Configure the ProxySG to serve multiple PAC files

Products

• Advanced Secure Gateway Software - ASG
• ProxySG Software - SGOS

Issue/Introduction

SGOS provides two Proxy Automatic Configuration (PAC) files natively:

• The default, standard, read-only PAC file called "http://<proxy>/proxy_pac_file"
• The user-defined "http://<proxy>/accelerated_pac_base.pac"

For those wishing to use the "wpad.dat" method of acquiring a PAC file from the ProxySG, add policy that returns a "302 Redirect" to the browser, which a browser will follow and ultimately be served.

See How to create a custom exception page using the ProxySG command line interface for a good overview of how to create exception pages using the CLI method. Simply replace the HTML text with a raw, unaltered PAC file.

Resolution

While exception pages are normally used for displaying HTML rendered within a browser, they can also be used to simply serve data -- in this case, the PAC file contents.

Call it "pacA"

• Create a custom exception page with its content being the PAC file to serve to clients from subnet group "B".
  Call it "pacB"
   
• Be sure to change the HTTP response-status code to "200" for each custom exception page, as described in How to create a custom exception page using the ProxySG command line interface.

 

So far the custom exception pages have only been defined (which happen to contain PAC files "A" and "B"). The following steps will utilize them via policy. 

• Since browsers expect a PAC file to have a specific MIME type, this must be set in the <Exception> layer, which is not editable in Visual Policy Manager (VPM); therefore, the following Content Policy Language (CPL) must be added to the Local (or Central or Forward) Policy File:

<Exception>
    exception.id="user-defined.pacA" action.setpacheader(yes)
    exception.id="user-defined.pacB" action.setpacheader(yes)

define action setpacheader
  set( exception.response.header.Content-Type, "application/x-ns-proxy-autoconfig" )
end

 

• Next, add policy rules that trigger the "Force Exception" action:

[The following CPL can be added directly to the Local/Central/Forwarding Policy File or added via VPM; choose one method or the other, not both]

CPL Method:

;; Tab: [Web Access Layer, Return different PAC file based on source subnet, incoming URL /proxy_pac]
<Proxy>
 client.address=10.0.0.1/24 url.path.exact="/proxy_pac" force_exception(user-defined.pacA) ; Return PAC file A
 client.address=10.0.0.1/24 url.path.exact="/proxy_pac" force_exception(user-defined.pacB) ; Return PAC file B

 

VPM Method:

• Create "Return Exception" objects, one for PAC file "A", and one for PAC file "B":

 

 

 

• Create rules, with different "Subnet" objects in the "Source" column.

 

 

• Create a "Layer Guard" so these rules are only evaluated if the incoming URL is "/proxy_pac".   

 

 

Final VPM example:

 

 

---

 

Client setup:

When choosing to use browser "auto config," the Network Administrator has several options for configuring the browser to request its PAC file, whether that PAC file is served from the ProxySG or not.

The steps above prepare the ProxySG to serve PAC files; however, the client also needs to know to request the PAC file from the ProxySG.

Using the example rules above, if a request for "/proxy_pac" comes to the ProxySG from a client on the 10.10.10.0 subnet, that client will be served PAC file "A". The ProxySG will serve PAC file "B" for  incoming requests, to the same URL (/proxy_pac)... from clients on the 10.20.20.0 subnet. Remember, in the VPM example above, it's the Layer-Guard that defines the URL "/proxy_pac".

Choose what incoming URL string to be used, and adjust the policy rules accordingly. Do not use "accelerated_pac_base.pac", since that's already defined and available from the ProxySG without any special policy. Of course, it can be used as the "default" PAC file to serve, regardless of incoming client-subnet.

Often, one of the desired goals is to configure the clients as little as possible. Consider using a common, company standard for the incoming URL (in the example above:  /proxy_pac).

Microsoft Windows environments may take advantage of Group Policy to configure browsers.

Internet Explorer (IE) Example: