McAfee Client Proxy Product Guide. (McAfee epolicy Orchestrator)

Transcription

1 McAfee Client Proxy Product Guide (McAfee epolicy Orchestrator)

2 COPYRIGHT Copyright 2018 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Client Proxy Product Guide Product Guide

3 Contents 1 Product overview 5 Overview of Client Proxy How Client Proxy works Client Proxy metadata Integration with Endpoint Security Managing Client Proxy policies 9 Configure the user permission setting for Client Proxy policies Configure a policy How Client Proxy manages the proxy server list Configure the proxy server list Client configuration Configure the client settings Configure the bypass list Configure the block list Assign the policy to the endpoints Export the policy to an.xml or.opg file Access information about Client Proxy on Windows-based endpoints Access information about Client Proxy on Mac OS X or macos endpoints Suspending policy enforcement Temporarily suspend policy enforcement Index 17 McAfee Client Proxy Product Guide Product Guide 3

4 Contents 4 McAfee Client Proxy Product Guide Product Guide

5 1 1 Product overview Contents Overview of Client Proxy How Client Proxy works Integration with Endpoint Security Overview of Client Proxy McAfee Client Proxy is client software installed on the endpoints in your organization running Microsoft Windows, Mac OS X, or macos. Location awareness Web gateways and other appliances do not protect endpoints after they leave your organization's network. For example, when users in your organization take laptops on business trips or work from home, they leave the network's secure zone. Using location-awareness settings that you configure, the Client Proxy software determines whether the endpoint is located inside or outside the network or is connected to the network by VPN. The Web Protection hybrid solution Client Proxy is an essential component of the McAfee Web Protection hybrid solution. This solution allows you to use the network-based and the cloud-based security solutions provided by McAfee Web Gateway and McAfee Web Gateway Cloud Service (McAfee WGCS), respectively. In the hybrid solution, the Client Proxy software allows web traffic sent from endpoints inside the network or connected by VPN to continue to a Web Gateway appliance installed on the network, where it is filtered. The software redirects web traffic sent from endpoints outside the network to McAfee WGCS for filtering. McAfee Client Proxy Product Guide Product Guide 5

6 1 Product overview How Client Proxy works How Client Proxy works Using location-awareness settings, Client Proxy protects the endpoints in your organization, whether they are located inside or outside the network. The software redirects, blocks, or lets web requests pass according to the policies you configure and the location of the endpoints. Figure 1-1 Client Proxy workflow 1 The Client Proxy software is installed on the endpoints in your organization. 2 Using McAfee epo or McAfee epo Cloud, the administrator creates a Client Proxy policy and assigns the policy to all managed endpoints. 3 Managed endpoints can be located inside your organization's network, connected to the network by VPN, or located outside the network. 4 Users working on the endpoints request access to web resources. 5 The software determines the user's location and then redirects the web request or lets it pass: Inside the network or connected by VPN Allows the web request to continue to a Web Gateway appliance installed on the network, where it is filtered. Client Proxy is passive. Outside the network Redirects the web request to McAfee WGCS for filtering. Client Proxy is active. 6 McAfee Client Proxy Product Guide Product Guide

7 Product overview Integration with Endpoint Security 1 Client Proxy metadata When the Client Proxy software redirects HTTP/HTTPS traffic, it adds metadata to the requests. You can configure and apply policies based on the values in the metadata: Authentication tokens User groups Authentication version Client IP address Customer ID Original destination IP address User ID The authentication version is the version of the metadata that Client Proxy shares with the proxy server. Integration with Endpoint Security Client Proxy is available as a standalone product or as a module integrated with McAfee Endpoint Security. As an integrated module, the software joins the Endpoint Security family, including: McAfee Endpoint Security Threat Prevention McAfee Endpoint Security Firewall McAfee Endpoint Security Web Control Whether a standalone product or integrated with Endpoint Security, Client Proxy is managed with McAfee epo and the management tasks are the same. When the software is integrated with Endpoint Security: 1 The client software package is deployed to the endpoints and installed as a module on the Endpoint Security platform. 2 The administrator can configure Web Control so that it is disabled while Client Proxy is installed and running. On a Windows-based endpoint, you can view the integration status of Client Proxy by opening the About McAfee Client Proxy window. If EspMode is set to ON, Client Proxy is installed as a module and running on the Endpoint Security platform. McAfee Client Proxy Product Guide Product Guide 7

