HTTPS proxy server overview and configuration

A proxy server acts as an intermediary gateway between a local network client or endpoint and another server, such as the Internet. It makes service requests on behalf of a local client and allows the client to make network connections to network services outside its own network. Transparent proxies do not require any special configuration.

If your enterprise uses a non-transparent HTTPS proxy server to allow endpoints on your network to access the Endpoint Security (HX) server or the Internet, you must configure your proxy server to allow communication between the xAgent and the Endpoint Security (HX) server. Your proxy server will also allow the Trellix DTI cloud to download malware and antivirus content updates and software updates to your xAgent .

This section describes how to configure proxy settings in your environment.

Note

Trellix does not recommend the use of proxy servers, because all communication between the xAgent and the Endpoint Security (HX) server is encrypted, so neither the performance nor security is enhanced. The simplest solution is for both the server and the xAgent to have a direct Internet connection in order to download malware definitions and other updates.

Direct HTTPS proxy support for Internet access is supported in Endpoint Security (HX) xAgent version 25 or later.

Proxy configurations

You can configure proxy settings in two ways: (1) locally, by editing the agent_config.json file, or (2) dynamically, on the server.

Note

Trellix recommends configuring proxy settings dynamically from the server.

In a complex proxy configuration, sometimes it is not possible to create host sets with separate agents for specific proxies. Instead, you modify the default agent_config.json file downloaded from the server before the installation. This method is also required if the initial communication with the Endpoint Security (HX) Server is through a proxy.

For example, to add a locally defined proxy, the following section could be added:

				"proxy": {
					"type": "manual",
					"host": "client.proxy.server",
					"port": 8080
				},

All the proxy settings detailed in Proxy Server Settings and Default Values can be configured. If the proxy policy is OFF on the Endpoint Security (HX) Server, these initial settings will be preserved on the xAgent . If proxy settings are configured on the server, then the imported settings will be overwritten.

To configure the proxy settings:

Export the current configuration: xagt -x agent.json
Edit the agent.json file with the new proxy settings. Any previously imported settings will be deleted.
Note
If no proxy settings are included, or if the following is added, all proxy settings will be deleted:
```
		     "proxy": {		
			      "type": "none"
		      }, 
```
Import the modified agent.json file: xagt -i agent.json

This method ensures that the proxy settings appear in the xAgent logs.

Important

If the configuration is exported after an xAgent restart, the proxy settings will not appear in the xAgent logs.

Proxy server types

The xAgent Policy Service allows you to select from three configuration types when setting up an HTTPS proxy server for the agents on your host endpoints: none, system, and manual.

Type Value	Description
`none`	No proxy server. Proxy switch is disabled.
`system`	Configure the xAgent to obtain proxy settings from the operating system. See Configuring a Proxy Server Policy for the Default Policy. This method is preferred over manual settings. Host containment works only at the IP protocol layer. If your host endpoints use a proxy server that has been added to the containment whitelist, a contained host will still be able to send and receive Web traffic and other traffic. If you are using an xAgent proxy and you want to be able to contain compromised hosts, you must set up the proxy server with a separate IP address that can only be used to reach the Endpoint Security (HX) server. Use the Endpoint Security (HX) xAgent Web UI to add the proxy server IP address to the Allowed IP Addresses on the Containment Settings page. See the Endpoint Security User Guide for more information.
`manual`	Configure the parameters of a remote proxy server. See Configuring a Proxy Server Policy for the Default Policy. Note When the proxy `type` is set to `manual`, the proxy `host` setting is required or your proxy server connection will fail. The proxy `host` setting has no default value.

Type Value

Description

none

No proxy server. Proxy switch is disabled.

system

Configure the xAgent to obtain proxy settings from the operating system. See Configuring a Proxy Server Policy for the Default Policy. This method is preferred over manual settings.

Host containment works only at the IP protocol layer. If your host endpoints use a proxy server that has been added to the containment whitelist, a contained host will still be able to send and receive Web traffic and other traffic. If you are using an xAgent proxy and you want to be able to contain compromised hosts, you must set up the proxy server with a separate IP address that can only be used to reach the Endpoint Security (HX) server. Use the Endpoint Security (HX) xAgent Web UI to add the proxy server IP address to the Allowed IP Addresses on the Containment Settings page. See the Endpoint Security User Guide for more information.

manual

Configure the parameters of a remote proxy server. See Configuring a Proxy Server Policy for the Default Policy.

Note

When the proxy type is set to manual, the proxy host setting is required or your proxy server connection will fail. The proxy host setting has no default value.

Using the Web UI or the API, you can set up a direct HTTPS proxy server that allows the agents on your host endpoints to access the Endpoint Security (HX) server and the Internet. Set up your proxy server using your Windows, OS X, and Linux operating system proxy settings, or manually enter your proxy server settings.

Trellix recommends using your system proxy settings to avoid breaking the provisioning between your Endpoint Security (HX) server and xAgent . Use care when manually supplying proxy settings. If your proxy settings are not correct and your xAgent and Endpoint Security (HX) server are on different networks, you may disrupt or break the communication between your Endpoint Security (HX) server and xAgent .

Note

You must either configure your HTTPS proxy server through the Web UI or manually modify the agent_config.json before installing or upgrading the Endpoint Security (HX) xAgent s on your host endpoints.

Note

SSL Intercept proxies that inspect, decrypt, or terminate are not supported.

Proxy server settings and default values

By default, HTTPS proxy support is disabled. To enable proxy settings in the HX policy settings, toggle this to ON. The table below defines the proxy settings and default values. Use these settings to configure your proxy server.

Proxy Setting	Description	Default Value
`exclude_local_host`	Enable or disable local and simple host exclusions from the xAgent web proxy support.	`false`
`exclude_hosts`	A list of hosts that should be excluded from proxy support.	`["eng.fireeye.com", "host.fireeye.com"]`
`password`	The user password required to authenticate access to the proxy server. The proxy password must have a minimum of six alphanumeric characters.
`port`	The HTTPS proxy server port number (optional setting).	`80`
`failed_retry_delay`	If the proxy server connection fails, the xAgent will wait for this specified time period (in seconds) before attempting to reconnect with the proxy server. The default value is 1200 seconds.	`1200`
`host`	The HTTPS proxy server hostname or IP address. Note When the proxy `type` is set to `manual`, the proxy `host` setting is required or your proxy server connection will fail. The proxy `host` setting has no default value.	---
`type`	The type of HTTPS proxy server configuration setting used by your host endpoint. Options include `none`, `system`, and `manual`. See Proxy Server Types for more information.	`none`
`username`	The username required to authenticate access to the proxy server.

Prerequisites

Admin access to the Endpoint Security server or the endpoints
Endpoint Security (HX) xAgent software version 25 (Downloaded from the Endpoint Security server and transferred to the endpoint)

This section covers the following topics: