This slide deck takes you through the role and architecture of the ProxyClient as an add-on solution that meets the application delivery and security

Transcription

1 This slide deck takes you through the role and architecture of the ProxyClient as an add-on solution that meets the application delivery and security needs in your network. Each slide presents the important points and the notes elaborate on the topics that need more discussion. This slide deck is not a whitepaper. 1

2 2

3 3

4 Blue Coat ProxyClient is a client-based platform that extends IT s sphere of influence beyond the traditional physical boundaries of the enterprise. It is part of Blue Coat s overall enterprise solution for application delivery that interconnects with Blue Coat s ProxySG appliances to provide application acceleration and/or security for all users whether at headquarters, regional and branch offices, on the road, or at home. With the ProxySG appliance running Blue Coat s 5-part Multiprotocol Accelerated Caching Hierarchy (MACH5) edition license, the ProxyClient leverages the MACH5 technology to optimize data, video, cloud and web applications in IPv4, IPv6 or mixed environments. The MACH5 technology combines protocol acceleration, compression, object and byte caching and QoS to help accelerate key applications such as file access, , web, storage replication and backup; it accelerates a wide array of applications including internally and externally-hosted encrypted applications. When used for security (with the Proxy Edition license on the ProxySG appliance), the ProxyClient offers proactive protection from Web threats using Blue Coat WebPulse. WebPulse provides immediate cloud analysis of new or recently compromised Web links using proactive machine analysis, multiple anti-malware engines, and/or Web hunters. Location awareness enables administrators to improve efficiency and make intelligent use of the ProxySG appliances in the network by enabling or disabling ProxyClient acceleration and Web filtering functionality based on a user s location. For example, the administrator can disable both acceleration and Web filtering when a user is in the office and a local ProxySG is available to perform those functions. Conversely, both acceleration and Web filtering are enabled for mobile users when there is no local ProxySG to perform those functions. The ProxyClient application automatically detects its location by matching a combination of IP address, virtual NIC IP address, and DNS server address as configured by the ProxySG administrator. Finally, using the Blue Coat Reporter, you can create centralized reports and drill down into remote client Web activities to meet HR and IT requirements. You can also use these reports to further refine the Web access rules for your network, as 4

5 needed. 4

6 To provide remote Web control (block applications and Web content) and LAN-like response for applications to your remote users, your Application Delivery Network (ADN) requires the framework/components listed above. To understand how the Blue Coat ADN works, refer to the ADN Overview slides in this deck. 5

7 6

8 The ProxyClient software is installed using a Microsoft installer (ProxyClientSetup.msi) on a Windows client and using a MAC installer (ProxyClientSetup.bsx) on a Mac client. The installer installs the ProxyClient application service and the drivers the Web filter driver and the acceleration driver. The Web filter driver does the following: Intercepts HTTP and HTTPS connections Parses out HTTP URLs Forwards URLs to URL rating service The Acceleration driver does the following: Intercepts all the TCP connections Redirects the connections to proxy service based on routing policy The Tray icon Retrieves ProxyClient service status for local web server Displays the key status events 7

9 This is the architecture of the ProxyClient Service. The function of each component is described below: Service manager Starts, stops and monitors the service Client Manager (CM) service Communicates with the ProxyClient Client Manager for software, policy and status updates URL rating service Communicates with the WebPulse (Dynamic Real Time Rating) service Proxy service Proxies TCP connections based on the routing policy CIFS proxy service Protocol optimization Object caching ADN service Manages ADN tunnels and byte cache Local Web server Serves status, statistics and log entries to browser UI and tray icon Serves exception pages to Web filter module Logging service Collects and uploads logs 8

10 Support for MacOS was introduced in ProxyClient 3.4 9

11 When the ProxyClient is removed from a user's system, all installed software, drivers and supported files are removed. The removal process marks the files for removal upon reboot; and the files are automatically removed when the system is restarted. 10

12 11

13 For servicing the needs of remote users (ProxyClients) in your ADN, you need a ProxyClient Manager, an ADN Manager and an ADN Concentrator. The role that each device plays on your network is listed below: The ProxyClient Manager provides the following services: Software for the client (initial deployment and updates). The Client Manager hosts the software binaries that users can download and automatically informs users when updates are unavailable. The ProxyClient also periodically polls the ProxyClient Manager on port 8084 for configuration and software updates Periodic verification of the Blue Coat Web Filter (BCWF) license and database (required to use BCWF) Monitoring Client configuration management (such as Web filtering policy) The ADN manager publishes routes advertised by the AND Concentrator(s) on the network. The ProxyClient maintains a management session with the ADN manager on port This session is used to receive ADN routing table updates and the ProxyClient uses this information to route traffic to the appropriate ADN Concentrator and retrieve content from the server. The ADN Concentrator must advertise the subnets to which it is connected so that the ADN peers (other ProxySG appliances and ProxyClients) can establish connections with it. When a ProxyClient connects to an ADN Concentrator, it connects to the physical IP of the Concentrator and uses port 3035 (the default) as the destination port. If the same appliance is used for the proxy features and as the ADN Concentrator: you must use a Virtual IP for the proxy service(s) and it must be different from the IP of the physical interface. the Concentrator s IP address is displayed as the source IP in the logs and in policy. Note: Although you can elect to use one appliance to function both as an ADN Manager and as a ProxyClient Manager, the ADN