8 1 Product overview Integration with Endpoint Security 8 McAfee Client Proxy Product Guide Product Guide

9 2 Managing 2 Client Proxy policies Contents Configure the user permission setting for Client Proxy policies Configure a policy Assign the policy to the endpoints Export the policy to an.xml or.opg file Access information about Client Proxy on Windows-based endpoints Access information about Client Proxy on Mac OS X or macos endpoints Suspending policy enforcement Configure the user permission setting for Client Proxy policies You can configure the permission setting for Client Proxy policies for each administrator role. A McAfee epo permission set is a set of permissions configured for a specified role. A default permission set named MCP Catalog Admin gives the administrator permission to view and change Client Proxy policies and tasks. The default permission set also gives the administrator permission to perform Common Catalog actions. 1 From the McAfee epo menu, select User Management Permission Sets. 2 Under Permission Sets, select a role. 3 In the list of permission sets, locate MCP Policy, the click Edit. 4 Select an option: No permissions The administrator cannot view or change Client Proxy policies or tasks. View policy and task settings The administrator can view, but not change Client Proxy policies and tasks. Select this option for the role of Client Proxy auditor. View and change policy and task settings The administrator can view and change Client Proxy policies and tasks. Select this option for the role of Client Proxy administrator. 5 Click Save. Configure a policy Contents How Client Proxy manages the proxy server list McAfee Client Proxy Product Guide Product Guide 9

10 2 Managing Client Proxy policies Configure a policy Configure the proxy server list Client configuration Configure the client settings Configure the bypass list Configure the block list How Client Proxy manages the proxy server list When configuring proxy servers for a Client Proxy policy, consider how the software manages the proxy server list. The Client Proxy software maintains an ordered list of proxy servers. The proxy server with the fastest response time is placed at the top of the list. The software updates the list from time to time. For example, the list is updated when the user starts the computer or the Client Proxy policy changes. It is also updated if the VPN connection breaks or a proxy server fails to respond. At these times, the software tests the connections to all proxy servers and reorders the list based on response times. If redirection to the proxy server at the top of the list fails, the software tries redirecting to the second proxy server in the list. At the same time, the software tests the proxy server connections again and updates the list. When configuring how the Client Proxy software selects the next proxy server from the list, you have these options: connect to the first accessible Proxy Server based on their order in the list below The software selects the next proxy server from the list that you configure. connect to the Proxy Server that has the fastest response time The software selects the next proxy server from the list that it maintains, which is based on response time. Auto-proxy switchover When this option is enabled, the software checks the proxy server list at the interval you specify. If a higher priority proxy server is available, the software automatically switches to it. The auto-proxy switchover option is only available when connect to the first accessible Proxy Server based on their order in the list below is selected. Configure the proxy server list To redirect web traffic to a proxy server, configure the proxy server list and rules. When Client Proxy is deployed on-premise, you configure at least one of the Web Gateway appliances installed on your network as the proxy server. Before you can save the policy, you must provide values for these settings: Proxy Servers page The IP address or host name of at least one proxy server and a port number Client Configuration page The customer ID and shared password 1 From the McAfee epo menu, select Policy Policy Catalog. 2 From the Product drop-down list, select the current version of Client Proxy. 3 To configure a policy, click the policy's name. 4 From the Client Proxy Settings menu, select Proxy Servers. 10 McAfee Client Proxy Product Guide Product Guide

