Documentation | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Forcepoint Web Security PAC File Best Practices > What is a PAC file?
What is a PAC file?
PAC File Best Practices | Forcepoint Web Security | v8.4.x, v8.5.x
A Proxy Auto-Configuration (PAC) file is a JavaScript function definition that determines whether web browser requests (HTTP, HTTPS, and FTP) go direct to the destination or are forwarded to a web proxy server.
PAC files are used to support explicit proxy deployments in which client browsers are explicitly configured to send traffic to the web proxy. The big advantage of PAC files is that they are usually relatively easy to create and maintain.
The use of a PAC file is highly recommended with explicit proxy deployments of Forcepoint Web Security (for the Content Gateway—web proxy—component) and is required to support the Forcepoint Web Security Hybrid Module.
 
* 
Note 
These Internet resources provide excellent information, including PAC file JavaScript reference information, PAC file examples, and links to additional information:
This website: (http://www.findproxyforurl.com)
This Wikipedia article: (http://en.wikipedia.org/wiki/Proxy_auto-config)
These Microsoft knowledge base articles:
*
An IE10 presentation that focuses on WPAD files: "Enable Automatic Detection and Configuration of Browser Settings" (http://technet.microsoft.com/library/jj647643.aspx)
*
An older discussion with more information about PAC files: "Using Automatic Configuration, Automatic Proxy, and Automatic Detection" (http://technet.microsoft.com/en-us/library/dd361918.aspx)
A PAC file is a JavaScript function definition for FindProxyForURL(url, host). The complexity of the function varies with the requirements of each organization.
A PAC file is:
*
Flexible and extensible
*
Supported by all popular browsers
*
Easy to administer and maintain in any size network; however, as this paper explains, PAC files are easiest to administer when the browser is Internet Explorer
*
Able to support mobile devices that use standard browsers
A PAC file can:
*
Be stored on any server in your network. Small networks may store the file on the proxy itself, but large, enterprise-class networks should use a separate server for storing the PAC file
*
Determine where Internet and intranet requests are routed
*
Allow for exceptions in the form of bypassing the proxy for specified destinations
*
Perform load distribution
*
Handle proxy failover
Because PAC files are written in JavaScript, they support the structure, logic, and extensibility of JavaScript. See JavaScript functions most commonly used in a PAC file.
Why use a PAC file?
In explicit proxy and Forcepoint Web Security Hybrid Module deployments of Forcepoint Web Security, using a PAC file fulfills several vital functions:
1.
The PAC file provides critical security, ensuring that traffic is always proxied when it should be, while allowing secure requests to go direct to the destination.
*
Typically, Internet-bound HTTP, HTTPS, and FTP traffic is sent to the proxy.
*
Typically, intranet traffic goes direct to the destination.
*
Exceptions can be made for internal or external sites that, for whatever reason, must go to or bypass the proxy.
2.
The PAC file locks down the web browser's LAN egress configuration. The PAC file should be appropriately permission-protected so that end-users cannot change it. This is most easily accomplished when the PAC file is administered with a Group Policy Object. See How do I configure a Group Policy so that Internet Explorer uses the PAC file?
3.
The PAC file provides a flexible, easy to maintain, script-driven method of controlling the routing of web requests.
4.
The PAC file can include code that handles proxy load distribution and failover.
 
* 
Note 
It is important from an organizational security perspective that end users be prohibited from installing unapproved applications on their computers. Without such restrictions, users could install alternate browsers in an attempt to circumvent PAC controls. Within the organizational perimeter, by application of appropriate firewall rules, users should be forced to browse through the designated proxy server(s) only.

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Forcepoint Web Security PAC File Best Practices > What is a PAC file?
Copyright 2022 Forcepoint. All rights reserved.