mcafee client proxy 2.3.0 product guide (for use with ... · how client proxy manages the proxy...

Product Guide

McAfee Client Proxy 2.3.0For Windows and Mac OS

For use with McAfee ePolicy Orchestrator

COPYRIGHT

© 2016 Intel Corporation

TRADEMARK ATTRIBUTIONSIntel and the Intel logo are registered trademarks of the Intel Corporation in the US and/or other countries. McAfee and the McAfee logo, McAfee ActiveProtection, McAfee DeepSAFE, ePolicy Orchestrator, McAfee ePO, McAfee EMM, McAfee Evader, Foundscore, Foundstone, Global Threat Intelligence,McAfee LiveSafe, Policy Lab, McAfee QuickClean, Safe Eyes, McAfee SECURE, McAfee Shredder, SiteAdvisor, McAfee Stinger, McAfee TechMaster, McAfeeTotal Protection, TrustedSource, VirusScan are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the US and other countries.Other marks and brands may be claimed as the property of others.

LICENSE INFORMATION

License AgreementNOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETSFORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOUHAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOURSOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR AFILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SETFORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OFPURCHASE FOR A FULL REFUND.

2 McAfee Client Proxy 2.3.0 Product GuideFor Windows and Mac OS

Contents

Preface 5About this guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Find product documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

1 Product overview 7What is the Web Protection hybrid solution? . . . . . . . . . . . . . . . . . . . . . . . 7How Client Proxy works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

Client Proxy metadata . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9Deployment options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9Integration with Endpoint Security . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

2 Deploying Client Proxy 11Deployment matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11System requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12Deploying Client Proxy software . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

Download and install the product files . . . . . . . . . . . . . . . . . . . . . . 13Install the extension software . . . . . . . . . . . . . . . . . . . . . . . . . . 13Check in the client software package . . . . . . . . . . . . . . . . . . . . . . . 13Deploy Client Proxy software to clients running Windows . . . . . . . . . . . . . . . 14Deploying Client Proxy software to clients running Mac OS X . . . . . . . . . . . . . 15

View end-user installation data . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

3 Managing Client Proxy policies 17Users and permission sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17Configuring the policy areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

How Client Proxy manages the proxy server list . . . . . . . . . . . . . . . . . . 18Configure the proxy server list . . . . . . . . . . . . . . . . . . . . . . . . . 18Client configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19Configure the client settings . . . . . . . . . . . . . . . . . . . . . . . . . . 20Configure the bypass list . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20Configure the block list . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

Assign the policy to end-user computers . . . . . . . . . . . . . . . . . . . . . . . . 21Export the policy to an .xml or .opg file . . . . . . . . . . . . . . . . . . . . . . . . . 22Policy Catalog . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

4 Maintaining Client Proxy 25Upgrade the Client Proxy software . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Install a hotfix release . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26Uninstall the Client Proxy software . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

Remove the extension software . . . . . . . . . . . . . . . . . . . . . . . . . 27Remove the client software package . . . . . . . . . . . . . . . . . . . . . . . 27

Working with end users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27View information about Client Proxy on a Windows-based computer . . . . . . . . . . 28

McAfee Client Proxy 2.3.0 Product GuideFor Windows and Mac OS

3

View information about Client Proxy on an OS X computer . . . . . . . . . . . . . . 28Suspending policy enforcement . . . . . . . . . . . . . . . . . . . . . . . . . 28

Index 31

Contents


Preface

This guide provides the information you need to work with your McAfee product.

Contents About this guide Find product documentation

About this guideThis information describes the guide's target audience, the typographical conventions and icons usedin this guide, and how the guide is organized.

AudienceMcAfee documentation is carefully researched and written for the target audience.

The information in this guide is intended primarily for:

• Administrators — People who implement and enforce the company's security program.

ConventionsThis guide uses these typographical conventions and icons.

Italic Title of a book, chapter, or topic; a new term; emphasis

Bold Text that is emphasized

Monospace Commands and other text that the user types; a code sample; a displayed message

Narrow Bold Words from the product interface like options, menus, buttons, and dialog boxes

Hypertext blue A link to a topic or to an external website

Note: Extra information to emphasize a point, remind the reader of something, orprovide an alternative method

Tip: Best practice information

Caution: Important advice to protect your computer system, software installation,network, business, or data

Warning: Critical advice to prevent bodily harm when using a hardware product


5

Find product documentationOn the ServicePortal, you can find information about a released product, including productdocumentation, technical articles, and more.

Task1 Go to the ServicePortal at https://support.mcafee.com and click the Knowledge Center tab.

2 In the Knowledge Base pane under Content Source, click Product Documentation.

3 Select a product and version, then click Search to display a list of documents.

PrefaceFind product documentation


https://support.mcafee.com

1 Product overview

McAfee®

Client Proxy is endpoint client software for Microsoft Windows and Mac OS X that is anessential component of the McAfee

®

Web Protection hybrid deployment solution. The Client Proxytechnology allows you to apply your organization's web security policy to a computer, whether it islocated inside or outside your network.