11 Managing Client Proxy policies Configure a policy 2 5 To specify how the software selects a proxy server from the list, select an option: connect to the first accessible Proxy Server based on their order in the list below The software selects the next proxy server from the list that you configure. connect to the Proxy Server that has the fastest response time The software selects the next proxy server from the list that it maintains, which is based on response time. 6 To add proxy servers to the Proxy Server List, configure these settings, then click Add. Proxy Server Address Specifies the IP address or host name of the proxy server. Proxy Port Specifies the port number of the proxy server. HTTP/HTTPS Select this checkbox to redirect traffic sent to ports 80 and 443 to a proxy server. Non-HTTP/HTTPS Redirected Ports Specifies the port numbers of protocols other than HTTP/HTTPS whose traffic you want redirected. Verify that the proxy server supports these protocols. Using the icons in the Actions column, you can edit, delete, or change the order of the proxy servers in the list. 7 Select Enable Auto proxy switch over to enable this option, then specify a value for the Polling interval in this range: seconds. The recommended value is 60 seconds. The auto-proxy switchover option is only available when connect to the first accessible Proxy Server based on their order in the list below is selected. 8 In the Specify additional ports that you would like to redirect as HTTP/HTTPS traffic field, specify the numbers of other ports whose traffic you want redirected like HTTP/HTTPS traffic. For example, you can redirect traffic sent to an application. 9 Deselect Bypass proxy server for local addresses to redirect all traffic, including traffic sent to local addresses inside your organization's network, to a proxy server. Client configuration Client Proxy uses the Client Configuration settings to determine when to redirect web traffic and whether the endpoint is located inside the network, outside the network, or connected to the network by VPN. Customer Identifier With the shared password, identifies the customer and the customer's policy. Traffic Redirection Settings Determines when to redirect web traffic to the configured proxy servers. Corporate Network Detection Determines whether the endpoint is located inside or outside the network. Corporate VPN Detection Determines whether the endpoint is connected to the network through the VPN. Active Directory Groups Filter Using regular expressions that you configure, filters the list of Active Directory groups sent to the proxy server. Log File Settings (OS X Only) Determines whether error messages are logged to a file on each endpoint. Access Protection (Windows Only) Protects Client Proxy from unauthorized removal or tampering by users. McAfee Client Proxy Product Guide Product Guide 11

12 2 Managing Client Proxy policies Configure a policy Configure the client settings Configure the settings that Client Proxy uses to determine the location of the endpoint and when to redirect web traffic. 1 From the McAfee epo menu, select Policy Policy Catalog. 2 From the Product drop-down list, select the current version of Client Proxy. 3 To configure a policy, click the policy's name. 4 From the Client Proxy Settings menu, select Client Configuration. 5 In the Customer Identifier section, click Browse, select the ID file, then click Open. This file is provided by the Web Gateway or McAfee WGCS administrator. The Unique Customer ID and Shared Password fields are automatically populated. 6 Configure the remaining client settings. Configure the bypass list Client Proxy allows web traffic that matches the items on the bypass list to bypass the proxy server and go directly to the Internet. To configure the bypass list, select the following types of items from the McAfee Common Catalog instance that is linked to the Client Proxy policy: Domain Name Network Address Network Port Process List A process list is a list of processes that run on the endpoints. Windows process names must end with.exe. Mac OS X or macos process names do not require a file name extension. You can also select McAfee Default catalog items and add them to the bypass list. 1 From the McAfee epo menu, select Policy Policy Catalog. 2 From the Product drop-down list, select the current version of Client Proxy. 3 To configure a policy, click the policy's name. 4 From the Client Proxy Settings menu, select Bypass List. 5 In the Bypass List pane: From the Actions drop-down list, select Add bypass list item, then select an item type. 12 McAfee Client Proxy Product Guide Product Guide

