McAfee Client Proxy 1.2

Transcription

1 Product Guide Revision B McAfee Client Proxy 1.2 For use with epolicy Orchestrator 4.6 and 5.1 Software

2 COPYRIGHT Copyright 2014 McAfee, Inc. Do not copy without permission. TRADEMARK ATTRIBUTIONS McAfee, the McAfee logo, McAfee Active Protection, McAfee DeepSAFE, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundscore, Foundstone, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee Total Protection, TrustedSource, VirusScan, WaveSecure are trademarks or registered trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other names and brands may be claimed as the property of others. Product and feature names and descriptions are subject to change without notice. Please visit mcafee.com for the most current products and features. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. 2 McAfee Client Proxy 1.2 Product Guide

3 Contents Preface 5 About this guide Audience Find product documentation Conventions Introduction 7 How Client Proxy works Deployment options Managing McAfee Client Proxy with McAfee epo 2 Completing the setup using McAfee epo 13 Check the system requirements Download and install the product files Install the extension Check in the package Deploy to end-user computers using McAfee epo Configuring and using McAfee Client Proxy with McAfee epo 17 Configurable policy options Configure a policy using McAfee epo Configure the proxy servers Configure the client settings Configure the Bypass List Configure the Block List Assign the policy using McAfee epo View end-user installation data Cancel policy enforcement using McAfee epo Export the policy to an XML file Maintaining McAfee Client Proxy using McAfee epo 23 Upgrade Client Proxy using McAfee epo Install a hotfix Uninstall Client Proxy Remove the extension from McAfee epo Remove the package in McAfee epo Managing McAfee Client Proxy outside of a McAfee epo system 5 Completing the setup using the Control Console 29 Check the system requirements Download and install the product files McAfee Client Proxy 1.2 Product Guide 3

4 Contents 6 Configuring and using Client Proxy with the Control Console 31 Configurable policy options Create a policy using the Control Console Configure the proxy servers Configure the bypass list Configure the block list Configure redirection settings Deploy to end-user computers using other systems View status and configuration details Generate a release code Maintaining McAfee Client Proxy on your system 37 Upgrade McAfee Client Proxy on your system Install a hotfix Uninstall McAfee Client Proxy Index 39 4 McAfee Client Proxy 1.2 Product Guide

5 Preface This guide provides the information you need to work with your McAfee product. Contents About this guide Find product documentation Conventions About this guide This information describes the guide's target audience, the typographical conventions and icons used in this guide, and how the guide is organized. Audience McAfee documentation is carefully researched and written for the target audience. The information in this guide is intended primarily for: Administrators People who implement and enforce the company's security program. Security officers People who determine sensitive and confidential data, and define the corporate policy that protects the company's intellectual property. Find product documentation After a product is released, information about the product is entered into the McAfee online Knowledge Center. 1 Go to the McAfee ServicePortal at and click Knowledge Center. 2 Enter a product name, select a version, then click Search to display a list of documents. Conventions This guide uses these typographical conventions and icons. Book title, term, emphasis Bold Title of a book, chapter, or topic; a new term; emphasis. Text that is strongly emphasized. McAfee Client Proxy 1.2 Product Guide 5

6 Preface Conventions User input, code, message Interface text Hypertext blue Commands and other text that the user types; a code sample; a displayed message. Words from the product interface like options, menus, buttons, and dialog boxes. A link to a topic or to an external website. Note: Additional information, like an alternate method of accessing an option. Tip: Suggestions and recommendations. Important/Caution: Valuable advice to protect your computer system, software installation, network, business, or data. Warning: Critical advice to prevent bodily harm when using a hardware product. 6 McAfee Client Proxy 1.2 Product Guide

7 1 1 Introduction McAfee Client Proxy is a Windows desktop agent that is an essential component of the McAfee Web Protection hybrid deployment solution. The Client Proxy technology allows you to apply your organization's web security policy to a computer, regardless of its location. Contents How Client Proxy works Deployment options How Client Proxy works McAfee Client Proxy extends network security solutions to computers outside the corporate network. End users receive automatic protection, regardless of their location (for example, a laptop or mobile computing device in a hotel or coffee shop). McAfee Client Proxy redirects web traffic and network communications to a web filtering solution either a McAfee Web Gateway appliance or McAfee SaaS Web Protection service to recognize the environment (whether it is inside the corporate network, connected by VPN, or outside the corporate McAfee Client Proxy 1.2 Product Guide 7

8 1 Introduction How Client Proxy works network). Regardless of the location of the end-user device, the Client Proxy software enforces your organization's policies to determine whether to route the web request, deny access, or bypass a proxy server. Figure 1-1 Client Proxy workflow 8 McAfee Client Proxy 1.2 Product Guide

