Comodo Secure Web Gateway

• Introduction To Comodo Secure Web Gateway
  • Purchase Licenses
  • Login To The Admin Console
• The Admin Console
• The Dashboard
  • Customize The Dashboard
• Configure Comodo Secure Web Gateway
  • Connect Your Network / Devices To Secure Web Gateway
    • Traffic Forwarding Via Direct Proxy Or PAC
    • Traffic Forwarding Via Proxy Chaining
    • Traffic Forwarding Via Internet Content Adaptation Protocol (ICAP)
    • Traffic Forwarding Via SWG Agent
  • Connect Your Roaming Devices To Comodo Secure Web Gateway
    • View Enrolled Roaming Devices
  • Configure Comodo Secure Web Gateway Messages
  • Configure Domain Name
  • Configure PAC File For Exclusions
  • Configure Data Loss Prevention And View ICAP Service Information
  • Configure Policy Time-Schedules
• Manage Trusted Networks
• Manage Policies
  • Security Policy
    • Configure Advanced Threat Protection Settings
    • Configure Containerization Settings
  • Web Content Policy
    • Manage URL Filtering Policies
    • Configure SSL Inspection Settings
    • Manage File Type Control Rules
• Apply Policies To Networks
• Administration
  • Configure User Authentication Settings
  • User Management
    • Manage Users
    • Manage User Groups
    • Manage Departments
    • Manage Computers
  • My Profile
• Reports
  • Custom Reports
  • Scheduled Reports
• Unknown Threat Statistics
• About Comodo Security Solutions

Traffic Forwarding via Proxy Chaining

 

• As the name implies, proxy chaining is used to link multiple forward proxies to obtain the benefits of each.

• This method is suitable for larger organizations with multiple networks that want to direct web traffic through Comodo Secure Web Gateway (SWG).

• SWG is designed to be placed as the "Upstream Proxy" to other web gateways such as Websense, Bluecoat, iboss and so on.
  

The following examples use a Bluecoat Proxy SG and Comodo SWG integration scenario, where Bluecoat is downstream and SWG is the upstream proxy.

1. Basic Chaining

Bluecoat > SWG

 

In this scenario, Bluecoat Proxy SG is forwarding requests to SWG but performing no authentication. SWG can be set to do Active Directory authentication.

Use the Blue Coat Management console to forward requests to the Dome as following:

1. In the Blue Coat Management Interface, under the 'Configuration tab', go to Forwading > Forwarding Hosts.

2. Select 'Install from Text Editor' from the drop-down then click 'Install'.

3. Edit the 'Forwarding Hosts' configuration file to point to Dome. e.g:

• Add “fwd_host Dome_Proxy X.X.X.X http=19080” at the end of “Forwarding host configuration” section.

• Add “sequence Dome_Proxy” to the end of “Default fail-over sequence” section.

4. Once editing is complete, click 'Install'.

5. In the 'Configuration' tab, go to 'Policy' and select 'Visual Policy Manager'.

6. Click 'Launch'.

7. In the 'Policy Menu', add a new Forwarding Layer with a chosen policy name.

8. Select the Forwarding Layer tab that is created. Edit source, destination and service columns with necessary information. You can also leave as 'Any' by default.

9. Select the alias name you created in steps 2-5 (e.g: Dome_Proxy) from the list.

10. Click OK.

11. Click Install Policy.

2. X-Authenticated-For Chaining

In this scenario, Bluecoat will be configured to pass X-Authenticated-User headers to Dome Proxy and Bluecoat will be doing user authentication as the downstream proxy.

Note 1: SWG supports passing X-Forwarded-For headers but can not use them with granular policies. They can, however, be used in reporting. Global Policy will be applied to such traffic. Note 2: SWG honors X-Authenticated-User headers first and X-Forwarded-For headers next. If you want to set granular policies, use X-Authenticated-User headers.

Edit Bluecoat local policy file:

1. Go to the 'Configuration' tab.

2. Click 'Policy' in the left column and select 'Policy Files'.

3. Edit the text file as following:

action.Add[header name for authenticated user](yes)

define action dd[header name for authenticated user]

set(request.x_header.X-Authenticated-User, "WinNT://$(user.domain)/$(user.name)")

end action Add[header name for authenticated user]

Or use the Visual Policy Manager

1. Go to the 'Policy Menu' and select 'Add Web Access Layer' and give the policy a name

2. Set Source, Destination, Service and Time column as 'ANY'

3. Right click on 'Set' and click 'New' then 'Control Request Header'

4. Enter X-Authenticated-User in the 'Header Name' field

5. Select 'Set Value' radio button and enter: WinNT://$(user.domain)/$(user.name)

6. Click 'OK'

7. Click 'New' and select 'Combined Action Object', enter a name, select the previously created headers and Click 'Add'

8. Click 'OK'

9. Click 'Install Policy'.
   

 

Note: After connecting your network(s), make sure to add them as a 'Trusted Network' in the 'Locations' interface. If you don't add the network(s) as 'Trusted Network' then SWG will not function correctly. Your network will also not be able to connect to the internet. See 'Manage Trusted Networks' for more details. Select 'Proxy Chain' as authentication and traffic forwarding option in the 'Locations' interface. User-based rules are supported for Proxy Chaining traffic forwarding method. Comodo SWG uses ports 17443, 19443 and 19080 to connect to your networks. Please configure your firewall to allow SWG traffic over these ports.

Please contact us at domesupport@comodo.com if you have any issues connecting endpoints / networks to Comodo SWG.