Define hybrid service filtered locations

Administrator Help | TRITON AP-WEB | Version 8.3.x

Related topics:

Specify sites not managed by the hybrid service

Configure user access to the hybrid service

Schedule communication with the hybrid service

Use the Settings > Hybrid Configuration > Filtered Locations page to review, add, or edit information about the locations whose Internet traffic is managed by the hybrid service.

A filtered location is the external IP address, IP address range, or subnet from which Internet requests appear to originate when seen by the hybrid service. Hybrid policy enforcement can be applied to off-site users, regardless of how requests from those users are managed when they are in-network.

For users managed by the hybrid service both in and outside the network, enter their in-network location details and specify that the location managed by the hybrid service. When off-site users make an Internet request, they are prompted to log on to the hybrid service so that the appropriate user or group-based policy can be applied.

Because the hybrid service is hosted outside your network, any locations managed by the hybrid service must be external addresses, visible from the Internet. Locations managed by the hybrid service:

Are public-facing IP addresses

Are often the external address of your Network Address Translation (NAT) firewall

Could include branch offices, remote sites, or satellite campuses

These locations are NOT:

IP addresses of individual client machines

The IP address of any Content Gateway machine

For users whose requests are managed by on-premises components (Filtering Service) when they are inside the network, you can configure the browser PAC file to determine whether the user is in-network or off-site before forwarding an Internet request.

If you are using the PAC file generated by the hybrid service, this configuration occurs automatically based on the settings that you provide on the Filtered Locations page. Specify that these users are managed by local web protection software and define whether their on-premise policy enforcement is through a firewall-integrated or transparent proxy (for example, Content Gateway in transparent mode), or an explicit proxy. If Internet requests from in-network machines at a specified location pass through an explicit proxy, you provide the proxy location (hostname or IP address) and port to ensure requests are routed properly for users at that location.

Each location that you define appears in a table that combines a name and description with technical configuration details, including the selected proxy mode, the type of location (single IP address, IP address range, or subnet), and the actual external IP address or addresses from which requests originate.

To edit an existing entry, click the location Name, and then see Adding or editing hybrid service filtered locations.

To define a new location, click Add, and then see Adding or editing hybrid service filtered locations.

To remove a location, mark the check box next to the location name, and then click Delete.

To add and edit on-premises explicit proxies for use with filtered locations, click Manage Explicit Proxies, then see Managing hybrid service explicit proxies.

If you have added or edited a location entry, click OK to cache your changes. Changes are not implemented until you click Save and Deploy.