topic Re: Sandboxing http/https traffics with web proxy(bluecoat) in place in Firewall and Security Management

Sandboxing http/https traffics with web proxy(bluecoat) in place

Biju_Nair — Thu, 07 Sep 2017 14:13:28 GMT

Hi, In a scenario with 3rd party web proxy(bluecoat) in place, how would the https traffic be handled by sandblast appliance. Considering bluecoat itself is doing https inspection first.

Re: Sandboxing http/https traffics with web proxy(bluecoat) in place

Norbert_Bohusch — Thu, 07 Sep 2017 14:40:25 GMT

There is not much information, how you want (or have) implemented the Sandblast appliance.

So just to keep it general:

If you want the https traffic to be inspected there has to be ssl-inspection active. Detail configuration for that depends on the implementation (sandblast before proxy or after).

Other way would be to use ICAP-client on proxy to speak with ICAP-server on Sandblast appliance.

Re: Sandboxing http/https traffics with web proxy(bluecoat) in place

Christian_Sandb — Thu, 07 Sep 2017 15:27:46 GMT

Hi,

Have a look at sk111306 and install JHF 284 or newer which includes the ICAP server feature.

HTH,

Christian

Re: Sandboxing http/https traffics with web proxy(bluecoat) in place

Biju_Nair — Thu, 07 Sep 2017 19:28:51 GMT

Hi Norbert,

I wish to implement the sandblast appliance to intercept https traffic for Sandboxing. I would like to deploy the Sandblast appliance after proxy towards internet and using fail open card.

Regards,

Biju Nair

Sent from my iPhone

Re: Sandboxing http/https traffics with web proxy(bluecoat) in place

Hugo_vd_Kooij — Fri, 08 Sep 2017 07:27:55 GMT

Hmmm. So you want two devices to break open SSL traffic independently?

This is the sort of stuff I would advise if you want nightmares.

It will be slow to the users and the likely hood you will get into negotiate trouble is big.

Re: Sandboxing http/https traffics with web proxy(bluecoat) in place

Norbert_Bohusch — Fri, 08 Sep 2017 07:43:44 GMT

I can only say that Hugo is right here and ICAP is the much better way to move forward!

Re: Sandboxing http/https traffics with web proxy(bluecoat) in place

Biju_Nair — Fri, 08 Sep 2017 09:53:01 GMT

Thanks Hugo.

Hi Norbert,

If we plan for ICAP then the proxy will act as a ICAP client and will send the traffic to sandblast(ICAP server).

But how would the https traffic work in ICAP scenario. Will proxy send the decrypted packet to sandblast and wait for verdict from sandblast by holding the connection.

Regards,

Biju Nair

Sent from my iPhone

Re: Sandboxing http/https traffics with web proxy(bluecoat) in place

PhoneBoy — Fri, 08 Sep 2017 21:16:18 GMT

That's the basic idea.

Re: Sandboxing http/https traffics with web proxy(bluecoat) in place

Thomas_Werner — Thu, 14 Sep 2017 07:20:05 GMT

In addition this helps getting you started on the BC side:

ProxySG ICAP Integration

Regards Thomas