McAfee Client Proxy 2.3 · McAfee® Client Proxy is endpoint client software for ... or by creating...

Product GuideRevision A

McAfee Client Proxy 2.3.2

COPYRIGHT

Copyright © 2017 McAfee, LLC

TRADEMARK ATTRIBUTIONSMcAfee and the McAfee logo, McAfee Active Protection, ePolicy Orchestrator, McAfee ePO, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes,McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee,LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others.

LICENSE INFORMATION

License AgreementNOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THEGENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASECONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVERECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOUDOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IFAPPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.

2 McAfee Client Proxy 2.3.2 Product Guide

Contents

1 Product overview 5What is the Web Protection hybrid solution? . . . . . . . . . . . . . . . . . . . . . . . . . 5How Client Proxy works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

Client Proxy metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6Integration with Endpoint Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

2 Managing Client Proxy policies 9Users and permission sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9Configuring the policy areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

How Client Proxy manages the proxy server list . . . . . . . . . . . . . . . . . . . . 10Configure the proxy server list . . . . . . . . . . . . . . . . . . . . . . . . . . 11Client configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12Configure the client settings . . . . . . . . . . . . . . . . . . . . . . . . . . . 12Configure the bypass list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12Configure the block list . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Assign the policy to the endpoint computers . . . . . . . . . . . . . . . . . . . . . . . . 14Export the policy to an .xml or .opg file . . . . . . . . . . . . . . . . . . . . . . . . . . 14Working with end users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

View information about Client Proxy on a Windows-based computer . . . . . . . . . . . . 15View information about Client Proxy on an OS X computer . . . . . . . . . . . . . . . . 15Suspending policy enforcement . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Index 17

McAfee Client Proxy 2.3.2 Product Guide 3

Contents


1 Product overview

McAfee®

Client Proxy is endpoint client software for Microsoft Windows and Mac OS X that is an essentialcomponent of the McAfee

®

Web Protection hybrid deployment solution. The Client Proxy technology allows youto apply your organization's web security policy to an endpoint computer, whether it is located inside or outsideyour network.

Contents What is the Web Protection hybrid solution? How Client Proxy works Integration with Endpoint Security

What is the Web Protection hybrid solution? The hybrid solution allows organizations to switch between the network-based and cloud-based securitysolutions provided by McAfee

®

Web Gateway and McAfee®

Web Gateway Cloud Service (McAfee®

WGCS),respectively.

Web gateways and other appliances do not protect equipment after it leaves your organization's network. Forexample, when users in your organization take laptops on business trips or work from home, they leave thenetwork's secure zone.

Client Proxy is installed on the computers of end users in your organization. Using the location-awarenesssettings that you configure, Client Proxy determines whether the computers are located inside or outside yournetwork or are connected to your network by VPN.

In a hybrid deployment, Client Proxy lets web requests sent by users working inside the network or connectedto the network by VPN pass. These requests are automatically redirected for filtering to a Web Gatewayappliance installed on the network. Web requests sent by users working outside the network, on the otherhand, are redirected to McAfee WGCS for filtering.

For more information about the hybrid solution, see the McAfee Web Protection Hybrid Deployment Guide.

End-user computers are referred to as endpoint computers.

1


How Client Proxy worksUsing location-awareness settings, Client Proxy protects the computers of end users in your organization,whether they are located inside or outside your network.

Client Proxy software redirects, blocks, or lets pass web traffic and network communications according to thepolicy you configure and location of the endpoint computer.

Figure 1-1 Client Proxy workflow

When an end user is working inside your organization's network, Client Proxy software:

1 Recognizes that the end user is working inside your organization's network

2 Remains passive, allowing web traffic and network communications to pass to Web Gateway for filtering

When an end user is working outside your organization's network, Client Proxy software:

1 Recognizes that the end user is working outside your organization's network

2 Redirects all web traffic and network communications to the McAfee WGCS service

Client Proxy metadataWhen the Client Proxy software redirects HTTP/HTTPS traffic, it adds metadata to the requests.