9 Introduction Deployment options 1 1 When an end user is working within the corporate network, McAfee Client Proxy software communicates withmcafee epolicy Orchestrator (McAfee epo ), or other servers configured within the policy, and recognizes that the end user is working within the corporate network. Client Proxy remains passive, allowing web traffic and network communications to pass through. 2 When the Client Proxy software recognizes that the end user is working outside the corporate network, it redirects all web traffic and network communications to the McAfee SaaS Web Protection service. All web traffic and network communication requests sent by Client Proxy to the SaaS Web Protection service include end-user and AD group information that is applied to your organization's policy. If the sent end-user information is mapped to a SaaS Web Protection service user account, the Client Proxy software applies the associated policy to the existing user account. If McAfee SaaS Web Protection does not recognize the sent end-user information as a mapped SaaS Web Protection user account, McAfee Client Proxy software applies the AD group information. If one or more AD groups match the end-user information, SaaS Web Protection service applies the associated policy or a combination of associated policies. When the sent end-user and AD group information are both unrecognized by SaaS Web Protection service, the proxy uses the default web policy. For organizations that use McAfee SaaS Web Protection service, McAfee Client Proxy also provides the option to always redirect web traffic and network communications to SaaS Web Protection service, whether the end user is working outside or inside the corporate network. Deployment options McAfee Client Proxy software can be deployed either with McAfee epo, or using a third-party deployment solution such as Microsoft Systems Management Server (Microsoft SMS). Deploying with McAfee epo We highly recommend using McAfee epo to deploy McAfee endpoint software, especially in a large enterprise. It provides a single management platform that enables policy management and product enforcement. In this case, McAfee epo is installed and configured on the administrator operating system. The end user installing the Client Proxy software on McAfee epo servers must be a member of the local administrator group. Example of the high-level process 1 Install the McAfee Client Proxy extension.zip file so it is available in McAfee epo. 2 Check in the Client Proxy package to the McAfee epo Master Repository. 3 Download the.xml file from the Control Console that the Client Proxy extension imports. 4 Deploy Client Proxy software to end-user computers within your corporate network. 5 Create policies that meet the needs of your network. McAfee Client Proxy 1.2 Product Guide 9

10 1 Introduction Deployment options Deploying with a third-party solution If you are using McAfee Client Proxy in a small- to medium-sized company and do not have McAfee epo, you can install the product within your corporate network using a third-party deployment solution such as Microsoft SMS. In this case, you use Client Proxy to manually push policies to end-user computers. See McAfee KnowledgeBase article KB59769 for an example of deployment using Microsoft SMS. Example of the high-level process 1 Install McAfee Client Proxy on the administrator operating system that will deploy policies. 2 Use McAfee SaaS Web Protection service to create policies that meet the needs of your network. 3 Follow the instructions of the third-party solution to create and deploy the installation package. 4 Deploy configured policies to end-user computers in your corporate network. 10 McAfee Client Proxy 1.2 Product Guide

11 Managing McAfee Client Proxy with McAfee epo Chapter 2 Chapter 3 Chapter 4 Completing the setup using McAfee epo Configuring and using McAfee Client Proxy with McAfee epo Maintaining McAfee Client Proxy using McAfee epo McAfee Client Proxy 1.2 Product Guide 11

12 Managing McAfee Client Proxy with McAfee epo 12 McAfee Client Proxy 1.2 Product Guide

13 2 Completing the setup using McAfee epo To set up McAfee Client Proxy in your corporate network, download and install the Client Proxy installation files on the administrator operating system. Deploy the Client Proxy software to end-user computers. Client Proxy can be set up on the same computer as McAfee epo, or on a separate computer that has the ability to communicate with McAfee epo. Additional configuration might be necessary to ensure communication through any firewall in place. McAfee epo must be installed and correctly running before installing Client Proxy. You must have administrator rights to be able to install Client Proxy software using McAfee epo. After completing the setup, Client Proxy runs on the end-user computer without a policy file, and does not redirect data until a policy is configured. Contents Check the system requirements Download and install the product files Install the extension Check in the package Deploy to end-user computers using McAfee epo Check the system requirements Verify that your network systems meet the hardware and operating system requirements. Table 2-1 Hardware requirements Hardware type Servers Run the McAfee epo software and Client Proxy extension. End-user computers Run the Client Proxy software. Specifications CPU Intel Pentium IV 2.8 GHz or later RAM 1 GB minimum Hard disk 80 GB minimum CPU Pentium III 1 GHz or later RAM 1 GB minimum Hard disk 200 MB minimum free disk space McAfee Client Proxy 1.2 Product Guide 13