14 Concentrator is best when configured as a standalone appliance. 12

15 13

16 In conjunction with the ProxySG, the ProxyClient accelerates a wide array of applications, including internally and externally-hosted encrypted applications. The devices combine protocol acceleration, compression, object and byte caching, and QoS to help accelerate key applications such as file access, , web, storage replication and backup. When used for acceleration, the ProxyClient receives the following Acceleration configuration from the Client Manager: Which application port to optimize Which CIFS specific acceleration features to use Location awareness: where the ProxyClient needs to be activated for both acceleration and Web filtering Automatic updates 14

17 When a ProxyClient at the edge communicates with a ProxySG appliance/adn Concentrator at the core, the communication takes place over a connection called an ADN tunnel. This ADN tunnel accelerates and optimizes traffic between the two devices. For example, when a user requests a file, the VPN on the client machine (with ProxyClient installed) connects to the VPN firewall, which then connects to the ProxySG appliance/adn Concentrator at the data center. The connection between the ProxyClient and the ProxySG is an ADN tunnel that uses the IP address of the ProxySG on port This ADN tunnel accelerates and optimizes the request and response between the user and server. 15

18 This slide explains how the first-time connection happens and the AND tunnel is formed to accelerate and optimize data. The ProxyClient always connects explicitly to the ADN Manager/Concentrator. When a client requests data from a file server, the first-time connection occurs as follows: 1. TCP Connect 2. ADN Connect 3. Client request 4. Server response with the data requested by the client 16

19 A proxy service is a logical grouping of traffic flows that share the same characteristics, such as a specific application or protocol such as CIFS or HTTP. To manage a particular type of traffic, ProxySG/ProxyClient must detect and intercept the service for that traffic and perform specified actions to route/ optimize and accelerate the flow. If the proxy services are enabled, the ProxyClient redirects the client request to the appropriate proxy based on the configuration. The ProxyClient refers to the network routing information that the ADN Manager advertised to it and redirects the connection to the appropriate ADN Concentrator to access the file server and service the request. If for example, the client opens a CIFS file share, the ProxyClient enables the CIFS proxy to optimize and accelerate the ensuing traffic. The CIFS proxy accelerates file shares located on remote servers by byte caching, which is locally caching regions of files that are read or written by the client; The CIFS proxy also performs object caching for both read and write file activities. Note: Both SMBv1 and v2 are supported, but protocol optimization and object caching limitations may apply to SMBv2 connections. 17

20 18

21 Most organizations have an acceptable use policy that governs the use of the Internet but they lack the ability to enforce these policies outside of a LAN. Blue Coat ProxyClient extends the enforcement of the enterprise policy and enables a single policy to cover all users, regardless of where they connect to the Internet. The ProxyClient connects the user to the Blue Coat WebFilter (BCWF) ecosystem that continually tracks, evaluates and dynamically rates millions of websites every day. Thus, once the user leaves the sphere of control created by the corporate secure gateway, he/she remains protected from Internet threats such as spyware and phishing and are in compliance with corporate policy on accessing or downloading applications and executable content. Thereby, the ProxyClient ensures productivity and risk management for users outside the LAN. To use Web filtering, the ProxyClient Client Manager must have a valid BCWF license. The Client Manager is a ProxySG appliance that provides the management infrastructure to ProxyClients. It can be any appliance in the ADN network, including an ADN Concentrator, the ADN Manager, or a backup manager. Commonly, the Client Manager appliance is deployed in the intranet behind the enterprise VPN gateway, with a router connection to the Internet. When used for security, the Client Manager must: Have the Proxy Edition license for the content filtering functionality; Blue Coat Web Filter must be enabled and the database downloaded to the device. Be accessible to ProxyClients directly on the Internet (Port 8084) or via VPN to periodically to check for filtering configuration changes; by default the client polls the manager every two hours. To meet HR and IT requirements, you can upload logs from the user s machine to the Blue Coat Reporter, and then create 19

22 centralized reports and drill downs into the Web activities of the remote user. 19