Contents What is the Web Protection hybrid solution? How Client Proxy works Deployment options Integration with Endpoint Security

What is the Web Protection hybrid solution? The hybrid solution allows organizations to switch between the network-based and cloud-basedsecurity solutions provided by McAfee

®

Web Gateway and McAfee®

Web Gateway Cloud Service(McAfee

®

WGCS), respectively.

Web gateways and other appliances do not protect equipment after it leaves your organization'snetwork. For example, when users in your organization take laptops on business trips or work fromhome, they leave the network's secure zone.

Client Proxy is installed on the computers of end users in your organization. Using thelocation-awareness settings that you configure, Client Proxy determines whether the computers arelocated inside or outside your network or are connected to your network by VPN.

In a hybrid deployment, Client Proxy lets web requests sent by users working inside the network orconnected to the network by VPN pass. These requests are automatically redirected for filtering to aWeb Gateway appliance installed on the network. Web requests sent by users working outside thenetwork, on the other hand, are redirected to McAfee WGCS for filtering.

For more information about the hybrid solution, see the McAfee Web Protection Hybrid DeploymentGuide.

1


7

How Client Proxy worksUsing location-awareness settings, Client Proxy protects the computers of end users in yourorganization, whether they are located inside or outside your network.

Client Proxy software redirects, blocks, or lets pass web traffic and network communications accordingto the policy you configure and location of the end-user computer.

Figure 1-1 Client Proxy workflow

When an end user is working inside your organization's network, Client Proxy software:1 Recognizes that the end user is working inside your organization's network

2 Remains passive, allowing web traffic and network communications to pass to Web Gateway forfiltering

When an end user is working outside your organization's network, Client Proxy software:1 Recognizes that the end user is working outside your organization's network

2 Redirects all web traffic and network communications to the McAfee WGCS service

1 Product overviewHow Client Proxy works


Client Proxy metadataWhen the Client Proxy software redirects HTTP/HTTPS traffic, it adds metadata to the requests.

Proxy server administrators configure and apply policies based on the values in the metadata:

• Authentication tokens • User groups

• Authentication version • Client IP address

• Customer ID • Original destination IP address

• User ID

The authentication version is the version of the metadata that Client Proxy shares with the proxy server.

Deployment optionsClient Proxy consists of server and client software that is deployed using the McAfee ePO or McAfeeePO Cloud management platform. Deployment details depend on which management platform is used.

Server software

The server software is installed on the McAfee ePO server and adds the Client Proxy serverfunctionality to the McAfee ePO platform. Because the server software extends the McAfee ePOfunctionality, it is called the extension software or extension.

When Client Proxy is deployed using McAfee ePO Cloud, the server software comes installed on theplatform and does not need to be installed by an administrator.

Client software

The client software is checked in to the McAfee ePO Master Repository as a package and then deployedto the client computers in your organization. Client software and computers are also called endpointsoftware and computers, respectively. Endpoint computers are sometimes called the endpoint.

When Client Proxy is deployed using McAfee ePO Cloud, the client package is already checked in to theMaster Repository and only needs to be deployed to the endpoint.

Deployment using McAfee ePO versus McAfee ePO Cloud

This table summarizes the differences between deploying Client Proxy using the on-premise and cloudversions of McAfee ePO.

Managementplatform

Server software(extension)

Client software (package)

McAfee ePO The administrator installs theextension software on theplatform.

The administrator checks in the client packageto the Master Repository and then deploys thepackage to the endpoint.

McAfee ePO Cloud The extension softwarecomes installed on theplatform.

The client package is already checked in to theMaster Repository. The administrator onlyneeds to deploy the package to the endpoint.

For more information about deploying Client Proxy using McAfee ePO Cloud, see the McAfee Client ProxyProduct Guide for McAfee ePolicy Orchestrator Cloud.

Product overviewDeployment options 1


9

Integration with Endpoint SecurityClient Proxy is available as a standalone product or integrated with Endpoint Security.

When integrated, Client Proxy joins the Endpoint Security family, including:

• McAfee® Endpoint Security Threat Prevention

• McAfee® Endpoint Security Firewall

• McAfee® Endpoint Security Web Control

Whether standalone or integrated, Client Proxy is managed using McAfee ePO and the managementtasks are the same. When Client Proxy is integrated with Endpoint Security:

1 The client software package is deployed to the endpoint and installed as a module on the EndpointSolution Platform.

2 The administrator can configure Web Control so that it is disabled while Client Proxy is installed andrunning.

On a Windows-based computer, you can view the integration status of Client Proxy by opening theAbout McAfee Client Proxy window. If EspMode is set to ON, Client Proxy is installed and running on theEndpoint Security Platform.

1 Product overviewIntegration with Endpoint Security


2 Deploying Client Proxy

Using McAfee®

ePolicy Orchestrator®

(McAfee®

ePO™

) , deploy the Client Proxy server and clientsoftware. The server software is installed on the McAfee ePO server and the client software package isdeployed to the computers of end users in your organization.

