Explicit Web Proxy

How Explicit Proxy Works?

Lets consider an example. In Figure 1, a client initiates HTTP connection to reach www.example.com. Client device first connects with SRX Series acting as explicit proxy on (10.4.0.254 and port 8080).

The client network connects to the SRX Series Firewall on ge-0/0/1 interface with IP address 10.4.0.254. SRX Series connects to Internet using the interface ge-0/0/2 with IP address 10.5.0.254.

For each session initiated by the client browser, the SRX Series creates two sessions:

S1: Session originating from client browser to explicit web proxy

S2: Session originating from explicit web proxy to actual destination server.

Table 1 provides details on the explicit web proxy sessions.

Table 1: Explicit Proxy Session Details

Session Type	Source IP/Port	Destination IP/Port	Policy	Comments
Client to SRX Series (S1)	Client IP / dynamic port range	SRX Series interface IP (10.4.0.254) / fixed port (8080)	Security policy/unified policy (explicitly configured on SRX Series)	Client traffic directly comes to the SRX Series interface where explicit proxy profile is configured.
SRX Series to actual destination server (S2)	SRX Series egress interface IP (10.5.0.254)/ dynamic port range	End server as resolved by DNS (203.0.113.0) or in explicit proxy request	Implicitly inherited from S1	SRX Series establishes the connection with actual server (www.example.com).

Benefits

• Explicit web proxy secures network by controlling and filtering the inbound and outbound traffic.
• Explicit web proxy performs DNS resolution on client's behalf.

Steps to Configure Explicit Proxy on SRX Series Firewall

To manage explicit proxy for connections to your network, you must:

1. Enable web-management services and configure web-authentication feature on an interface
2. Enforce users to authenticate before they can connect to your network. When you enforce authentication in the explicit proxy, unauthenticated connections are redirected to the Firewall authentication page.
3. Configure the explicit proxy profile.
4. Configure explicit proxy on an interface. This interface must be connected to client network. The client browsers use this IP address to forward requests to the SRX Series device. You can configure and attach multiple explicit proxy profiles to a particular IP address in the interface. However, you must ensure that there must not be overlapping ports between the explicit proxy profiles.
5. Use security policies to control the explicit web proxy traffic.
6. Attach SSL proxy service to the explicit proxy policy.
7. Configure default-policy for the explicit proxy.

Security Policy Support for Explicit Web Proxy

You must configure and enforce security policies to manage the traffic for the explicit proxy. Explicit proxy profile needs a set of unique security policies or unified policies. The firewall determines which profile to leverage for a policy lookup based on the ingress interface and port combination. Once the firewall identifies the explicit proxy profile for a flow, it performs a policy lookup.

SRX Series Firewall uses the following sequence for the policy lookup:

• Source IP address, source-port, protocol, and source identity
• DNS-based destination IP resolution
• URL category detection
• Dynamic Layer 7 application match
• DNS-based destination resolved IP reputation
• Hardcoded destination IP address or reputation of hardcoded destination IP address

Configuring Explicit Proxy Profile Policy

You can configure the explicit proxy profile rule-base using the following statement:

You can notice that this policy, similar to the global policies, does not need security zones.

To attach a security policy with explicit proxy profile, the profile name mentioned in policy configuration must match with the name of the explicit proxy profile configured under web-proxy services (set services web-proxy explicit-proxy profile <profile-name>).

Example:

Create a policy for the explicit proxy profile named "profile-site-A".

Ensure that the explicit profile policy also uses the same name:

• Limitations
• Default Policy for Explicit Proxy