Issue downloading a PAC file hosted on the ProxySG in a NAT environment.
Article ID: 166648
Updated On:
Products
Issue/Introduction
Only the second one can be edited. For more information about this topic, see the 000011089.
Resolution
From a PCAP, we can see the REQUEST with the “wrong” host header:
The same example works fine on a management port. We will use the "--insecure" CURL argument in order to bypass untrusted certificate errors.
As you can see in the following scenario, also with a different host header, the PAC file can be downloaded.
root@debian:~# curl https://10.91.22.2:8082/proxy_pac_file --insecure -H Host:1.1.1.1
function FindProxyForURL(url, host)
{
if( url.substring(0, 5) == "http:" )
{
return "PROXY 10.91.22.2:8080; DIRECT";
}
else if( url.substring(0, 6) == "https:" )
{
return "PROXY 10.91.22.2:8080; DIRECT";
}
else if( url.substring(0, 4) == "ftp:" )
{
return "PROXY 10.91.22.2:8080; DIRECT";
}
else
{
return "DIRECT";
}
}
Considerations and workarounds in a NATed environment:
The simplest thing to do is to always use management port to provide PAC file when possible.
You can host the PAC file on an external web server.
The NAT device, if smart enough, can be used to modify the HTTP REQUEST Host value as well. (In our example, from public IP 1.1.1.1 to the Proxy IP 10.91.22.2.)
Configure a virtual IP on the ProxySG with the public IP address (in our case 1.1.1.1) . Please note that this configuration can generate network issues in particular routing environments.
As you can see, the request now works fine:
root@debian:~# curl http://10.91.22.2:8080/accelerated_pac_base.pac -H Host:1.1.1.1
function FindProxyForURL(url, host)
{
if( url.substring(0, 5) == "http:" )
{
return "PROXY 10.91.22.2:8080; DIRECT";
}
else
{
return "DIRECT";
}
}
The NAT device, if smart enough, can be used to completely remove the value of the host header. As you can see, the request now works fine:
root@debian:~# curl http://10.91.22.2:8080/accelerated_pac_base.pac -H Host:;
function FindProxyForURL(url, host)
{
if( url.substring(0, 5) == "http:" )
{
return "PROXY 10.91.22.2:8080; DIRECT";
}
else
{
return "DIRECT";
}
}
root@debian:~#
HTTPS Note:
If the certificate is invalid, when Firefox (v 7.0.1) tries to download the PAC file, it will generate a certificate error. From this error window, it is not possible to install the certificate.
You can easily import the certificate browsing the management GUI (https://10.91.22.2:8082 in our example) and installing it when the certificate error pops up. Then after you close and reopen the browser, the PAC file should be downloaded correctly.
IE 8 will silently drop the PAC file if the certificate is invalid. You can install the certificate using the following procedure:
- Browse the management GUI (https://10.91.22.2:8082).
- Choose Continue to this website (not recommended).
- Select Tools > Internet Options.
- Select Security > Trusted sites > Sites.
- Add https://10.91.22.2:8082 to the list.
- Refresh the current page.
- Choose Continue to this website (not recommended).
- Click Certificate Error at the right of the address bar and select View certificates.
- Click on Install Certificate, then in the wizard, click Next.
- On the next page, select Place all certificates in the following store.
- Click Browse, select Trusted Root Certification Authorities, and click OK.
- In the wizard, click Next, then Finish.
- If you get a Security Warning message box, click Yes.
The certificate should now be trusted, and the PAC file correctly downloaded.
Feedback
