DTI network services include: download, upload destination, mil, faude, enrollment, avsuite, helix, and virtual. You can designate that an appliance send requests for one or more of these services through an HTTP proxy server. The appliance can either be managed by a Central Management System appliance or be a standalone appliance.
Note
The helix DTI network service is not currently used. For information about allowing appliances to communicate with Helix though an HTTP proxy server, see the Helix Integration Guide.
The enrollment service pertains only to appliances that are running in sensor or hybrid MVX mode. The virtual service pertains only to virtual appliances.
How it works for managed appliances
By default, a managed appliance sends requests for all DTI network services through the Central Management System appliance. You can instead configure the appliance to bypass the Central Management System appliance and send requests for one or more DTI network services through an HTTP proxy server.
For example, the managed appliance could use the Central Management System appliance as the DTI source for software downloads, but for more effective detection and remediation, use the proxy server for detection-related DTI services such as faude and avsuite.
This feature has the following benefits:
Reliability—If the managed appliance uses single-port communication (the default method), requests for all DTI network services will fail over to the HTTP proxy server if the Central Management System appliance becomes unavailable. For example, suppose the Central Management System appliance becomes unavailable during maintenance activities. The managed appliance will automatically use the proxy server to reach the DTI network until its connection with the Central Management System appliance is restored. For details, see Enabling HTTP proxy settings for automatic failover using the CLI on the facing page.
Decentralization —You can limit the amount of traffic passing through the Central Management System appliance when requests for DTI services go through an HTTP proxy server instead of the Central Management System appliance.
Reduced Network Latency—You can send requests through an HTTP proxy server if the managed appliance is geographically closer to the DTI network than it is to the Central Management System appliance.
HTTP proxy settings for a DTI service on a managed appliance will be enabled if all of the following conditions are met:
The HTTP proxy server host address is configured.
The HTTP proxy server is enabled.
HTTP proxy settings for the DTI service are not manually (also known as administratively) disabled.
The active setting for the DTI service is not CMS (<DTIuser>@<address> : singleport) - Managed by CMS. This setting on the managed appliance indicates that the managing Central Management System appliance controls the active setting, and the appliance is using single-port communication.
Note
HTTP proxy settings can be enabled if the active setting is CMS (<DTIuser>@<address>) - Managed by CMS. This indicates that the managing Central Management System appliance controls the active setting, but the appliance is using dual-port communication.
How it works for standalone appliances
By default, standalone appliances send requests for DTI network services directly to the DTI network. You can instead configure the appliance to send requests for one or more DTI services through an HTTP proxy server.
HTTP proxy settings for a DTI service on a standalone appliance will be enabled if all of the following conditions are met:
The HTTP proxy server host address is configured.
The HTTP proxy server is enabled.
HTTP proxy settings for the DTI service are not manually (also known as administratively) disabled.
Prerequisites
Operator or Admin access.
The HTTP proxy server is deployed in your network, and is configured and enabled on the appliance (see Configuring HTTP proxy server settings using the CLI).