PROXY Protocol support

Products

• SG-S200
• ProxySG Software - SGOS

Issue/Introduction

Does ProxySG / ASG / ISG support Proxy protocol

Proxy protocol:

Th PROXY protocol provides a convenient way to safely transport connection information such as a client's address across multiple layers of NAT or TCP proxies. It is designed to require little changes to existing components and to limit the performance impact caused by the processing of the transported information.

Environment

Proxy is behind load balancer that hides the clients IPs, and the LB is sending the clients IPs using Proxy protocol

Resolution

Proxy Protocol support was added starting version 7.3.2.1

====

Proxy Protocol Support

The DNS, HTTP, HTTPS, RTSP, SOCKS, SSL, TCP, and Telnet services now include an Expect Proxy Protocol option.
When enabled, the appliance looks for the originating IPv4 or IPv6 addresses in the Proxy Protocol request header. If Proxy Protocol is supported on the OCS and available, the proxy then includes the originating address in the request.
The IP address is used for the effective client IP address in policy; refer to the Visual Policy Manager Reference or Content Policy Language Reference for more information.

When Expect Proxy Protocol option is enabled and Proxy Protocol is not supported on the OCS or is unavailable, the request header is unchanged.

In the CLI, configure Expect Proxy Protocol with the following command:

# (config proxy_service_name) attribute expect-proxy-protocol {disable | enable}

======