14 2 Completing the setup using McAfee epo Download and install the product files Table 2-2 Operating system requirements 32-bit Computer type Servers Run the McAfee epo software and Client Proxy extension. End-user computers Run the Client Proxy software. Software Microsoft Windows 2003 Server Standard (SE) SP1 or later Windows 2003 Enterprise (EE) SP1 or later Windows 2008 Server Enterprise Windows XP Professional SP3 or later Windows Vista SP2 or later Windows 7 SP1 or later Windows 8 or 8.1 Table 2-3 Operating system requirements 64-bit Computer type Servers Run the McAfee epo software and Client Proxy extension. End-user computers Run the Client Proxy software. Software Windows 2003 Server Standard (SE) SP1 or later Windows 2003 Enterprise (EE) SP1 or later Windows 2008 Server Enterprise Windows 7 SP1 or later Windows 8 or 8.1 Download and install the product files Download the McAfee Client Proxy product files from the McAfee Content & Cloud Security Portal and install them on the administrator operating system. 1 Download the product files. a Log on to the operating system as an administrator. b c d e Go to the McAfee Content & Cloud Security Portal. Enter your user name and password, then click Login. Select Software McAfee Web Gateway Tools McAfee Client Proxy. Select and save the.zip file for your operating system. 2 Install the product files. a Run the MCPService.exe file. b Follow the on-screen prompts to complete the installation. Install the extension Install the McAfee Client Proxy extension.zip file so it is available in McAfee epo. For option definitions, click? in the interface. 14 McAfee Client Proxy 1.2 Product Guide

15 Completing the setup using McAfee epo Check in the package 2 1 From the McAfee epo interface, select Menu Software Extensions. 2 Click Install Extension. 3 Click Browse to locate the Client Proxy extension.zip file, then click Open OK. The Install Package window appears. 4 Click OK. 5 To verify the extension successfully installed, select Menu Software Extensions. Check in the package Check in the McAfee Client Proxy package to the McAfee epo Master Repository. For option definitions, click? in the interface. 1 From the McAfee epo interface, select Menu Software Master Repository. 2 From the Actions menu, select Check In Package. 3 In the Check In Package window, select the package type, then click Browse. 4 Choose the Client Proxy extension.zip file you downloaded earlier, and click Open. McAfee Client Proxy appears in the Packages in Master Repository list. Deploy to end-user computers using McAfee epo Deploy McAfee Client Proxy software to end-user computers using McAfee epo. 1 From the McAfee epo interface, select Menu Systems System Tree. 2 From the System Tree list, select the subgroup level to deploy Client Proxy. Select the My Organization subgroup to deploy Client Proxy to all computers managed by McAfee epo. To deploy Client Proxy to the individual computers available in the right-hand pane, select a subgroup under My Organization. 3 Click the Assigned Client s tab. 4 From the Actions menu, select New Client Assignment. The Client Assignment Builder wizard opens. McAfee Client Proxy 1.2 Product Guide 15

16 2 Completing the setup using McAfee epo Deploy to end-user computers using McAfee epo 5 Configure the Client Assignment Builder options. a From the Product menu, select McAfee Agent. b c From the Type menu, select Product Deployment, Click Create New. The Product Deployment window appears. 6 Configure the Product Deployment options. a Enter a task name and optional description. b c Select a Target platform. In the Products and Components field, select McAfee Client Proxy from the drop-down list. The remaining fields automatically populate. d e Configure the remaining options. Click Save. 7 Click Next. 8 From the Schedule type drop-down list, select Run immediately, then click Next. 9 Review the task summary, then click Save. The task is scheduled for the next time the McAfee Agent checks for updates. To force the installation to run immediately, issue an agent wake-up call. After installation, Client Proxy runs immediately without restarting the end-user computer. At this point, Client Proxy runs on the end-user computer without a policy file, and does not redirect data until a policy is configured. 16 McAfee Client Proxy 1.2 Product Guide

17 3 3 Configuring and using McAfee Client Proxy with McAfee epo Use McAfee epo to manage and configure the options that define the Client Proxy policies enforced on end-user computers. Contents Configurable policy options Configure a policy using McAfee epo View end-user installation data Cancel policy enforcement using McAfee epo Export the policy to an XML file Configurable policy options Policy options allow you to tune multiple settings when you configure policies. The following are configurable policy options available in McAfee epo. Configure a policy using McAfee epo Use McAfee epo to create and configure policies that are deployed to end-user computers. For option definitions, click? in the interface. 1 From the McAfee epo interface, select Menu Policy Policy Catalog. 2 From the Product drop-down list, select McAfee Client Proxy. The default policy assignment appears. 3 From the Actions menu, select New Policy. The New Policy dialog box appears. 4 In the Policy Name field, type a name for the policy, enter any additional information, then click OK. McAfee Client Proxy 1.2 Product Guide 17

18 3 Configuring and using McAfee Client Proxy with McAfee epo Configure a policy using McAfee epo s Configure the proxy servers on page 18 Configure the proxy servers for McAfee Client Proxy to redirect network traffic. Configure the client settings on page 18 Configure the settings that define how deployed McAfee Client Proxy policies behave inside or outside the corporate network. Configure the Bypass List on page 19 Configure and add the web definitions to the Bypass List that end-user computers directly connect to by bypassing the policy. Configure the Block List on page 19 To reduce the amount of network traffic redirected to the proxy server, configure and add processes to the Block List that are permanently blocked from communicating with the network. Assign the policy using McAfee epo on page 19 Assign policies to specific end-user computers within your corporate network. Configure the proxy servers Configure the proxy servers for McAfee Client Proxy to redirect network traffic. For option definitions, click? in the interface. 1 On the Policy Catalog page, select a policy. 2 From the Client Proxy Settings menu, select Proxy Servers. 3 In the Proxy Server List, select how Client Proxy connects to the proxy servers using these options: connect to the first proxy server that is accessible based on their order in the following list. connect to the proxy server that has the fastest response time. 4 Add proxy servers to the Proxy Server List. a In the Proxy Server Address field, type the proxy server IP address or host name. b In the Proxy Port field, type the port for the proxy server. Port 8888 is outside of the proxy server configuration options. c d To direct HTTP/HTTPS requests to the Web Gateway appliance or SaaS Web Protection service, select the HTTP/HTTPS checkbox. In the Non-HTTP/HTTPS Redirected Ports field, type the non-http/https redirected ports. For non-http/https protocols, make sure the server supports the protocol. e Click Add. The proxy server appears in the Proxy Server List. 5 In the Actions list, click the arrows to move the proxy servers in the Proxy Server List. Configure the client settings Configure the settings that define how deployed McAfee Client Proxy policies behave inside or outside the corporate network. For option definitions, click? in the interface. 18 McAfee Client Proxy 1.2 Product Guide

19 Configuring and using McAfee Client Proxy with McAfee epo Configure a policy using McAfee epo 3 1 From the Client Proxy Settings menu, select Client Configuration. 2 In the Customer Identifier section, click Browse, select the XML file, then click Open. The Unique Customer ID and Shared Password fields are automatically populated. 3 Configure the remaining options. Configure the Bypass List Configure and add the web definitions to the Bypass List that end-user computers directly connect to by bypassing the policy. For option definitions, click? in the interface. 1 From the Client Proxy Settings menu, select Bypass List. 2 From the Actions menu, select Add bypass list item, then select a web definition type. The Choose from existing values dialog box appears. 3 Click New Item, enter the required information, then click Save. 4 Click OK. Configure the Block List To reduce the amount of network traffic redirected to the proxy server, configure and add processes to the Block List that are permanently blocked from communicating with the network. For option definitions, click? in the interface. 1 From the Client Proxy Settings menu, select Block List. 2 Select an option for how to handle network traffic. 3 In the Process Name field, type the name of a process to block, then click Add. 4 Click Save. Assign the policy using McAfee epo Assign policies to specific end-user computers within your corporate network. For option definitions, click? in the interface. 1 Select Menu Systems System Tree. 2 From the System Tree menu, select a group or subgroup. 3 Click the Assigned Policies tab. 4 From the Product drop-down list, select McAfee Client Proxy. 5 Click Edit Assignment. The Policy Assignment for my Organization window appears. McAfee Client Proxy 1.2 Product Guide 19

20 3 Configuring and using McAfee Client Proxy with McAfee epo View end-user installation data 6 Next to Inherit from, select Break inheritance and assign the policy and settings below. 7 From the Assigned policy drop-down list, select the policy. 8 Choose whether or not to lock policy inheritance. 9 Click Save. View end-user installation data View the number of end-user computers that have successfully installed McAfee Client Proxy within the past month. For option definitions, click? in the interface. 1 From the McAfee epo interface, select Menu Reporting Queries & Reports. 2 From the Groups list, expand Shared Groups, then select McAfee Client Proxy. 3 Create a query. Option Select a query type. Definition 1 Select the Query tab, then select Actions New. The Query Builder opens with the Result Types view active. 2 From the Feature Group list, select Policy Management. 3 Choose from these options: Applied Client s Applied Policies Client Assignment Broken Inheritance Policy Assignment Broken Inheritance 4 Click Next. Select a query layout. 1 From the Display Results As list, select a graph or table for the query layout. Select a layout for your query that will best display your data. 2 Select the display options you want from the available lists. 3 To move to the Columns page, click Next. Select query columns. 1 From the Available Columns list, select which columns to apply to your query. 2 In Selected Columns, select, drag and position each column. 3 To move to the Filter page, click Next. Configure properties. From the Available Properties list, select which properties to use for filtering your query, and the appropriate values for each. 20 McAfee Client Proxy 1.2 Product Guide

21 Configuring and using McAfee Client Proxy with McAfee epo Cancel policy enforcement using McAfee epo 3 Option Run the query. Save the query. Definition Click Run. 1 To view the Save Query page, click Save. 2 Type a name for the query, add any notes, and select a group. 3 Click Save. 4 Create a report. Option Select a query. Definition 1 Click the Report tab, then select Actions New. The Report Builder opens with the Report Layout view active. 2 From the Toolbox menu, select Query Chart, and drag it to the Report Layout area. The Configure Query Chart dialog box appears. 3 From the Query drop-down list, select MCP: Endpoint Install Success/Failed events in last month. 4 Configure the remaining query options, then click OK. Customize the report. 1 In the Name, Description and Group tab, type a name, description, and which group to use. 2 Use the Header and Footer and Page Setup tabs to specify how you want the query to appear in the report. 3 Use the Runtime Parameters tab to select report level filters. Generate the report. Click Run. At this point, you can choose to run the report to get the information immediately, save to use it another time, or configure its appearance further by adding additional content. Cancel policy enforcement using McAfee epo End users request a bypass release code from their computer. The administrator uses McAfee Help Desk to create and issue the code, which is valid for a specified time period. 1 End user does one of the following: On Microsoft Windows computers: Click the McAfee icon on the system tray, then select Manage Features Disable McAfee Client Proxy. On Mac OS X computers: From the McAfee menulet on the status bar, select McAfee Endpoint Protection for Mac Preferences, then select Client Proxy. 2 The end user copies the following information from the window and supplies it to the Client Proxy administrator: Computer Name Policy Name McAfee Client Proxy 1.2 Product Guide 21