Proxy server administrators configure and apply policies based on the values in the metadata:

1 Product overviewHow Client Proxy works


• Authentication tokens • User groups

• Authentication version • Client IP address

• Customer ID • Original destination IP address

• User ID

The authentication version is the version of the metadata that Client Proxy shares with the proxy server.

Integration with Endpoint SecurityClient Proxy is available as a standalone product or integrated with Endpoint Security.

When integrated, Client Proxy joins the Endpoint Security family, including:

• McAfee® Endpoint Security Threat Prevention

• McAfee® Endpoint Security Firewall

• McAfee® Endpoint Security Web Control

Whether standalone or integrated, Client Proxy is managed using McAfee ePO and the management tasks arethe same. When Client Proxy is integrated with Endpoint Security:

1 The client software package is deployed to the endpoint and installed as a module on the Endpoint SolutionPlatform.

2 The administrator can configure Web Control so that it is disabled while Client Proxy is installed andrunning.

On a Windows-based computer, you can view the integration status of Client Proxy by opening the About McAfeeClient Proxy window. If EspMode is set to ON, Client Proxy is installed and running on the Endpoint SecurityPlatform.

Product overviewIntegration with Endpoint Security 1


1 Product overviewIntegration with Endpoint Security


2 Managing Client Proxy policies

In the McAfee ePO management console, you configure and manage Client Proxy policies.

Contents Users and permission sets Configuring the policy areas Assign the policy to the endpoint computers Export the policy to an .xml or .opg file Working with end users

Users and permission setsWe recommend creating specific administrator roles and permissions in McAfee ePO for the Client Proxycatalog administrator.

McAfee ePO defines roles and permissions in terms of Permission Sets. A default permission set installed with theproduct, MCP Catalog Admin, gives the Client Proxy administrator view and change permissions for policies andcertain Common Catalog items and actions. You can also assign an auditor role by adding view permission toone of the existing reviewer permission sets, or by creating a new permission set. You assign users topermission sets using Active Directory.

Configuring the policy areasClient Proxy policy configuration includes these areas: the proxy servers list, client configuration, the bypass list,and the block list.

2


Tasks• How Client Proxy manages the proxy server list on page 10

When configuring proxy servers for a Client Proxy policy, consider how Client Proxy manages theproxy server list.

• Configure the proxy server list on page 11To redirect web requests to a proxy server, configure the proxy server list and rules.

• Client configuration on page 12Client Proxy uses the Client Configuration settings to identify the customer and determine whetherendpoint computers are located inside or outside the network.

• Configure the client settings on page 12Configure the settings that Client Proxy uses to identify the customer and determine whetherendpoint computers are located inside or outside the network.

• Configure the bypass list on page 12Configure the McAfee® Common Catalog instance that Client Proxy uses to determine whichnetwork traffic is allowed to bypass the proxy server.

• Configure the block list on page 13Configure the list of processes running on endpoint computers that are blocked from accessing thenetwork.

How Client Proxy manages the proxy server listWhen configuring proxy servers for a Client Proxy policy, consider how Client Proxy manages the proxy serverlist.

The Client Proxy software maintains an ordered list of proxy servers. The proxy server with the fastest responsetime is placed at the top of the list. The software updates the list from time to time.

For example, the list is updated when the user starts the computer or the Client Proxy policy changes. It is alsoupdated if the VPN connection breaks or a proxy server fails to respond. At these times, the software tests theconnections to all proxy servers and reorders the list based on response times.

If redirection to the proxy server at the top of the list fails, the software tries redirecting to the second proxyserver in the list. At the same time, the software tests the proxy server connections again and updates the list.

When configuring how the Client Proxy software selects the next proxy server from the list, you have theseoptions:

• connect to the first accessible Proxy Server based on their order in the list below — The software selects the next proxyserver from the list that you configure.

• connect to the Proxy Server that has the fastest response time — The software selects the next proxy server from thelist that it maintains, which is based on response time.

Auto proxy switchover

When this option is enabled, the software checks the proxy server list at the interval you specify. If a higherpriority proxy server is available, the software automatically switches to it.

The auto proxy switchover option is only available when connect to the first accessible Proxy Server based on their orderin the list below is selected.

