Operating tips

Topic 60089 | Web Security Gateway and Gateway Anywhere | 12-Mar-2014

Installation

Configuration

Proxy user authentication

SSL Internal Root CA

Installation

Software installation location and file ownerships

Content Gateway is installed in /opt/WCG.

Files are installed with root ownership.

Content Gateway processes are run as root.

Internet connectivity

Ports

A full deployment of Content Gateway requires that several ports be open. See Installing Content Gateway in the Deployment and Installation Center for information about open ports and the reassignment of ports, if necessary.

Cluster handling during upgrades

Content Gateway tolerates different software versions in the same cluster. This is intended to simplify the process of upgrading a cluster. You should not run a cluster containing different versions for a prolonged period of time (many days).

Support for multiple versions in a cluster has these features and limits:

Configuration synchronization does not take place among nodes of different versions.

Condition alarms are passed among all nodes.

The VIP feature is supported.

'admin' password restrictions

The password you enter for the Content Gateway administrator during installation (default name: admin) must be 15 characters or fewer.

To create a strong password (recommended), use 8 or more characters, with at least 1 each of the following: capital letter, lower-case letter, number, special character.

The password cannot contain the following special characters:

space

$ (dollar symbol)

: (colon)

' (backtick; typically shares a key with tilde, ~)

\ (backslash)

" (double-quote)

Cache size

Cache size should be restricted to 147 GB. This size provides optimal resource utilization while also providing an excellent end-user experience. Because today's Internet sites are often composed of dynamic, uncacheable content, caching is a less significant factor in the end user's Web browsing experience.

Configuration

In explicit proxy deployments, send HTTPS traffic to port 8080

In explicit proxy deployments, when HTTPS (SSL support) is enabled, client browsers should be configured to send HTTPS traffic to proxy port 8080.

Accessing Intranet sites in an explicit proxy deployment

If your clients cannot access your Intranet sites, verify that your operating system has been correctly configured to resolve all internal and external hostnames. Use the nslookup command to verify that a domain is listed in your DNS server:

For internal-facing servers:

nslookup intranet.example.com

For external Web sites:

nslookup www.example.com

If your organization has multiple DNS domains, verify that a hostname in each domain resolves correctly. If you are unable to resolve hostnames, verify the contents of the /etc/resolv.conf file, which provides search rules for how domain names are resolved in DNS.

When Content Gateway is on a V-Series appliance, the domain of the hostname is automatically added to /etc/resolv.conf. For example, if the hostname of the appliance is vseries.example.com, then Content Gateway treats "intranet" requests as "intranet.example.com".

DNS proxy caching

The DNS proxy caching option allows Content Gateway to resolve DNS requests on behalf of clients. This option off-loads remote DNS servers and reduces response times for DNS lookups. You can use the DNS proxy caching option only with a layer 4 switch or a Cisco router running WCCP v2.

DNS proxy caching can only answer requests for A and CNAME DNS entries. Other types of request (e.g., MX) will not be answered.

Limitation: If the host name to IP address mapping is not in the DNS cache, Content Gateway contacts the DNS server specified in the /etc/resolv.conf file. Only the first entry in resolv.conf is used. This might not be the same DNS server for which the DNS request was originally intended.

See "DNS Proxy Caching" in Content Gateway Manager Help.

If your environment is configured such that you have DNS servers that resolve internal sites only and others that resolve external sites only, see Using the Split DNS option in Content Gateway Manager Help.

Virtual IP address must not match any real IP address

When configuring the Virtual IP feature, make sure that the Virtual IP addresses do not conflict with any existing IP addresses in the network.

Restart the proxy after protocol settings change

Any time you change your protocol settings in Content Gateway Manager (for example, with Configure > SSL > Decryption/Encryption > Inbound > Protocol Settings), you must restart the proxy for the new settings to take effect.

Using extended event logging

To investigate unexpected system behavior, it is sometimes helpful to enable the Log Transaction and Errors option (extended event logging) in Content Gateway Manager (Configure > Subsystems > Logging). However, extended event logging adds significant load to Content Gateway processes. Therefore you should not enable extended event logging when Content Gateway is at the high end of its processing capacity.

Reverse proxy

Content Gateway does not function as a reverse proxy.

Proxy user authentication

Client browser limitations

Not all Web browsers fully support transparent user authentication (prompt-less).

The following table indicates how a browser responds to an authentication request when Integrated Windows Authentication (IWA) is configured.


Browser/ Operating System	Internet Explorer (v9, 10 tested)	Firefox	Chrome	Opera (v12.02 tested)	Safari (v6.02 tested)
Windows	Performs transparent authentication	Performs transparent authentication (v21 tested)	Performs transparent authentication (v26, 27 tested)	Falls back to NTLM and prompts for credentials	Falls back to NTLM and prompts for credentials
Mac OS X	Not applicable	Performs transparent authentication (v21 tested)	Browser issue prevents IWA from working (v23 tested)	Not tested	Performs transparent authentication
Red Hat Enterprise Linux, update 6	Not applicable	Performs transparent authentication (v11 tested)	Browser issue prevents IWA from working (v27 tested)	Not tested	Not applicable