22 3 Configuring and using McAfee Client Proxy with McAfee epo Export the policy to an XML file Policy Revision Identification Code In addition, the user supplies the administrator with their End user name and matching End user address. All these items are required except the Computer Name, which is optional. The release code works only with the ID code, named policy, and revision number specified. The revision number is verified when the code is generated. The Identification Code changes each time the Enter Release Code window opens. Do not close the window until you enter the Release Code from the administrator. You can copy and paste the ID code, but you cannot edit it. 3 When the administrator supplies a release code, type the code in the Release Code field. On Microsoft Windows computers: Click OK. On Mac OS X computers: Click Release. Policy enforcement is canceled for the time period specified by the administrator when creating the release code. Export the policy to an XML file For troubleshooting purposes, export the McAfee Client Proxy policy to an XML file. For option definitions, click? in the interface. 1 From the McAfee epo interface, select a policy. 2 Select Actions Export Policy to File. The Export Policy to File dialog box appears. 3 Click the McAfee Client Proxy Client File link. 4 Save the file. 5 Click OK. 22 McAfee Client Proxy 1.2 Product Guide

23 4 Maintaining 4 McAfee Client Proxy using McAfee epo Perform maintenance tasks to ensure Client Proxy operates as intended. Contents Upgrade Client Proxy using McAfee epo Install a hotfix Uninstall Client Proxy Upgrade Client Proxy using McAfee epo Download, install, and deploy the latest version of McAfee Client Proxy. For option definitions, click? in the interface. 1 Download the latest version of the product files. a Go to the McAfee Content & Cloud Security Portal. b c d Enter your user name and password, then click Login. Select Software McAfee Web Gateway Tools McAfee Client Proxy. Select and save the appropriate.zip file. 2 Install the extension. a From the McAfee epo interface, select Menu Software Extensions. b c Click Install Extension. Click Browse to locate the Client Proxy.zip file, click Open, then click OK. The Install Package window appears. d e Click OK. Verify that the extension is installed, and select Menu Software Extensions. 3 Check in the package. a Select Actions Check in Package. The Check in Package window appears. McAfee Client Proxy 1.2 Product Guide 23

24 4 Maintaining McAfee Client Proxy using McAfee epo Install a hotfix b c Select the package type, then click Browse. Choose the Client Proxy.zip file you downloaded earlier, then click Open. McAfee Client Proxy appears in the Packages in Master Repository list. 4 Deploy the upgrade. a Select Menu Systems System Tree. b c d e f g h i j k From the System Tree list, select the subgroup level to deploy Client Proxy endpoint software. Click the Assigned Client s tab. From the Actions menu, select New Client Assignment. Configure the Client Assignment Builder options. Click Create New. Configure the Product Deployment options. Click Save. Click Next. From the Schedule type drop-down list, select Run immediately, then click Next. Review the task summary, then click Save. Install a hotfix McAfee occasionally releases Client Proxy hotfixes to address product issues. If the hotfix includes release notes, use the release notes instructions to install the hotfix. If the hotfix does not have release notes, use the following task. 1 Go to the McAfee Content & Cloud Security Portal. 2 Enter your user name and password, then click Login. 3 Select Software McAfee Web Gateway Tools McAfee Client Proxy. 4 Select and save the hotfix installation file for your operating system. 5 Run the hotfix installation file. 6 Follow the on-screen prompts to complete the installation. Uninstall Client Proxy To fully uninstall McAfee Client Proxy, remove the extension and package from McAfee epo, then remove the software from the administrator operating system. Contents Remove the extension from McAfee epo Remove the package in McAfee epo 24 McAfee Client Proxy 1.2 Product Guide

25 Maintaining McAfee Client Proxy using McAfee epo Uninstall Client Proxy 4 Remove the extension from McAfee epo Remove the McAfee Client Proxy extension from McAfee epo. For option definitions, click? in the interface. 1 Log on to McAfee epo as an administrator. 2 Select Menu Software Extensions. 3 From the Extensions list, select McAfee Client Proxy. 4 Click Remove. Remove the package in McAfee epo Remove the McAfee Client Proxy package from the McAfee epo Master Repository. For option definitions, click? in the interface. 1 Select Menu Software Master Repository. 2 From the McAfee Client Proxy Actions column, click Delete. McAfee Client Proxy 1.2 Product Guide 25

