WebSocket support on Edge SWG (formerly ProxySG)

Products

• ISG Proxy
• ProxySG Software - SGOS

Issue/Introduction

WebSocket support on Edge SWG (ProxySG) software

Resolution

Edge SWG (ProxySG) software supports WebSocket over HTTP/1.1 in SGOS 6.7 and 7.x.

HTTP/2 is supported in 7.x; however, WebSocket over HTTP/2 is not supported. Clients (browsers) should automatically attempt to use HTTP/1.1 for WebSocket requests. If the automatic downgrade to HTTP/1.1 fails, you can write policy that downgrades HTTP/2 requests to HTTP/1.1.

For example, if site example.com is using WebSocket over HTTP/2, create the following policy to allow requests to example.com to work through the Edge SWG (ProxySG):

<Proxy "disable HTTP/2">
 client.connection.ssl_server_name.substring=example.com http2.client.accept(no) http2.server.request(no)

Alternatively, create a policy to apply to multiple sites that use WebSocket over HTTP/2:

<Proxy "disable HTTP/2">
  condition=WebSocket_Sites http2.client.accept(no) http2.server.request(no)

define condition WebSocket_Sites
  client.connection.ssl_server_name.suffix=(.bank1.example.com,.bank2.example.com)
  client.connection.ssl_server_name.suffix=.training.example.org
  client.connection.ssl_server_name.suffix=.other.example.net
  ...
end

The specified domains use WebSocket connections over HTTP/2.