What is the hybrid PAC file?

Administrator Help | Forcepoint Web Security | v8.5.x

A Proxy Auto-Configuration file is a JavaScript function definition that a browser calls to determine how to handle requests. The PAC file used to enable hybrid policy enforcement contains a number of global settings and allows you to configure sites (for example, intranet sites or organizational webmail) that users can access directly, without sending the request to the hybrid service (see Specify sites not managed by the hybrid service).

If you want to use the hybrid service on client machines, you must configure browser settings on each of the clients to point to the URL hosting the PAC file. This URL is displayed on the Hybrid Configuration > User Access page (see Configure user access to the hybrid service).

The exact mechanism for configuring a browser to use the PAC file depends on the browser and network environment. For example, if you are using Microsoft Active Directory and Internet Explorer or Mozilla Firefox, you have the option to automate the process via group policies. Users can also be instructed to set up their browsers manually.

For Microsoft Internet Explorer, go to Tools > Internet Options and click the Connections tab. Click LAN Settings, and then mark Use automatic configuration script. Enter the PAC file URL in the Address field.

For Mozilla Firefox, go to Tools > Options, click the Advanced icon, and then select the Network tab. Under Connection, click Settings, and then select Automatic proxy configuration URL. Enter the PAC file URL in the blank field.

The default PAC file is supplied by the hybrid service, and comprises default settings and any changes you make on the Hybrid Configuration pages. If you want to customize the PAC file, create a directory named pac in the ssdata directory (by default, \Program Files\Websense\Web Security\bin\ssdata\pac on Windows, or /opt/websense/bin/ssdata/pac on Linux). Then you have the following options:

To use your own PAC file, create a file named websense.pac and place it in the pac directory.

To add a customized fragment to the default PAC file, place the JavaScript fragment in a file named customfinal.pac, and put it in the pac directory. This fragment is appended to the default PAC file, replacing the token _CUSTOMFINALPAC_.


	Important The customized websense.pac file must contain the following function: function FindProxyForURL(url, host) {} If this function is not in the file, it will be rejected by the hybrid service.

If either of these files exists in the pac directory, Sync Service detects it and sends the data to the hybrid service. The file must be greater than 0KB and smaller than 256KB (50 KB for versions prior to v8.5.5) for Sync Service to send it. Sync Service also detects when there is a newer version of the PAC file or fragment and updates the version on the hybrid service.

The recommended state for custom PAC files is to set up a custom file or a custom fragment, not both. If both files exist in the pac directory, we recommend you decide whether a full customized PAC file or a customized fragment suits your needs better, and delete the other file from the directory.

To stop using a customized PAC file or fragment, delete the file or fragment from the pac directory.

The Hybrid Service page displays the type of PAC file you are using, and lists the date and time that Sync Service last sent a customized file or fragment to the hybrid service (see Monitor communication with the hybrid service).

If you are unfamiliar with PAC files, Wikipedia has a good introductory article, and a good website for more information and several example PAC files is http://www.findproxyforurl.com/.