13 Managing Client Proxy policies Assign the policy to the endpoints 2 6 In the Choose from existing values dialog box, choose from these options: Filter the list of catalog items Type a string value in the Filter items field, then click GO. Only catalog items matching the string value are shown. Create a catalog item Click New Item, enter the information, then click Save. The catalog item is added to the list. Select a catalog item Select the catalog items that you want added to the bypass list. 7 Click OK. The selected catalog items are added to the bypass list. Configure the block list Each Client Proxy policy has a list of blocked processes associated with it. The block list is designed to reduce the amount of traffic that is redirected to the proxy server for filtering. Occasionally, the block list can restrict access to Internet resources, when the restriction is not intended. Configure the list of processes running on the endpoints that are blocked from accessing the network. A process list is a list of processes that run on the endpoints. Windows process names must end with.exe. Mac OS X or macos process names do not require a file name extension. 1 From the McAfee epo menu, select Policy Policy Catalog. 2 From the Product drop-down list, select the current version of Client Proxy. 3 To configure a policy, click the policy's name. 4 From the Client Proxy Settings menu, select Block List. 5 Select an option: Allow traffic to go directly to destination All processes are allowed to access the Internet without going through a proxy server. Block traffic for all processes (except bypass listed processes) All processes are blocked from accessing the Internet except for processes on the bypass list. Block traffic only for the following processes To configure this list, use the Add, Edit, and Delete functions. 6 Click Save. The Client Proxy policy is saved. Assign the policy to the endpoints Using McAfee epo, assign the Client Proxy policy to the endpoints in your organization. 1 From the McAfee epo menu, select Systems System Tree. 2 Select the organizational level where you want the policy assigned. To select all endpoints managed by your platform, select My Organization. McAfee Client Proxy Product Guide Product Guide 13

14 2 Managing Client Proxy policies Export the policy to an.xml or.opg file 3 Click Assigned Policies. 4 From the Product drop-down list, select the current version of McAfee Client Proxy. 5 In the Actions column, click Edit Assignment on the same line as the policy you want to assign. 6 For Inherit from, select Break inheritance and assign the policy and settings below. 7 From the Assigned policy drop-down list, select the policy. 8 Select an option for Lock policy inheritance: Unlocked A different policy can be assigned to one or more subgroups. Locked This policy must be assigned to all subgroups. 9 Click Save. Export the policy to an.xml or.opg file You can export the Client Proxy policy to an.xml file for troubleshooting or to an.opg file for import by the endpoints in your organization. 1 From the McAfee epo menu, select Policy Policy Catalog. 2 From the Product drop-down list, select the current version of Client Proxy. 3 To export a policy, click the policy's name. 4 From the Actions drop-down list, select Export Policy to File. 5 Click a link: McAfee Client Proxy Policy Server File Exports the policy to a.xml file that you can use for troubleshooting. McAfee Client Proxy Policy Client File Exports the policy to a.opg file that can be imported by the endpoints in your organization. 6 Save the file. 7 Click OK. Access information about Client Proxy on Windows-based endpoints For troubleshooting purposes, you can ask users in your organization to provide information about the Client Proxy software installed on endpoints running Windows. 1 On a Windows-based endpoint, click Start All Programs McAfee, then click About McAfee Client Proxy. 2 In the McAfee Client Proxy window, view this information: Version Number Specifies the version and build number of the client software installed on the endpoints. Active Proxy Specifies the address of the proxy server where the client software is redirecting traffic. Connection Status Specifies whether the endpoint is connected to the network. 14 McAfee Client Proxy Product Guide Product Guide

