Contents

Related Topics

About the HTTPS-Proxy

HTTPS (Hypertext Transfer Protocol over Secure Socket Layer, or HTTP over SSL) is a request/response protocol between clients and servers used for secure communications and transactions. You can use the HTTPS-proxy to secure a web server protected by your Firebox or Firebox, or to examine HTTPS traffic requested by clients on your network. By default, when an HTTPS client starts a request, it establishes a TCP (Transmission Control Protocol) connection on port 443. Most HTTPS servers listen for requests on port 443.

HTTPS is more secure than HTTP because HTTPS uses a digital certificate to encrypt and decrypt user page requests as well as the pages that are returned by the web server. Because HTTPS traffic is encrypted, the Firebox must decrypt it before it can be examined. After it examines the content, the Firebox encrypts the traffic with a certificate and sends it to the intended destination.

You can export the default certificate created by your Firebox for this feature, or import a certificate for the device to use instead. If you use the HTTPS-proxy to examine web traffic requested by users on your network, we recommend that you export the default certificate and distribute it to each user so that they do not receive browser warnings about untrusted certificates. If you use the HTTPS-proxy to secure a web server that accepts requests from an external network, we recommend that you import the current web server certificate for the same reason.

When an HTTPS client or server uses a port other than port 443 in your organization, you can use the TCP/UDP proxy to relay the traffic to the HTTPS-proxy. For information on the TCP/UDP proxy, see About the TCP-UDP-Proxy.

To add the HTTPS-proxy to your Firebox configuration, see Add a Proxy Policy to Your Configuration.

Which Proxy Action To Use

When you configure a proxy policy, you must select a proxy action appropriate to the policy. For a proxy policy that allows connections from your internal clients to the internet, use the Client proxy action. For a proxy policy that allows connections to your internal servers from the internet, use the Server proxy action.

Predefined proxy actions with Standard appended to the proxy action name include recommended standard settings that reflect the latest Internet network traffic trends.

In Fireware v11.12 and higher, the Web Setup Wizard and WSM Quick Setup Wizard automatically adds an HTTPS-proxy policy that uses the Default-HTTPS-Client proxy action. The Default-HTTPS-Client proxy action is based on the HTTPS-Client.Standard proxy action and enables subscription services that were licensed in the feature key when the setup wizard was run. If you add a new HTTPS-proxy policy, the Default-HTTPS-Client proxy action could be a better choice than the HTTPS-Client.Standard proxy action. For more information about the Default-HTTPS-Client proxy action, see Setup Wizard Default Policies and Settings.

Configure the HTTPS-Proxy

These sections describe the HTTPS-Proxy configuration tabs in Fireware Web UI.Closed

Settings Tab

On the Settings tab, you can set basic information about a proxy policy, such as whether it allows or denies traffic, create access rules for a policy, configure policy-based routing, enable bandwidth and time quotas, configure static NAT, and server load balancing. The Settings tab also shows the port and protocol for the policy, as well as an optional description of the policy. You can use the settings on this tab to set logging, notification, automatic blocking, and timeout preferences.

Application Control Tab

If Application Control is enabled on your Firebox, you can set the action this proxy uses for Application Control.

  1. Select the Application Control tab.
  2. From the Application Control Action drop-down list, select an application control action to use for this policy, or create a new action.
  3. (Optional) Edit the Application Control settings for the selected action.
  4. Click Save.

For more information, see Enable Application Control in a Policy.

Traffic Management Tab

On the Traffic Management tab, you can select the Traffic Management action for the policy. You can also create a new Traffic Management action. For more information about Traffic Management actions, see Define a Traffic Management Action in v11.8.x and Lower and Add a Traffic Management Action to a Policy.

To apply a Traffic Management action in a policy:

  1. Select the Traffic Management tab.
  2. From the Traffic Management Action drop-down list, select a Traffic Management action.
    Or, to create a new Traffic Management action, select Create new and configure the settings as described in the topic Define a Traffic Management Action in v11.8.x and Lower.
  3. Click Save.

Proxy Action Tab

You can choose a predefined proxy action or configure a user-defined proxy action for this proxy. For more information about how to configure proxy actions, see About Proxy Actions.

To configure the proxy action:

  1. Select the Proxy Action tab.
  2. From the Proxy Action drop-down list, select the proxy action to use for this policy.
    For information about proxy actions, see About Proxy Actions.
  3. Click Save.

For the HTTPS-proxy, you can configure these categories of settings for a proxy action:

Scheduling Tab

On the Scheduling tab, you can specify an operating schedule for the policy. You can select an existing schedule or create a new schedule.

  1. Select the Scheduling tab.
  2. From the Schedule Action drop-down list, select a schedule.
    Or, to create a new schedule, select Create New and configure the settings as described in the topics Create Schedules for Firebox Actions and Set an Operating Schedule.
  3. Click Save.

Advanced Tab

The Advanced tab includes settings for NAT, QoS, multi-WAN, and ICMP options.

To edit or add a comment to this proxy policy configuration, type the comment in the Comment text box.

For more information on the options for this tab, see:

These sections describe the HTTPS-Proxy configuration tabs in Policy Manager.Closed

Policy Tab

To set access rules and other options, select the Policy tab.

Properties Tab

On the Properties tab, you can configure these options:

  • To edit or add a comment to this policy configuration, type the comment in the Comment text box.
  • To define the logging settings for the policy, click Logging.
    For more information, see Set Logging and Notification Preferences.
  • If you set the HTTPS-proxy connections are drop-down list (on the Policy tab) to Denied or Denied (send reset), you can block sites that try to use HTTPS.
    For more information, see Block Sites Temporarily with Policy Settings.
  • To change the idle timeout that is set by the Firebox or Firebox, or authentication server, see Set a Custom Idle Timeout.

Advanced Tab

 You can also configure these options in your proxy definition:

Configure the Proxy Action

You can choose a predefined proxy action or configure a user-defined proxy action for this proxy. For more information about how to configure proxy actions, see About Proxy Actions.

For the HTTPS-proxy, you can configure these categories of settings for a proxy action:

If you enable WebBlocker in an HTTPS proxy action, but do not enable content inspection, users do not see a deny message when content is denied by WebBlocker. For more information, see HTTPS-Proxy: WebBlocker.

See Also

About Proxy Policies and ALGs

Give Us Feedback  •   Get Support  •   All Product Documentation  •   Technical Search

© 2018 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, WatchGuard Dimension, Firebox, Core, Fireware, and LiveSecurity are registered trademarks or trademarks of WatchGuard Technologies in the United States and/or other countries.