Contents Deployment matrix System requirements Deploying Client Proxy software View end-user installation data

Deployment matrixThis release of the Client Proxy client software supports these versions of McAfee

®

Agent. This releaseof the extension software supports these versions of McAfee ePO.

Component Supported versions

End-user computers running Windows

Client Proxy software for Windows 2.3.0.288.1

McAfee Agent 5.0.1.x–5.0.4.x

End-user computers running Mac OS X

Client Proxy software for Mac OS X 2.3.0.107

McAfee Agent 5.0.2.x–5.0.4.x

McAfee ePO management platform

Client Proxy extension software 2.3.0.288.1

McAfee ePO software 5.1.3.x–5.3.2.x

2


11

System requirements Verify that your network meets the following hardware and operating system requirements.

Table 2-1 Hardware requirements

Hardware type Specifications

Servers — Run the McAfee ePOsoftware and Client Proxyextension.

• CPU — Intel Pentium IV 2.8 GHz or higher

• RAM — 1 GB minimum (2 GB recommended)

• Hard disk — 80 GB minimum

End-user computers — Run theClient Proxy software.

• RAM — 1 GB minimum (2 GB recommended)

• Hard disk — 300 MB minimum free disk space (500 MBrecommended)

Table 2-2 Operating system requirements

Computer type Software

Servers — Run the McAfee ePO softwareand Client Proxy extension.

• Windows Server 2008SP2 or later

• Windows Server 2012R2

• Windows Server 2008R2

• Windows Server 2016

• Windows Server 2012

End-user computers — Run the ClientProxy software.

• Windows Vista SP2 orlater

• OS X 10.9 (Mavericks)

• Windows 7 SP1 orlater

• OS X 10.10 (Yosemite)

• Windows 8 or 8.1 • OS X 10.11 (ElCapitan)

• Windows 10

Deploying Client Proxy softwareDownload the Client Proxy product files on the administrator operating system. Using McAfee ePO,install the extension software on the server, and check in the client software package. Then deploy theclient software to the computers of end users in your organization.

Contents Download and install the product files Install the extension software Check in the client software package Deploy Client Proxy software to clients running Windows Deploying Client Proxy software to clients running Mac OS X

2 Deploying Client ProxySystem requirements


Download and install the product filesDownload the Client Proxy product files from the McAfee Content & Cloud Security Portal and installthem on the administrator operating system. Client Proxy also supports McAfee ePO Software Manager.

Task1 Download the product files.

a Log on to the operating system as an administrator.

b Go to the McAfee Content & Cloud Security Portal.

c Enter your user name and password, then click Login.

d Select Software | McAfee Web Gateway | Tools | McAfee Client Proxy.

e Select and save the .zip files for your operating system.

• Client Proxy server software for McAfee ePO: MCPSRVER1000_2.3.0.x_package.zip

• Client Proxy client software for Mac OS X: Mcpdistribution.zip

• Client Proxy client software for Windows: mcp-win 2.3.0 Build x Package #y.zip

x specifies the number of the build and y specifies the number of the package.

2 Install the server software, and check the client package into McAfee ePO.

Install the extension softwareInstall the Client Proxy extension .zip file so it is available in McAfee ePO.

Task1 In the McAfee ePO interface, select Menu | Software | Extensions.

2 Click Install Extension.

3 Click Browse to locate the Client Proxy extension file: MCPSRVER1000_2.3.0.x_package.zip, where xspecifies the number of the build.

4 Select the file, then click Open | OK.

The Install Package window opens.

5 Click OK.

The package installs the Client Proxy manager, McAfee®

Common Catalog, McAfee®

Help Desksoftware, and the related Help files.

Check in the client software packageCheck the Client Proxy client software package in to the McAfee ePO Master Repository.

Task1 In the McAfee ePO interface, select Menu | Software | Master Repository.

2 Click Check In Package.

3 For the Package type, select Product or Update (.ZIP), then click Browse.

Deploying Client ProxyDeploying Client Proxy software 2


13

https://contentsecurity.mcafee.com

4 Select the Client Proxy Mac OS X or Windows client file that you downloaded earlier:

• Mac OS X — McpDistribution.zip

• Windows — mcp-win 2.3.0 Build x Package #y.zip

x specifies the number of the build and y specifies the number of the package.

5 Click Open, then click Next.

6 Review the package options, then click Save.

McAfee Client Proxy is visible in the Packages in Master Repository list.

Deploy Client Proxy software to clients running WindowsUsing McAfee ePO, install Client Proxy software on the computers of end users in your organization.

Task1 In the McAfee ePO interface, select Menu | Systems | System Tree.

2 Select the organizational level to which you want the install action applied.

Selecting My Organization selects all computers managed by McAfee ePO.

3 Click the Assigned Client Tasks tab.

4 From the Actions drop-down list, select New Client Task Assignment.

5 In the Client Task Assignment Builder, configure the following options in the order shown, then click CreateNew Task:• Product — Select McAfee Agent.