2 Managing Client Proxy policiesConfiguring the policy areas


Configure the proxy server list To redirect web requests to a proxy server, configure the proxy server list and rules.

When Client Proxy is deployed on-premise, you configure one or more Web Gateway appliances installed onyour network as the proxy servers.

To save the policy, you must configure at least one proxy server, and the configuration must include an IP addressor host name and a port number.

Task1 From the McAfee ePO menu, select Policy | Policy Catalog.

2 From the Product drop-down list, select the current version of Client Proxy.

3 To configure a policy, click the policy's name.

4 From the Client Proxy Settings menu, select Proxy Servers.

5 To specify how Client Proxy selects a proxy server from the list, choose an option:

• connect to the first accessible Proxy Server based on their order in the list below

• connect to the Proxy Server which has the fastest response time

6 To add proxy servers to the Proxy Server List, configure these settings, then click Add.

• Proxy Server Address — Specify the IP address or host name of the proxy server.

• Proxy Port — Specify the port number of the proxy server.

• HTTP/HTTPS — Select this checkbox to redirect all web requests sent to ports 80 and 443 to a proxy server.

• Non-HTTP/HTTPS Redirected Ports — Specify the port numbers of protocols other than HTTP/HTTPS whoserequests you want redirected. Verify that the proxy server supports these protocols.

Using the icons in the Actions column, you can edit, delete, or change the order of the proxy servers in the list.

7 Select Enable Auto proxy switch over to enable this option, then specify a value for the Polling interval in this range:10–3600 seconds. Recommended value: 60 seconds

The auto proxy switchover option is only available when connect to the first accessible Proxy Server based on theirorder in the list below is selected.

8 In the Specify additional ports that you would like to redirect as HTTP/HTTPS traffic field, specify the numbers of otherports whose web requests you want redirected like HTTP/HTTPS traffic. For example, you can redirectrequests sent to an application the same as requests sent to a web browser.

9 Deselect Bypass proxy server for local addresses to redirect all web requests, including those sent to localaddresses inside your organization's network, to a proxy server.

10 Click Save.

The configured proxy server list and redirection rules are saved.

Managing Client Proxy policiesConfiguring the policy areas 2


Client configurationClient Proxy uses the Client Configuration settings to identify the customer and determine whether endpointcomputers are located inside or outside the network.

• Customer Identifier — Client Proxy uses the customer ID and shared password to identify the customer andapply the customer's policy.

• Traffic Redirection Settings — Client Proxy uses this setting to determine when to redirect network traffic to theconfigured proxy servers.

• Corporate Network Detection — Client Proxy uses this setting to determine whether the endpoint computer islocated inside or outside the network.

• Corporate VPN Detection — Client Proxy uses this setting to determine whether the endpoint computer isconnected to the network through the VPN.

• Active Directory Groups Filter — Client Proxy uses the regular expressions that you configure to filter the list ofActive Directory groups included sent to the proxy server.

• Log File Settings (OS X Only) — Depending on this setting, Client Proxy logs error messages to a log file on eachendpoint computer.

• Access Protection (Windows Only) — Depending on this setting, Client Proxy is protected from unauthorizedremoval or tampering by end users.

Configure the client settingsConfigure the settings that Client Proxy uses to identify the customer and determine whether endpointcomputers are located inside or outside the network.




4 From the Client Proxy Settings menu, select Client Configuration.

5 In the Customer Identifier section, click Browse, select the ID file, then click Open.

This file is provided by the Web Gateway or McAfee WGCS administrator.

The Unique Customer ID and Shared Password fields are automatically populated.

6 Configure the remaining options.

Configure the bypass listConfigure the McAfee

®

Common Catalog instance that Client Proxy uses to determine which network traffic isallowed to bypass the proxy server.

Each Client Proxy policy has a Common Catalog instance associated with it. The catalog is a list that youconfigure and that Client Proxy uses to determine which network traffic bypasses the proxy server.

The bypass list can include domain names, network addresses, network ports, and the names of processes thatendpoint computers are allowed to access directly. Updating the bypass list in McAfee ePO also updates theCommon Catalog instance associated with the policy.

Process names can be in Microsoft Windows format (test.exe) or Mac OS X format (test).