26 4 Maintaining McAfee Client Proxy using McAfee epo Uninstall Client Proxy 26 McAfee Client Proxy 1.2 Product Guide

27 Managing McAfee Client Proxy outside of a McAfee epo system Chapter 5 Chapter 6 Chapter 7 Completing the setup using the Control Console Configuring and using Client Proxy with the Control Console Maintaining McAfee Client Proxy on your system McAfee Client Proxy 1.2 Product Guide 27

28 Managing McAfee Client Proxy outside of a McAfee epo system 28 McAfee Client Proxy 1.2 Product Guide

29 5 Completing the setup using the Control Console To set up McAfee Client Proxy in your corporate network using a system other than McAfee epo, download and install the Client Proxy installation files from the Control Console. Contents Check the system requirements Download and install the product files Check the system requirements Verify that your network systems meet the hardware and operating system requirements. Table 5-1 Hardware requirements Hardware type Specifications Servers Run the McAfee Client Proxy extension. CPU Intel Pentium IV 2.8 GHz or later RAM 1 GB minimum Hard disk 80 GB minimum End-user computers Run the Client Proxy software. CPU Pentium III 1 GHz or later RAM 1 GB minimum Hard disk 200 MB minimum free disk space Table 5-2 Operating system requirements 32-bit Computer type Servers Run the Client Proxy extension. End-user computers Run the Client Proxy software. Software Microsoft Windows 2003 Server Standard (SE) SP1 or later Windows 2003 Enterprise (EE) SP1 or later Windows 2008 Server Enterprise Windows XP Professional SP3 or later Windows Vista SP2 or later Windows 7 SP1 or later Windows 8 or 8.1 McAfee Client Proxy 1.2 Product Guide 29

30 5 Completing the setup using the Control Console Download and install the product files Table 5-3 Operating system requirements 64-bit Computer type Servers Run the Client Proxy extension. End-user computers Run the Client Proxy software. Software Windows 2003 Server Standard (SE) SP1 or later Windows 2003 Enterprise (EE) SP1 or later Windows 2008 Server Enterprise Windows 7 SP1 or later Windows 8 or 8.1 Download and install the product files Download the McAfee Client Proxy product files from the McAfee Content & Cloud Security Portal or Control Console, and install them on the administrator operating system. To download the Client Proxy product files from the Control Console, you must first have a SaaS Web Protection service account. 1 Log on to the operating system as an administrator. 2 Download the product files. Option McAfee Content & Cloud Security Portal Steps 1 Go to the McAfee Content & Cloud Security Portal. 2 Enter your user name and password, then click Login. 3 Select Software McAfee Web Gateway Tools McAfee Client Proxy. 4 Select and save the.zip file for your operating system. Control Console 1 Log on to the Control Console as an administrator. 2 Select Web Protection Setup McAfee Client Proxy. 3 Click Download MCP. 4 Select and save the.zip file for your operating system. 3 Install the product files. Do one of the following: Run McpInstaller.x64.exe Run McpInstaller.86.exe Follow the on-screen prompts to complete the installation. 30 McAfee Client Proxy 1.2 Product Guide

31 6 Configuring 6 and using Client Proxy with the Control Console Use the Control Console to manage and configure the options that define the Client Proxy policies enforced on end-user computers. Contents Configurable policy options Create a policy using the Control Console Deploy to end-user computers using other systems View status and configuration details Generate a release code Configurable policy options Policy options allow you to tune multiple settings when you configure policies. The following are configurable policy options available in the Control Console. Customer ID and secret key McAfee Client Proxy includes a customer ID and secret key in its policy definition to ensure that client identities are securely protected. Use the epo Export button to download the customer ID XML file for use with McAfee epo. If you are using McAfee epo, we recommend using McAfee epo to manage Client Proxy policies instead of the Control Console. Proxy servers When the Client Proxy software detects that an end-user computer is disconnected from the corporate network, network traffic is automatically redirected to a McAfee Web Gateway appliance or McAfee SaaS Web Protection servers, which are configured in the proxy servers list. You can configure how Client Proxy connects to proxy servers using these options: Connect to the first proxy server that is accessible based on their order in the following list Client Proxy connects to the first proxy server in the proxy servers list. If the connection to the first proxy server in the list fails, the software attempts a connection on the second proxy server in the list. If the connection is lost during transmission, the software reconnects with the first proxy server in the list. Connect to the proxy server that has the fastest response time Client Proxy connects to the closest proxy server in the proxy servers list based on the proxy server response time. If the connection to the closest proxy server fails, the software attempts to connect to the second closest proxy server. If the connection is lost during transmission, the software reconnects with the original closest proxy server. McAfee Client Proxy 1.2 Product Guide 31