• Task Type — Select Product Deployment.

6 In the New Task window, configure the following options, then click Save:• Task Name — Specify a name for the task.

• Description — (Optional) Describe the task.

• Target platforms — Select Windows.

• Products and components — From the drop-down list, select the version of McAfee Client Proxy thatyou want to install on the end-user computers, then from the Action drop-down list, select Install.

7 Click Next.

8 From the Schedule type drop-down list, select Run immediately, then click Next.

9 Review the task summary, then click Save.

The task is scheduled for the next time that the McAfee Agent checks for updates. To force theinstallation to run immediately, issue an agent wake-up call.

After installation, Client Proxy runs immediately without restarting the end-user computer.

Client Proxy does not redirect data until a policy is configured.

2 Deploying Client ProxyDeploying Client Proxy software


Deploying Client Proxy software to clients running Mac OS X Check these prerequisites before using the McAfee ePO platform to deploy Client Proxy software toend-user computers running Mac OS X.

• The Client Proxy extension software must be installed on the McAfee ePO platform.

• The latest Mac OS X build of the Client Proxy package must be checked in to the McAfee ePOMaster Repository.

• McAfee Agent 5.0.2 or later must be checked in to the Master Repository and installed on theend-user computers running Mac OS X.

View end-user installation dataView the number of end-user computers that have successfully installed Client Proxy in the pastmonth.

Task1 In the McAfee ePO interface, select Menu | Reporting | Queries & Reports.

2 From the Groups list, expand Shared Groups, then select McAfee Client Proxy.

3 Create a query.

Option Definition

Select a querytype.

1 Click the Query tab, then select Actions | New.The Query Builder opens with the Result Types view active.

2 From the Feature Group list, select Policy Management.

3 Choose from these options:

• Applied Client Tasks

• Applied Policies

• Client Task Assignment Broken Inheritance

• Policy Assignment Broken Inheritance

4 Click Next.

Select a querylayout.

1 From the Display Results As list, select a graph or table for the query layout.Select a layout for your query that best displays your data.

2 Select the display options you want from the available lists.

3 To move to the Columns page, click Next.

Select querycolumns.

1 From the Available Columns list, select which columns to apply to your query.

2 In Selected Columns, select, drag, and position each column.

3 To move to the Filter page, click Next.

Configureproperties.

From the Available Properties list, select which properties to use for filtering yourquery, and the appropriate values for each.

Deploying Client ProxyView end-user installation data 2


15

Option Definition

Run the query. Click Run.

Save the query. 1 To view the Save Query page, click Save.

2 Type a name for the query, add any notes, and select a group.

3 Click Save.

4 Create a report.

Option Definition

Select a query. 1 Click the Report tab, then select Actions | New.The Report Builder opens with the Report Layout view active.

2 From the Toolbox menu, select Query Chart, and drag it to the Report Layout area.The Configure Query Chart dialog box appears.

3 From the Query drop-down list, select MCP: Endpoint Install Success/Failed events in lastmonth.

4 Configure the remaining query options, then click OK.

Customize thereport.

1 In the Name, Description and Group tab, type a name, description, and which groupto use.

2 Use the Header and Footer and Page Setup tabs to specify how you want the query toappear in the report.

3 Use the Runtime Parameters tab to select report‑level filters.

Generate thereport.

Click Run.You can choose to run the report to get the information immediately, save to useit another time, or configure its appearance further by adding additional content.

2 Deploying Client ProxyView end-user installation data


3 Managing Client Proxy policies

In the McAfee ePO management console, you configure and manage Client Proxy policies.

Contents Users and permission sets Configuring the policy areas Assign the policy to end-user computers Export the policy to an .xml or .opg file Policy Catalog

Users and permission setsWe recommend creating specific administrator roles and permissions in McAfee ePO for the ClientProxy catalog administrator.

McAfee ePO defines roles and permissions in terms of Permission Sets. A default permission set installedwith the product, MCP Catalog Admin, gives the Client Proxy administrator view and change permissionsfor policies and certain Common Catalog items and actions. You can also assign an auditor role byadding view permission to one of the existing reviewer permission sets, or by creating a newpermission set. You assign users to permission sets using Active Directory.

Configuring the policy areasClient Proxy policy configuration includes these areas: the proxy servers list, client configuration, thebypass list, and the block list.

3


17

Tasks• How Client Proxy manages the proxy server list on page 18

When configuring proxy servers for a Client Proxy policy, consider how Client Proxymanages the proxy server list.

• Configure the proxy server list on page 18To redirect network traffic to a proxy server, configure the proxy server list.

• Client configuration on page 19Client Proxy uses the Client Configuration settings to identify the customer and determinewhether end-user computers are located inside or outside the network.

• Configure the client settings on page 20Configure the settings that Client Proxy uses to identify the customer and determinewhether end-user computers are located inside or outside the network.

• Configure the bypass list on page 20Configure the McAfee® Common Catalog instance that Client Proxy uses to determine whichnetwork traffic is allowed to bypass the proxy server.