2 Managing Client Proxy policiesConfiguring the policy areas





4 From the Client Proxy Settings menu, select Bypass List.

5 In the Bypass List window: From the Actions menu, select Add bypass list item, then select an item type.

The Choose from existing values dialog box opens.

6 Do one of the following:

• Select one or more existing catalog items.

• Click New Item, enter the new information, then click Save.

7 Click OK.

Configure the block listConfigure the list of processes running on endpoint computers that are blocked from accessing the network.

Each Client Proxy policy has a list of blocked processes associated with it. The block list is designed to reducethe amount of unwanted traffic that is redirected to the proxy server for filtering. Occasionally, the block list canrestrict access to Internet resources, where the restriction was not intended.




4 From the Client Proxy Settings menu, select Block List.

5 Select an option:

• Allow traffic to go directly to destination — No processes are blocked.

• Block traffic for all processes (except bypass listed processes) — All processes are blocked except for processeswhose names are on the bypass list. These processes are allowed to access the network directly.

• Block traffic only for the following processes — To configure the list of processes that you want blocked, enterthe process names, clicking Add after each entry.

Windows process names must end with the .exe extension. Mac process names can be specified withoutthe extension.

6 Click Save.

Managing Client Proxy policiesConfiguring the policy areas 2


Assign the policy to the endpoint computersUsing McAfee ePO, assign the Client Proxy policy to specified endpoint computers in your organization'snetwork.

Task1 From the McAfee ePO menu, select Systems | System Tree.

2 From the System Tree menu, select a group or subgroup.

3 Click the Assigned Policies tab.

4 From the Product drop-down list, select the current version of McAfee Client Proxy.

5 In the Actions column, click Edit Assignment.

The Policy Assignment for My Organization window appears.

6 Next to Inherit from, select Break inheritance and assign the policy and settings below.

7 From the Assigned policy drop-down list, select the policy.

8 Choose whether or not to lock policy inheritance.

9 Click Save.

Assign a Client Task to schedule the policy deployment to the endpoints.

Export the policy to an .xml or .opg fileYou can export the Client Proxy policy to an .xml file for troubleshooting or to an .opg file for import by clientcomputers in your organization.



3 To export a policy, click the policy's name.

The Client Proxy Settings pane opens.

4 From the Actions drop-down list, select Export Policy to File.

The Export Policy to File dialog box opens.

5 Click a link:

• McAfee Client Proxy Policy Server File — Exports the policy to a .xml file that you can use for troubleshooting.

• McAfee Client Proxy Policy Client File — Exports the policy to a .opg file that can be imported by clientcomputers in your organization.

6 Save the file.

7 Click OK.

2 Managing Client Proxy policiesAssign the policy to the endpoint computers


Working with end usersEnd users can view information about Client Proxy on their computers or temporarily suspend policyenforcement by contacting a McAfee

®

Help Desk administrator.

View information about Client Proxy on a Windows-based computerOn an endpoint computer running Windows, you can view information about the Client Proxy software, policy,and status.

Task1 On a Windows-based computer, click Start | All Programs | McAfee, then click About McAfee Client Proxy.

2 In the McAfee Client Proxy window, you can view the following information:

• Version Number — Specifies the version and build number of the Client Proxy software installed on theendpoint computer.

• Active Proxy — Specifies the address of the proxy server to which Client Proxy is redirecting traffic.

• Connection Status — Specifies whether the endpoint computer is connected to the network.

• EspMode — Specifies whether Client Proxy is installed and running on the Endpoint Solution Platform.

• Policy Name — Specifies the name of the policy that Client Proxy is applying.

• Policy Revision — Specifies the revision number of the policy that Client Proxy is applying.

• Policy Timestamp — Specifies the time when the Client Proxy policy was deployed to the endpointcomputer.

• Status — Specifies whether Client Proxy is working in active or passive mode.

3 To close the window, click Ok.

View information about Client Proxy on an OS X computerOn an endpoint computer running OS X, you can view information about the Client Proxy software, policy, andstatus.

Task1 On an OS X computer, click the McAfee menulet and select About McAfee Endpoint Protection for Mac.