23 When a user requests Web content, the client machine with ProxyClient installed, sends the request to the WebPulse service. However, to determine the rules that should apply for the requested content (whether to block or allow the content) the ProxyClient depends on the Client manager. For example, if WebPulse categorizes the content as Social Networking, ProxyClient uses the Web access policy rules that it received from the Client Manager to determine whether or not the user is allowed to view the requested content. 20

24 21

25 22

26 WAN optimization is a set of technologies for accelerating, compressing, and securing application traffic across distributed network environments. The Application Delivery Network (ADN) is the core of Blue Coat s WAN optimization solution; it defines the framework that enables application acceleration between various corporate offices and endpoints separated by a WAN. In an ADN, ProxySG appliances are integrated into the network in different roles to provide visibility, acceleration, and control for all TCP (and UDP streaming) traffic sent over the WAN, including Web (HTTP), secure Web (SSL), file sharing (CIFS), Microsoft Outlook/Exchange (MAPI), DNS, live and on-demand streaming (RTSP, MMS, streaming over HTTP) traffic, and TCP-based applications. 23

27 An optimal ADN network will have the following devices: Branch or Edge Peers: The ProxySG appliances or ProxyClients that are placed in the local branch or endpoint to create ADN tunnels that can optimize traffic over the WAN; Typically the ADN Concentrator is placed in the datacenter or core and it terminates ADN connections. When a client makes a request, an ADN tunnel is formed between the local ProxySG appliance that the client is behind and the ProxySG appliance that fronts the server that hosts the requested content or between the ProxyClient and a ProxySG appliance that fronts the server that hosts the requested content. The ProxySG appliance closer to the server that hosts the content, terminates the connection, unoptimizes the data and serves the client s request. The content is then optimized and served back to the client over the ADN tunnel. ADN Manager: A ProxySG appliance that is responsible for publishing the routing table to ProxyClients and to other ProxySG appliances that serve as ADN peers. The ADN routing table specifies the ProxyClients and the ProxySG appliances that are available for routing traffic through the WAN for acceleration and optimization. ProxyClient Manager: A Client Manager is a ProxySG appliance that provides the management infrastructure to ProxyClients. The ProxyClient depends on the Client Manager for route information that enables it to form ADN tunnels and accelerate network traffic. The ProxyClient connects directly to the IP address of the advertised ProxySG appliance that fronts the content servers from which the user wishes to access or retrieve content. 24

28 To understand the role of the ADN Manager and the process that is uses to publish routes to ProxyClients and other ProxySG appliances that serve as ADN peers, see the network diagram above. The next 3 slides take you through the process of how the peer database on each device is populated so that the traffic can be accelerated and/or optimized to deliver the best user experience. In this network diagram, keep the following details in mind: SN 9999 is the ADN Manager SN 2000 fronts the file server and functions as an ADN Concentrator that terminates requests made to the file server SN 1001 is a Branch Peer SN Px 2002 and Px 3003 are remote users that have ProxyClient installed on their laptops Note: An ADN Manager is not required for all ADN deployments; It is required for a ADN with ProxyClients. 25

29 After you complete the configuration to define the appliance with IP as the ADN Manager, the serial number of the appliance (9999) is automatically added to its routing table. On the ADN Concentrator (SN 2000), after you configure the IP address of the ADN Manager, the appliance first adds its own serial number to its routing table and then sends its SN to the ADN Manager. The ADN Manager then adds the SN to its routing table and reciprocates with its SN. This process creates a mutual entry on the routing table for both devices. 26

30 Next when you configure the ADN Manager on the branch peer with SN 1001, it sends its SN number information to the ADN Manager which then appends the SN to its routing table and then it publishes its updated routing information to the devices it manages concentrator and the branch peer. 27

31 The same update process happens with the ProxyClients. The ADN Manager receives information on the SN of the ProxyClients on the network and updates its routing table to reflect the most current list of devices it manages. While the ADN Manager maintains a list of all managed devices, the routing table on the individual appliances only contains information on other appliances (and not ProxyClients), and each ProxyClient has a list of itself and all other appliances managed by the ADN Manager. 28

32 29

33 30

34 The ProxyClient requires an explicit ADN deployment. That is there must be an ADN Manager that publishes routes advertised by the ADN Concentrator(s) on the network; the ADN Concentrator must advertise the subnets to which it is connected so that the ADN Branch peers can establish connections with it. In the example above, after you configure the ADN Concentrator to advertise the subnets that its serves, the sequence of events is as follows: 1: The Concentrator advertises the routing information on the server subnets that it services to the ADN Manager. 2. The ADN Manager publishes the server subnet information along with the IP address of the Concentrator to which the devices must connect to access the file servers serviced by the Concentrator. 3. When a user requests content from file server , the ProxyClient (installed on the client machine) establishes an ADN connection to the ADN Concentrator with IP

35 32