• Configure the block list on page 21Configure the list of processes running on end-user computers that are blocked fromaccessing the network.

How Client Proxy manages the proxy server listWhen configuring proxy servers for a Client Proxy policy, consider how Client Proxy manages the proxyserver list.

The Client Proxy software maintains an ordered list of proxy servers, with the proxy server having thefastest response time placed at the top of the list. The software updates the list from time to time.

For example, the list is updated when the end user starts the computer, the VPN connection breaks, aproxy server fails to respond, or the Client Proxy policy changes. At these times, the software tests theconnections to all proxy servers and reorders the list based on response times.

If redirection to the proxy server at the top of the list fails, the software tries redirecting to the secondproxy server in the list. At the same time, the software tests the proxy server connections again andupdates the proxy server list.

When configuring how the Client Proxy software selects the next proxy server from the list, you havethese options:

• connect to the first accessible Proxy Server based on their order in the list below — The software selects the nextproxy server from the list that you configure.

• connect to the Proxy Server that has the fastest response time — The software selects the next proxy server fromthe list that it maintains, which is based on response time.

Configure the proxy server list To redirect network traffic to a proxy server, configure the proxy server list.

When Client Proxy is deployed on-premise, you configure one or more Web Gateway appliancesinstalled on your network as the proxy servers.

To save the policy, you must configure at least one proxy server, and the configuration must include anIP address or host name and a port number.

3 Managing Client Proxy policiesConfiguring the policy areas


Task1 In the McAfee ePO interface, select Menu | Policy | Policy Catalog.

2 From the Product drop-down list, select the current version of McAfee Client Proxy.

3 To configure a policy, click the policy's name.

4 From the Client Proxy Settings menu, select Proxy Servers.

5 In the Proxy Server List, select how Client Proxy connects to the proxy servers from these options:

• connect to the first accessible Proxy Server based on their order in the list below

• connect to the Proxy Server which has the fastest response time

6 Add proxy servers to the Proxy Server List:

a In the Proxy Server Address field, enter the IP address or host name of the proxy server.

b In the Proxy Port field, enter the port number of the proxy server.

c To redirect HTTP/HTTPS requests to the proxy server, select the HTTP/HTTPS checkbox.

Client Proxy redirects all requests going to ports 80 and 443.

d To redirect requests going to ports using protocols other than HTTP/HTTPS, specify the portnumbers in this field: Non-HTTP/HTTPS Redirected Ports.

Use this setting to redirect traffic that uses a transfer protocol other than HTTP/HTTPS. Verifythat the proxy server supports the protocol.

e Click Add.

The IP address or host name is added to the Proxy Server List.

Using the icons in the Actions column, you can edit, delete, or change the order of the proxy serversin the list.

7 To redirect requests going to ports other than 80 or 443 using the HTTP/HTTPS protocol, specifythe port numbers in this field: Specify additional ports that you would like to redirect as HTTP/HTTPS traffic.

Use this setting to redirect traffic that is going to an application, for example, instead of a webbrowser.

8 To redirect all requests, including requests going to local addresses inside your organization'snetwork, deselect the Bypass proxy server for local addresses checkbox.

By default, Client Proxy does not redirect requests going to local addresses. To redirect all requeststo the proxy server, you can override the default setting.

Client configurationClient Proxy uses the Client Configuration settings to identify the customer and determine whetherend-user computers are located inside or outside the network.

• Customer Identifier — Client Proxy uses the customer ID and shared password to identify the customerand apply the customer's policy.

• Traffic Redirection Settings — Client Proxy uses this setting to determine when to redirect network trafficto the configured proxy servers.

• Corporate Network Detection — Client Proxy uses this setting to determine whether the end-usercomputer is located inside or outside the network.

Managing Client Proxy policiesConfiguring the policy areas 3


19

• Corporate VPN Detection — Client Proxy uses this setting to determine whether the end-user computeris connected to the network through the VPN.

• Active Directory Groups Filter — Client Proxy uses the regular expressions that you configure to filter thelist of Active Directory groups included sent to the proxy server.

• Log File Settings (OS X Only) — Depending on this setting, Client Proxy logs error messages to a log fileon each end-user computer.

• Access Protection (Windows Only) — Depending on this setting, Client Proxy is protected fromunauthorized removal or tampering by end users.

Configure the client settingsConfigure the settings that Client Proxy uses to identify the customer and determine whether end-usercomputers are located inside or outside the network.




4 From the Client Proxy Settings menu, select Client Configuration.

5 In the Customer Identifier section, click Browse, select the ID file, then click Open.

This file is provided by the Web Gateway or McAfee WGCS administrator.

The Unique Customer ID and Shared Password fields are automatically populated.

6 Configure the remaining options.

Configure the bypass listConfigure the McAfee

®

Common Catalog instance that Client Proxy uses to determine which networktraffic is allowed to bypass the proxy server.

Each Client Proxy policy has a Common Catalog instance associated with it. The catalog is a list thatyou configure and that Client Proxy uses to determine which network traffic bypasses the proxy server.