32 6 Configuring and using Client Proxy with the Control Console Create a policy using the Control Console When HTTP/HTTPS traffic is redirected, Client Proxy adds metadata to the request, such as: Identification tokens Encrypted domain user names AD groups The proxy server uses this metadata to verify that Client Proxy is redirecting the network traffic, then determines the policy definitions configured in the associated policy. Bypass list Each policy maintains a list of definitions for Client Proxy to bypass when network traffic is redirected to the proxy server. The bypass list can include domain names, network addresses, network ports, and processes that end-user computers connect to directly. Block list Each policy maintains a list of processes that are permanently blocked from network communication. The block list reduces the amount of network traffic redirected to the proxy server, but can also apply unintended Internet access restrictions to end-user computers. Redirection settings Client Proxy communicates with McAfee epo, or other configured proxy servers, to verify that the end user is working inside the corporate network. Client Proxy also checks a list of corporate servers to detect when an end-user computer is connected through VPN. When Client Proxy detects that an end user is working inside the corporate network or through VPN, the software stops redirecting web traffic and network communication. Create a policy using the Control Console Policies are created and saved as McAfee SaaS Web Protection web protection policies. Use the Control Console to create and configure policies that are deployed to end-user computers. Before you begin Request a customer ID and password from the Web Gateway or SaaS Web Protection administrator. To use McAfee Client Proxy with SaaS Web Protection, the SaaS Web Protection service must be activated. 1 From the Control Console interface, select Web Protection Policies McAfee Client Proxy Policies. 2 In the Secret Key field, enter your secret key. A secret key must be entered to enable Client Proxy policies. 32 McAfee Client Proxy 1.2 Product Guide

33 Configuring and using Client Proxy with the Control Console Create a policy using the Control Console 6 3 Click New. The New McAfee Client Proxy Policy dialog box appears. 4 Click the Details tab. a In the Name field, type the policy name. b c d e Type an optional description. To prevent uninstallation, interruption, and policy manipulation, select the Enable Access Protection checkbox. To provide the administrator with ability to generate release code, select the Request Release key for manual uninstall checkbox. Define the Client Logging level. s Configure the proxy servers on page 33 Configure the proxy servers for McAfee Client Proxy to redirect network traffic. Configure the bypass list on page 34 Configure and add the web definitions to the bypass list that end-user computers directly connect to by bypassing the policy. Configure the block list on page 34 To reduce the amount of network traffic redirected to the proxy server, configure and add processes to the block list that are permanently blocked from communicating with the network. Configure redirection settings on page 34 Configure the options to redirect web traffic to a proxy server instead of the original destination address. Configure the proxy servers Configure the proxy servers for McAfee Client Proxy to redirect network traffic. 1 Click the Proxy Servers tab. 2 Click New. 3 Add proxy servers to the policy. a In the Proxy Server Address field, type the proxy server IP address or host name. b In the Port field, type the port for the proxy server. Port 8888 is outside of the proxy server configurable options. c d To direct HTTP/HTTPS requests to the Web Gateway or SaaS Web Protection servers, select Yes from the HTTP/HTTPS drop-down list. In the Non-HTTP/HTTPS Redirected Ports field, type the non-http/https redirected ports. For non-http/https protocols, make sure the server supports the protocol. McAfee Client Proxy 1.2 Product Guide 33

34 6 Configuring and using Client Proxy with the Control Console Create a policy using the Control Console 4 Configure the remaining options. a In the Additional Ports field, type any additional ports to redirect as HTTP/HTTPS traffic. b To bypass Client Proxy for local addresses in your internal network, select the Bypass the McAfee Client Proxy for local addresses checkbox. To remove a proxy server, click Delete. Configure the bypass list Configure and add the web definitions to the bypass list that end-user computers directly connect to by bypassing the policy. 1 Click the Bypass List tab. 2 Click New. 3 From the Type drop-down list, select a type. 4 In the Value field, type the value. To remove a definition from the bypass list, click Delete. Configure the block list To reduce the amount of network traffic redirected to the proxy server, configure and add processes to the block list that are permanently blocked from communicating with the network. 1 Click the Block List tab. 2 Click New. 3 In the Executable Name field, type a value. To remove a process from the block list, click Delete. Configure redirection settings Configure the options to redirect web traffic to a proxy server instead of the original destination address. 1 Click the Redirection Settings tab. 2 To enable corporate detection, select the Enable checkbox. 3 From the Corporate Servers or Corporate VPNs areas, click New. 4 In the Server Address field, type the IP address or host name. 5 In the Port field, type the port number. 6 Click Save. To remove an item from the Corporate Servers or Corporate VPNs lists, click Delete. 34 McAfee Client Proxy 1.2 Product Guide