15 Managing Client Proxy policies Access information about Client Proxy on Mac OS X or macos endpoints 2 EspMode Specifies whether Client Proxy is installed and running on the Endpoint Solution Platform. Policy Name Specifies the name of the policy that the client software is applying. Policy Revision Specifies the revision number of the policy that the client software is applying. Policy Timestamp Specifies the time when the policy was deployed to the endpoints. Status Specifies whether Client Proxy is working in active or passive mode. 3 To close the window, click Ok. Access information about Client Proxy on Mac OS X or macos endpoints For troubleshooting purposes, you can ask users in your organization to provide information about the Client Proxy software installed on Mac OS X or macos endpoints. 1 On a Mac OS X or macos endpoint, click the McAfee menulet, then select About McAfee Endpoint Protection for Mac. 2 In the Client Proxy section, view this information: Version and build number of the client software Policy name Policy revision Policy modified date Proxy server 3 To verify that you are connected to the proxy server: From the menulet, select the dashboard. This message is displayed: Client Proxy: Redirecting. Suspending policy enforcement You can suspend policy enforcement on an endpoint for a limited time, so that the user can access or transfer sensitive information for an approved business reason. To temporarily suspend policy enforcement, you and the user follow a challenge-response procedure: 1 The user sends you a request, which includes the policy revision number and an identification code. 2 Using this information and the McAfee Help Desk software, you generate a release code and send it to the user. 3 The user enters the release code, which is valid for a limited time, and completes the task requiring policy suspension in the time that you specified. Best practice: Using McAfee epo to remove Client Proxy from the endpoints We recommend using McAfee epo to remove Client Proxy software from the endpoints. If McAfee epo is not available and the endpoint is running Windows, you can remove the software using the Windows Add or Remove Programs tool. In this case, you need to generate a release code using the challenge-response procedure. McAfee Client Proxy Product Guide Product Guide 15

16 2 Managing Client Proxy policies Suspending policy enforcement Temporarily suspend policy enforcement To temporarily suspend policy enforcement on an endpoint, the user requests a bypass release code. Using the Help Desk software, you generate the release code and send it to the user. 1 To open the Enter Release Code dialog box, the user: Windows From the Start menu, click McAfee Bypass McAfee Client Proxy. Mac OS X or macos From the McAfee menulet on the status bar, select McAfee Endpoint Protection for Mac Preferences, then select Client Proxy. While waiting for you to send the release code, the user must leave this dialog box open. If the box is closed, the user must start the procedure over. 2 The user sends you an that includes: User name and address Policy Revision number (copied from the Enter Release Code dialog box) Identification code (copied from the Enter Release Code dialog box) 3 Using the Help Desk software and the values provided by the user, you generate the release code and send it to the user. 4 The user receives the release code, enters the code in the Release field, then clicks OK (Windows) or Release (Mac OS X or macos). Policy enforcement is suspended for the time period you specified when generating the release code. 16 McAfee Client Proxy Product Guide Product Guide

17 Index A access protection 12 Windows 11 Active Directory groups filter 11 Active Directory groups 12 authentication tokens 7 authentication version 7 B block list configuring 13 bypass list configuring 12 C challenge-response mechanism 15 client configuration 11 Client Proxy assigning a policy 13 how the software works 6 integrated with Endpoint Security 7 managing the proxy server list 10 metadata 7 Client Proxy software removing from endpoint computers 15 Client Proxy, about viewing on a Windows-based computer 14 viewing on an OS X computer 15 client settings configuring 12 Common Catalog 12 corporate network and VPN detection 11 corporate network detection 12 corporate VPN detection 12 customer ID 7, 11, 12 E Endpoint Solution Platform 7 EspMode 7 H hybrid solution 5 I IP addresses client and original destination 7 L log file settings 12 OS X 11 M McAfee WGCS configuring as the proxy server 10 metadata Client Proxy 7 P policies Client Proxy 13 exporting to an.xml or.opg file 14 suspending 15 processes blocking 13 proxy server list configuring 10 how Client Proxy manages 10 R release codes generating 16 S shared password 11 T traffic redirection 12 traffic redirection settings 11 McAfee Client Proxy Product Guide Product Guide 17

18 Index U user groups 7 user ID 7 W Web Gateway appliances configuring as proxy servers 10 Web Protection hybrid solution 5 Web Control 7 18 McAfee Client Proxy Product Guide Product Guide

19 0-00