The bypass list can include domain names, network addresses, network ports, and the names ofprocesses that end-user computers are allowed to access directly. Updating the bypass list in McAfeeePO also updates the Common Catalog instance associated with the policy.

Process names can be in Microsoft Windows format (test.exe) or Mac OS X format (test).




4 From the Client Proxy Settings menu, select Bypass List.

5 In the Bypass List window: From the Actions menu, select Add bypass list item, then select an item type.

The Choose from existing values dialog box opens.

3 Managing Client Proxy policiesConfiguring the policy areas


6 Do one of the following:

• Select one or more existing catalog items.

• Click New Item, enter the new information, then click Save.

7 Click OK.

Configure the block listConfigure the list of processes running on end-user computers that are blocked from accessing thenetwork.

Each Client Proxy policy has a list of blocked processes associated with it. The block list is designed toreduce the amount of unwanted traffic that is redirected to the proxy server for filtering. Occasionally,the block list can restrict access to Internet resources, where the restriction was not intended.




4 From the Client Proxy Settings menu, select Block List.

5 Select an option:

• Allow traffic to go directly to destination — No processes are blocked.

• Block traffic for all processes (except bypass listed processes) — All processes are blocked except forprocesses whose names are on the bypass list. These processes are allowed to access thenetwork directly.

• Block traffic only for the following processes — To configure the list of processes that you want blocked,enter the process names, clicking Add after each entry.

Windows process names must end with the .exe extension. Mac process names can be specifiedwithout the extension.

6 Click Save.

Assign the policy to end-user computersUsing McAfee ePO, assign the Client Proxy policy to specified end-user computers in yourorganization's network.


2 From the System Tree menu, select a group or subgroup.

3 Click the Assigned Policies tab.


5 In the Actions column, click Edit Assignment.

The Policy Assignment for My Organization window appears.

Managing Client Proxy policiesAssign the policy to end-user computers 3


21

6 Next to Inherit from, select Break inheritance and assign the policy and settings below.

7 From the Assigned policy drop-down list, select the policy.

8 Choose whether or not to lock policy inheritance.

9 Click Save.

Assign a Client Task to schedule the policy deployment to the endpoints.

Export the policy to an .xml or .opg fileYou can export the Client Proxy policy to an .xml file for troubleshooting or to an .opg file for importby client computers in your organization.


2 From the Product drop-down list, select the current version of McAfee Client Proxy, then select apolicy.

The Client Proxy Settings pane opens.

3 From the Actions drop-down list, select Export Policy to File.

The Export Policy to File dialog box opens.

4 Click a link:

• McAfee Client Proxy Policy Server File — Exports the policy to a .xml file that you can use fortroubleshooting.

• McAfee Client Proxy Policy Client File — Exports the policy to a .opg file that can be imported by clientcomputers in your organization.

5 Save the file.

6 Click OK.

Policy CatalogOn the McAfee Client Proxy page of the Policy Catalog, you can create, import, export, rename, duplicate,delete, view, and edit policies.

The Client Proxy policy named McAfee Default is read only. It can be duplicated and saved with a newname, but it cannot be renamed, deleted, exported, or edited.

Table 3-1 Client Proxy policy options

Option Definition

New Policy When clicked, opens the Create a new policy dialog box, where you can select an existingpolicy to use as a template for a new policy and specify a name.

Import When clicked, opens the Import Policies dialog box, where you can browse for the .xml filethat has the policy you want to import.

3 Managing Client Proxy policiesExport the policy to an .xml or .opg file


Table 3-1 Client Proxy policy options (continued)

Option Definition

Export When clicked, opens the Export page, where you have these options:• Click the link — Opens a new tab in your web browser, where you can view the policy in

XML format.

• Right-click the link, then select Save Link As, choose a folder, and optionally update thefile name — Downloads the policy to an .xml file.Default file name: Policies_For_McAfee_Client_Proxy_<x.y.z>.xml

<x.y.z> specifies the version number of Client Proxy.

Name Clicking this link opens the policy settings, which you can edit and save.

Owner Clicking this link opens a list of users and groups, where you can select the policy ownersand save any changes.

Assignments Clicking this link opens the list of nodes, to which the policy is assigned.

Actions • Rename — When clicked, opens the Rename Policy dialog box, where you specify a newname for the policy.

• Duplicate — When clicked, opens the Duplicate Existing Policy dialog box, where you specify aname for the new policy that is based on an existing policy.

• Delete — When clicked, opens the Delete Policy dialog box, where you confirm that youwant to delete the policy.

• Export — When clicked, opens the same page as the Export button.

Managing Client Proxy policiesPolicy Catalog 3


23

3 Managing Client Proxy policiesPolicy Catalog


4 Maintaining Client Proxy

You can upgrade or remove the Client Proxy software, install a hotfix release, and support end users.

Contents Upgrade the Client Proxy software Install a hotfix release Uninstall the Client Proxy software Working with end users

Upgrade the Client Proxy softwareDownload the latest Client Proxy software, install the extension, check in the client package, anddeploy the client software to the end-user computers.

