this setting to determine when to redirect network traffic to the configured proxy servers. Corporate Network Detection Client Proxy uses this setting to determine whether the endpoint computer is located inside or outside the network. Corporate VPN Detection Client Proxy uses this setting to determine whether the endpoint computer is connected to the network through the VPN. Active Directory Groups Filter Client Proxy uses the regular expressions that you configure to filter the list of Active Directory groups included sent to the proxy server. Log File Settings (OS X Only) Depending on this setting, Client Proxy logs error messages to a log file on each endpoint computer. Access Protection (Windows Only) Depending on this setting, Client Proxy is protected from unauthorized removal or tampering by end users. Configure the client settings Configure the settings that Client Proxy uses to identify the customer and determine whether endpoint computers are located inside or outside the network. Task 1 From the McAfee epo menu, select Policy Policy Catalog. 2 From the Product drop-down list, select the current version of Client Proxy. 3 To configure a policy, click the policy's name. 4 From the Client Proxy Settings menu, select Client Configuration. 5 In the Customer Identifier section, click Browse, select the ID file, then click Open. This file is provided by the Web Gateway or McAfee WGCS administrator. The Unique Customer ID and Shared Password fields are automatically populated. 6 Configure the remaining options. Configure the bypass list Configure the McAfee Common Catalog instance that Client Proxy uses to determine which network traffic is allowed to bypass the proxy server. Each Client Proxy policy has a Common Catalog instance associated with it. The catalog is a list that you configure and that Client Proxy uses to determine which network traffic bypasses the proxy server. The bypass list can include domain names, network addresses, network ports, and the names of processes that endpoint computers are allowed to access directly. Updating the bypass list in McAfee epo also updates the Common Catalog instance associated with the policy. Process names can be in Microsoft Windows format (test.exe) or Mac OS X format (test). 12 McAfee Client Proxy Product Guide

13 Managing Client Proxy policies Configuring the policy areas 2 Task 1 From the McAfee epo menu, select Policy Policy Catalog. 2 From the Product drop-down list, select the current version of Client Proxy. 3 To configure a policy, click the policy's name. 4 From the Client Proxy Settings menu, select Bypass List. 5 In the Bypass List window: From the Actions menu, select Add bypass list item, then select an item type. The Choose from existing values dialog box opens. 6 Do one of the following: Select one or more existing catalog items. Click New Item, enter the new information, then click Save. 7 Click OK. Configure the block list Configure the list of processes running on endpoint computers that are blocked from accessing the network. Each Client Proxy policy has a list of blocked processes associated with it. The block list is designed to reduce the amount of unwanted traffic that is redirected to the proxy server for filtering. Occasionally, the block list can restrict access to Internet resources, where the restriction was not intended. Task 1 From the McAfee epo menu, select Policy Policy Catalog. 2 From the Product drop-down list, select the current version of Client Proxy. 3 To configure a policy, click the policy's name. 4 From the Client Proxy Settings menu, select Block List. 5 Select an option: Allow traffic to go directly to destination No processes are blocked. Block traffic for all processes (except bypass listed processes) All processes are blocked except for processes whose names are on the bypass list. These processes are allowed to access the network directly. Block traffic only for the following processes To configure the list of processes that you want blocked, enter the process names, clicking Add after each entry. Windows process names must end with the.exe extension. Mac process names can be specified without the extension. 6 Click Save. McAfee Client Proxy Product Guide 13

14 2 Managing Client Proxy policies Assign the policy to the endpoint computers Assign the policy to the endpoint computers Using McAfee epo, assign the Client Proxy policy to specified endpoint computers in your organization's network. Task 1 From the McAfee epo menu, select Systems System Tree. 2 From the System Tree menu, select a group or subgroup. 3 Click the Assigned Policies tab. 4 From the Product drop-down list, select the current version of McAfee Client Proxy. 5 In the Actions column, click Edit Assignment. The Policy Assignment for My Organization window appears. 6 Next to Inherit from, select Break inheritance and assign the policy and settings below. 7 From the Assigned policy drop-down list, select the policy. 8 Choose whether or not to lock policy inheritance. 9 Click Save. Assign a Client Task to schedule the policy deployment to the endpoints. Export the policy to an.xml or.opg file You can export the Client Proxy policy to an.xml file for troubleshooting or to an.opg file for import by client computers in your organization. Task 1 From the McAfee epo menu, select Policy Policy Catalog. 2 From the Product drop-down list, select the current version of Client Proxy. 3 To export a policy, click the policy's name. The Client Proxy Settings pane opens. 4 From the Actions drop-down list, select Export Policy to File. The Export Policy to File dialog box opens. 5 Click a link: McAfee Client Proxy Policy Server File Exports the policy to a.xml file that you can use for troubleshooting. McAfee Client Proxy Policy Client File Exports the policy to a.opg file that can be imported by client computers in your organization. 6 Save the file. 7 Click OK. 14 McAfee Client Proxy Product Guide