35 Configuring and using Client Proxy with the Control Console Deploy to end-user computers using other systems 6 Deploy to end-user computers using other systems We recommend using McAfee epo to deploy McAfee endpoint software products. Various methods of manual deployment are possible in cases where deployment with McAfee epo is either unfeasible or not wanted. One such method is described in McAfee KnowledgeBase article KB View status and configuration details View status and configuration details using the Microsoft Windows registry. Before you run an.reg file, confirm it is a genuine import file. 1 From your Windows-based system, click Start Run. The Run dialog box appears. 2 In the Open field, type regedit, then click OK. 3 Browse to HKEY_LOCAL_MACHINE\SOFTWARE\McAfee\MCP\About. Do not change these values: Active Proxy Policy Revision Connection Status Policy Timestamp Policy Name Generate a release code To temporarily cancel policy enforcement on end-user computers, end users request a release code from the administrator. The end user requests the release code from their computer, and the administrator uses McAfee Help Desk to create and issue the code, which is valid for a specified time period. 1 On the end-user computer, click the McAfee icon on the system tray, then select Manage Features Request McAfee Client Proxy Bypass. The Enter Release Code window appears. 2 The end user provides this information to the Client Proxy administrator: Computer Name Policy Name Policy Revision McAfee Client Proxy 1.2 Product Guide 35

36 6 Configuring and using Client Proxy with the Control Console Generate a release code End-user system user name and address Identification Code The Identification Code changes each time the Enter Release Code window opens, so do not close the window. You can copy and paste the Identification Code, but you cannot edit it. 3 The administrator uses this information to generate and send the Release Code to the end user: Sent information from the end user. Enter end user identification code Allows the administrator to copy and paste the Identification Code. User master release code Allows the administrator to generate a release code that can be used for any network computer. Once the master release code has been generated, it must be used within 60 minutes. Generate Key Generates the release code. Send the release code that appears in the Release Code field to the end user. 4 On the end-user computer, type the release code in the Release Code field, then click OK. 36 McAfee Client Proxy 1.2 Product Guide

37 7 Maintaining 7 McAfee Client Proxy on your system View the Client Proxy status and configuration details, or uninstall the software from the administrator operating system. Contents Upgrade McAfee Client Proxy on your system Install a hotfix Uninstall McAfee Client Proxy Upgrade McAfee Client Proxy on your system Download and install the latest version of Client Proxy. 1 Copy all existing policy files to a temporary file on your system. 2 Go to the McAfee Content & Cloud Security Portal. 3 Enter your user name and password, then click Login. 4 Select Software McAfeeWeb Gateway Tools McAfee Client Proxy 5 Select and save the.zip file for the latest version of the Client Proxy software. 6 From the.zip file, locate and run the installation file, then follow the prompts to install the software. Install a hotfix McAfee occasionally releases Client Proxy hotfixes to address product issues. If the hotfix includes release notes, use the release notes instructions to install the hotfix. If the hotfix does not have release notes, use the following task. 1 Go to the McAfee Content & Cloud Security Portal. 2 Enter your user name and password, then click Login. 3 Select Software McAfee Web Gateway Tools McAfee Client Proxy. 4 Select and save the hotfix installation file for your operating system. McAfee Client Proxy 1.2 Product Guide 37

38 7 Maintaining McAfee Client Proxy on your system Uninstall McAfee Client Proxy 5 Run the hotfix installation file. 6 Follow the on-screen prompts to complete the installation. Uninstall McAfee Client Proxy To fully uninstall Client Proxy, remove the software from the administrator operating system. 38 McAfee Client Proxy 1.2 Product Guide

39 Index A about this guide 5 access protection 17, 18 active directory groups 17, 18 B bypass key 35 C conventions and icons used in this guide 5 corporate network detection 17, 18, 34 corporate VPN detection 17, 18 customer ID 17, 18, 34 D deployment options 9 documentation audience for this guide 5 product-specific, finding 5 typographical conventions and icons 5 E end-user computer requirements 13, 29 epolicy Orchestrator 7 H hardware requirements 13, 29 I installation hotfix 24, 37 product files 14, 30 L log file settings 17, 18, 34 M McAfee Common Catalog 17, 19 McAfee epo block list, configure 19 bypass list, configure 19 McAfee epo (continued) Client Configuration 17 client settings, configure 18 deploy 9, 15 end-user installation data, view 20 extension, install 14 extension, remove 25 package, check in 15 package, remove 25 policy, configure 17 Proxy Server List, configure 18 setup 13 upgrade the software 23 McAfee SaaS Control Console block list, configure 34 bypass list, configure 34 proxy servers, configure 33 redirection settings, configure 34 McAfee SaaS Web Protection Service 17, 18, 31, 33, 34 McAfee ServicePortal, accessing 5 McAfee Web Gateway 7, 17, 18, 31, 33, 34 McAfee Web Protection Service 7 Microsoft Systems Management Server deploy 9 O operating system requirements 13, 29 overview 7 P policy assign 19 export to XML file 22 policy options block list 31 Block List 17 bypass list 31 Bypass List 17 Client Configuration 17 Proxy Server List 17 proxy servers 31 redirection settings 31 processes, block 19, 34 McAfee Client Proxy 1.2 Product Guide 39

40 Index Proxy Server List 18 Q queries 20 R release code 21, 35 reports 20 S server software requirements 13, 29 ServicePortal, finding product documentation 5 setup system requirements 13, 29 status and configuration details 35 T technical support, finding product information 5 traffic redirection 17, 18 U uninstall key 35 upgrade the software 37 V VPN 7 VPN detection McAfee Client Proxy 1.2 Product Guide

41 0-B00