Task1 Download the latest versions of the Client Proxy software.

a Go to the McAfee Content & Cloud Security Portal.

b Enter your user name and password, then click Login.

c Select Software | McAfee Web Gateway | Tools | McAfee Client Proxy.

d Select and save the appropriate .zip file.

Client Proxy also supports McAfee ePO Software Manager.

2 Install the extension software.

a From the McAfee ePO interface, select Menu | Software | Extensions.

b Click Install Extension.

c Click Browse to locate the Client Proxy .zip file, click Open, then click OK.

The Install Package window appears.

d Click OK.

e Verify that the extension is installed, and select Menu | Software | Extensions.

3 Check in the client package.

a Select Actions | Check in Package.

The Check in Package window appears.

4


25


b Select the package type, then click Browse.

c Choose the Client Proxy .zip file you downloaded earlier, then click Open.

McAfee Client Proxy appears in the Packages in Master Repository list.

4 Deploy the client software to the end-user computers.

a Select Menu | Systems | System Tree.

b From the System Tree list, select the subgroup level to deploy Client Proxy endpoint software.

c Click the Assigned Client Tasks tab.

d From the Actions menu, select New Client Task Assignment.

e Configure the Client Task Assignment Builder options.

f Click Create New Task.

g Configure the Product Deployment options.

h Click Save.

i Click Next.

j From the Schedule type drop-down list, select Run immediately, then click Next.

k Review the task summary, then click Save.

The Client Proxy software runs immediately on the end-user computers without restarting.

Install a hotfix release Occasionally, McAfee releases a Client Proxy hotfix to address issues with the product.

If the hotfix includes release notes, follow the instructions in the release notes when installing thehotfix. If the hotfix does not include release notes, follow these steps.

Task1 Go to the McAfee Content & Cloud Security Portal.

2 Enter your user name and password, then click Login.

3 Select Software | McAfee Web Gateway | Tools | McAfee Client Proxy.

4 Select and save the hotfix installation file for your operating system.

5 Run the hotfix installation file.

6 Follow the on-screen prompts to complete the installation.

Uninstall the Client Proxy softwareTo fully uninstall the Client Proxy software, remove the extension and package from McAfee ePO andthen remove the software from the administrator operating system.

4 Maintaining Client ProxyInstall a hotfix release



Remove the extension softwareRemove the Client Proxy extension software using McAfee ePO.

Task1 Log on to McAfee ePO as an administrator.

2 Select Menu | Software | Extensions.

3 From the Extensions list, select McAfee Client Proxy.

4 Click Remove.

Remove the client software packageUsing McAfee ePO, remove the Client Proxy software from the computers of end users in yourorganization.


2 Select the organizational level to which you want the remove action applied.

Selecting My Organization selects all computers managed by McAfee ePO.

3 Click the Assigned Client Tasks tab.

4 From the Actions drop-down list, select New Client Task Assignment.

5 In the Client Task Assignment Builder, configure the following options in the order shown, then click CreateNew Task:• Product — Select McAfee Agent.

• Task Type — Select Product Deployment.

6 In the New Task window, configure the following options, then click Save:• Task Name — Specify a name for the task.

• Description — (Optional) Describe the task.

• Target platforms — Select Windows.

• Products and components — From the drop-down list, select the version of McAfee Client Proxy thatyou want to remove from the end-user computers, then from the Action drop-down list, selectRemove.

Working with end usersEnd users can view information about Client Proxy on their computers or temporarily suspend policyenforcement by contacting a McAfee

®

Help Desk administrator.

Maintaining Client ProxyWorking with end users 4


27

View information about Client Proxy on a Windows-basedcomputerOn an end-user computer running Windows, you can view information about the Client Proxy software,policy, and status.

Task1 On a Windows-based computer, click Start | All Programs | McAfee, then click About McAfee Client Proxy.

2 In the McAfee Client Proxy window, you can view the following information:

• Version Number — Specifies the version and build number of the Client Proxy software installed onthe end-user computer.

• Active Proxy — Specifies the address of the proxy server to which Client Proxy is redirecting traffic.

• Connection Status — Specifies whether the end-user computer is connected to the network.

• EspMode — Specifies whether Client Proxy is installed and running on the Endpoint SolutionPlatform.

• Policy Name — Specifies the name of the policy that Client Proxy is applying.

• Policy Revision — Specifies the revision number of the policy that Client Proxy is applying.

• Policy Timestamp — Specifies the time when the Client Proxy policy was deployed to the end-usercomputer.

• Status — Specifies whether Client Proxy is working in active or passive mode.

3 To close the window, click Ok.

View information about Client Proxy on an OS X computerOn an end-user computer running OS X, you can view information about the Client Proxy software,policy, and status.

Task1 On an OS X computer, click the McAfee menulet and select About McAfee Endpoint Protection for Mac.