15 Managing Client Proxy policies Working with end users 2 Working with end users End users can view information about Client Proxy on their computers or temporarily suspend policy enforcement by contacting a McAfee Help Desk administrator. View information about Client Proxy on a Windows-based computer On an endpoint computer running Windows, you can view information about the Client Proxy software, policy, and status. Task 1 On a Windows-based computer, click Start All Programs McAfee, then click About McAfee Client Proxy. 2 In the McAfee Client Proxy window, you can view the following information: Version Number Specifies the version and build number of the Client Proxy software installed on the endpoint computer. Active Proxy Specifies the address of the proxy server to which Client Proxy is redirecting traffic. Connection Status Specifies whether the endpoint computer is connected to the network. EspMode Specifies whether Client Proxy is installed and running on the Endpoint Solution Platform. Policy Name Specifies the name of the policy that Client Proxy is applying. Policy Revision Specifies the revision number of the policy that Client Proxy is applying. Policy Timestamp Specifies the time when the Client Proxy policy was deployed to the endpoint computer. Status Specifies whether Client Proxy is working in active or passive mode. 3 To close the window, click Ok. View information about Client Proxy on an OS X computer On an endpoint computer running OS X, you can view information about the Client Proxy software, policy, and status. Task 1 On an OS X computer, click the McAfee menulet and select About McAfee Endpoint Protection for Mac. In the Client Proxy section, the following information is displayed: Client Proxy version and build number Policy modified date Policy name Proxy server Policy revision 2 Verify that you are connected to the proxy server: From the menulet, select the dashboard. This message is displayed: Client Proxy: Redirecting. Suspending policy enforcement End users can request permission to access or transfer sensitive information for a limited time. Occasionally, there is a legitimate business reason to temporarily suspend the security policy so that sensitive information can be accessed or transferred. Client Proxy uses a challenge-response mechanism to perform this function. McAfee Client Proxy Product Guide 15

16 2 Managing Client Proxy policies Working with end users The end user sends a request to an administrator, including the policy revision number and identification code displayed in the Enter Release Code dialog box. Using this information and the McAfee Help Desk software, the administrator creates a release code and then sends it to the end user. The release code is valid for a limited time, and the time allowed for policy suspension is limited as well. Thus, the end user must enter the release code in the dialog box and complete the task that requires policy suspension before the allowed time period expires. Best practice: Removing the software from endpoint computers Client Proxy software cannot be removed from endpoint computers without authorization. Usually, the administrator uninstalls the software using McAfee epo. If McAfee epo is not available and the endpoint computer is running Windows, the administrator can uninstall the software using the Windows Add or Remove Programs tool. In this case, the administrator uses the challenge-response mechanism to generate the release key. Generate a release code To temporarily suspend policy enforcement on endpoint computers, users request a bypass release code from a Client Proxy administrator. Using Help Desk software, administrators create a release code and send it to the end user. Task 1 To request a bypass release code on an endpoint computer, do one of the following: On Mac OS X computers: From the McAfee menulet on the status bar, select McAfee Endpoint Protection for Mac Preferences, then select Client Proxy. On computers running Windows: Click Start All Programs McAfee, then click Bypass McAfee Client Proxy. The McAfee Client Proxy Enter Release Code dialog box opens. While you are waiting for the administrator to send the release code, leave this dialog box open. If you close it, you must start the procedure over. 2 Copy the number in the Policy Revision field and the code in the Identification field, send these values to your administrator, and include your user name and address. 3 When your administrator sends the release code, enter the code in the Release field, then do one of the following: On Mac OS X computers: Click Release. On computers running Windows: Click OK. Policy enforcement is suspended for the time period specified by the administrator when creating the code. 16 McAfee Client Proxy Product Guide

17 Index A access protection 12 Windows 12 Active Directory groups filter 12 Active Directory groups 12 authentication tokens 6 authentication version 6 B block list configuring 13 bypass list configuring 12 C challenge-response mechanism 15 client configuration 12 Client Proxy assigning a policy 14 how the software works 6 integrated with Endpoint Security 7 managing the proxy server list 10 metadata 6 Client Proxy software removing from endpoint computers 15 Client Proxy, about viewing on a Windows-based computer 15 viewing on an OS X computer 15 client settings configuring 12 Common Catalog 12 corporate network and VPN detection 12 corporate network detection 12 corporate VPN detection 12 customer ID 6, 12 E Endpoint Solution Platform 7 EspMode 7 H hybrid solution 5 I IP addresses client and original destination 6 L log file settings 12 OS X 12 M McAfee WGCS configuring as the proxy server 11 metadata Client Proxy 6 P permission sets 9 policies Client Proxy 14 exporting to an.xml or.opg file 14 suspending 15 policy areas configuring 9 processes blocking 13 proxy server list configuring 11 how Client Proxy manages 10 R release codes generating 16 S shared password 12 T traffic redirection 12 traffic redirection settings 12 McAfee Client Proxy Product Guide 17

18 Index U user groups 6 user ID 6 W Web Gateway appliances configuring as proxy servers 11 Web Protection hybrid solution 5 Web Control 7 18 McAfee Client Proxy Product Guide

19 0A00