In the Client Proxy section, the following information is displayed:

• Client Proxy version and build number • Policy modified date

• Policy name • Proxy server

• Policy revision

2 Verify that you are connected to the proxy server: From the menulet, select the dashboard.

This message is displayed: Client Proxy: Redirecting.

Suspending policy enforcementEnd users can request permission to access or transfer sensitive information for a limited time.Occasionally, there is a legitimate business reason to temporarily suspend the security policy so that sensitiveinformation can be accessed or transferred. Client Proxy uses a challenge-response mechanism to perform thisfunction.

Managing Client Proxy policiesWorking with end users 2


The end user sends a request to an administrator, including the policy revision number and identification codedisplayed in the Enter Release Code dialog box. Using this information and the McAfee

®

Help Desk software, theadministrator creates a release code and then sends it to the end user.

The release code is valid for a limited time, and the time allowed for policy suspension is limited as well. Thus,the end user must enter the release code in the dialog box and complete the task that requires policysuspension before the allowed time period expires.

Best practice: Removing the software from endpoint computers

Client Proxy software cannot be removed from endpoint computers without authorization. Usually, theadministrator uninstalls the software using McAfee ePO.

If McAfee ePO is not available and the endpoint computer is running Windows, the administrator can uninstallthe software using the Windows Add or Remove Programs tool. In this case, the administrator uses thechallenge-response mechanism to generate the release key.

Generate a release codeTo temporarily suspend policy enforcement on endpoint computers, users request a bypass release code froma Client Proxy administrator. Using Help Desk software, administrators create a release code and send it to theend user.

Task1 To request a bypass release code on an endpoint computer, do one of the following:

• On Mac OS X computers: From the McAfee menulet on the status bar, select McAfee Endpoint Protection forMac Preferences, then select Client Proxy.

• On computers running Windows: Click Start | All Programs | McAfee, then click Bypass McAfee Client Proxy.

The McAfee Client Proxy Enter Release Code dialog box opens.

While you are waiting for the administrator to send the release code, leave this dialog box open. If you closeit, you must start the procedure over.

2 Copy the number in the Policy Revision field and the code in the Identification field, send these values to youradministrator, and include your user name and email address.

3 When your administrator sends the release code, enter the code in the Release field, then do one of thefollowing:

• On Mac OS X computers: Click Release.

• On computers running Windows: Click OK.

Policy enforcement is suspended for the time period specified by the administrator when creating the code.

2 Managing Client Proxy policiesWorking with end users


Index

Aaccess protection 12

Windows 12

Active Directorygroups filter 12

Active Directory groups 12

authentication tokens 6authentication version 6

Bblock list

configuring 13

bypass listconfiguring 12

Cchallenge-response mechanism 15

client configuration 12

Client Proxyassigning a policy 14

how the software works 6integrated with Endpoint Security 7managing the proxy server list 10

metadata 6Client Proxy software

removing from endpoint computers 15

Client Proxy, aboutviewing on a Windows-based computer 15

viewing on an OS X computer 15

client settingsconfiguring 12

Common Catalog 12

corporate network and VPN detection 12

corporate network detection 12

corporate VPN detection 12

customer ID 6, 12

EEndpoint Solution Platform 7EspMode 7

Hhybrid solution 5

IIP addresses

client and original destination 6

Llog file settings 12

OS X 12

MMcAfee WGCS

configuring as the proxy server 11

metadataClient Proxy 6

Ppermission sets 9policies

Client Proxy 14

exporting to an .xml or .opg file 14

suspending 15

policy areasconfiguring 9

processesblocking 13

proxy server listconfiguring 11

how Client Proxy manages 10

Rrelease codes

generating 16

Sshared password 12

Ttraffic redirection 12

traffic redirection settings 12


Uuser groups 6user ID 6

WWeb Control 7

Web Gateway appliancesconfiguring as proxy servers 11

Web Protectionhybrid solution 5

Index


McAfee Client Proxy 2.3 · McAfee® Client Proxy is endpoint client software for ... or by creating...

Documents

Transcript of McAfee Client Proxy 2.3 · McAfee® Client Proxy is endpoint client software for ... or by creating...