In the Client Proxy section, the following information is displayed:

• Client Proxy version and build number • Policy modified date

• Policy name • Proxy server

• Policy revision

2 Verify that you are connected to the proxy server: From the menulet, select the dashboard.

This message is displayed: Client Proxy: Redirecting.

Suspending policy enforcementEnd users can request permission to access or transfer sensitive information for a limited time.

Occasionally, there is a legitimate business reason to temporarily suspend the security policy so thatsensitive information can be accessed or transferred. Client Proxy uses a challenge-responsemechanism to perform this function.

4 Maintaining Client ProxyWorking with end users


The end user sends a request to an administrator, including the policy revision number andidentification code displayed in the Enter Release Code dialog box. Using this information and the McAfee

®

Help Desk software, the administrator creates a release code and then sends it to the end user.

The release code is valid for a limited time, and the time allowed for policy suspension is limited aswell. Thus, the end user must enter the release code in the dialog box and complete the task thatrequires policy suspension before the allowed time period expires.

Best practice: Removing the software from end-user computers

Client Proxy software cannot be removed from end-user computers without authorization. Usually, theadministrator uninstalls the software using McAfee ePO.

If McAfee ePO is not available and the end-user computer is running Windows, the administrator canuninstall the software using the Windows Add or Remove Programs tool. In this case, theadministrator uses the challenge-response mechanism to generate the release key.

Generate a release codeTo temporarily suspend policy enforcement on end-user computers, users request a bypass releasecode from a Client Proxy administrator. Using Help Desk software, administrators create a release codeand send it to the end user.

Task1 To request a bypass release code on an end-user computer, do one of the following:

• On Mac OS X computers: From the McAfee menulet on the status bar, select McAfee EndpointProtection for Mac Preferences, then select Client Proxy.

• On computers running Windows: Click Start | All Programs | McAfee, then click Bypass McAfee ClientProxy.

The McAfee Client Proxy Enter Release Code dialog box opens.

While you are waiting for the administrator to send the release code, leave this dialog box open. Ifyou close it, you must start the procedure over.

2 Copy the number in the Policy Revision field and the code in the Identification field, send these values toyour administrator, and include your user name and email address.

3 When your administrator sends the release code, enter the code in the Release field, then do one ofthe following:

• On Mac OS X computers: Click Release.

• On computers running Windows: Click OK.

Policy enforcement is suspended for the time period specified by the administrator when creating thecode.

Maintaining Client ProxyWorking with end users 4


29

4 Maintaining Client ProxyWorking with end users


Index

Aabout this guide 5access protection 20

Windows 19

Active Directorygroups filter 19

Active Directory groups 20

authentication tokens 9authentication version 9

Bblock list

configuring 21

bypass listconfiguring 20

Cchallenge-response mechanism 28

client configuration 19

Client Proxyassigning a policy 21

checking in the client software 13

how the software works 8integrated with Endpoint Security 10

managing the proxy server list 18

metadata 9policies 22

server and client software 9Client Proxy software

deploying to clients running Mac OS X 15

deploying to clients running Windows 14

removing from end-user computers 28

uninstalling 26

upgrading 25

Client Proxy, aboutviewing on a Windows-based computer 28

viewing on an OS X computer 28

client settingsconfiguring 20

client softwareClient Proxy 13

viewing the number of successful installations 15

client software packageremoving 27

Common Catalog 20

conventions and icons used in this guide 5corporate network and VPN detection 19

corporate network detection 20

corporate VPN detection 20

customer ID 9, 20

Ddeployment options 9documentation

audience for this guide 5product-specific, finding 6typographical conventions and icons 5

Eend-user computers

hardware requirements and software requirements 12

Endpoint Solution Platform 10

EspMode 10

extension softwareinstalling 13

removing 27

Hhardware requirements

network servers and end-user computers 12

software requirementsnetwork servers and end-user computers 12

hotfix releaseinstalling 26

hybrid solution 7

Iinstallation

product files 13

IP addressesclient and original destination 9


31

Llog file settings 20

OS X 19

MMaster Repository

McAfee ePO 13

McAfee ePOMaster Repository 13

McAfee ServicePortal, accessing 6McAfee WGCS

configuring as the proxy server 18

metadataClient Proxy 9

Nnetwork servers

hardware and software requirements 12

Ppermission sets 17

policiesClient Proxy 21, 22

exporting to an .xml or .opg file 22

suspending 28

policy areasconfiguring 17

Policy CatalogClient Proxy page 22

processesblocking 21

proxy server listconfiguring 18

proxy server list (continued)how Client Proxy manages 18

Qqueries

creating in McAfee ePO 15

Rrelease codes

generating 29

reportsgenerating in McAfee ePO 15

SServicePortal, finding product documentation 6shared password 19

Ttechnical support, finding product information 6traffic redirection 20

traffic redirection settings 19

Uuser groups 9user ID 9

WWeb Control 10

Web Gateway appliancesconfiguring as proxy servers 18

Web Protectionhybrid solution 7

Index


mcafee client proxy 2.3.0 product guide (for use with ... · how client proxy manages the proxy...

Documents