Using an HTTP proxy for DTI service requests

An HTTP proxy server can act as an intermediary between an appliance and the DTI network. The following table describes the default behavior, and the behavior after an HTTP proxy is configured on the appliance and enabled for DTI service requests.

Appliance	Default behavior	HTTP proxy behavior
Standalone Appliance	The appliance connects directly to the DTI network.	The appliance connects to the DTI network through the HTTP proxy.
Central Management System Appliance	The Central Management System appliance connects directly to the DTI network.	The Central Management System appliance connects to the DTI network through the HTTP proxy.
Managed Appliance	The appliance communicates with the DTI network through the Central Management System appliance.	Single-port communication with the Central Management System appliance (the default, in which both management and DTI network traffic use SSH port 22)—The appliance connects to the DTI network through the HTTP proxy. Dual-port communication with the Central Management System appliance (in which management traffic uses SSH port 22 and DTI network traffic uses HTTP port 443)—The appliance either connects directly to the DTI network through the HTTP proxy, or through the managing Central Management System appliance to the HTTP proxy.

Appliance

Default behavior

HTTP proxy behavior

Standalone Appliance

The appliance connects directly to the DTI network.

The appliance connects to the DTI network through the HTTP proxy.

Central Management System Appliance

The Central Management System appliance connects directly to the DTI network.

The Central Management System appliance connects to the DTI network through the HTTP proxy.

Managed Appliance

The appliance communicates with the DTI network through the Central Management System appliance.

Single-port communication with the Central Management System appliance (the default, in which both management and DTI network traffic use SSH port 22)—The appliance connects to the DTI network through the HTTP proxy.

Dual-port communication with the Central Management System appliance (in which management traffic uses SSH port 22 and DTI network traffic uses HTTP port 443)—The appliance either connects directly to the DTI network through the HTTP proxy, or through the managing Central Management System appliance to the HTTP proxy.

Important
If an HTTP proxy server is configured and enabled on a managed appliance that uses single-port communication with the Central Management System appliance, the managed appliance will automatically fail over to the proxy server for all DTI services if the Central Management System appliance becomes unavailable.

This section includes the following information:

Enabling HTTP proxy settings for DTI network services

DTI network services include: download, upload destination, mil, faude, enrollment, avsuite, helix, and virtual. You can designate that an appliance send requests for one or more of these services through an HTTP proxy server. The appliance can either be managed by a Central Management System appliance or be a standalone appliance.

Note
The helix DTI network service is not currently used. For information about allowing appliances to communicate with Helix though an HTTP proxy server, see the Helix Integration Guide.
The enrollment service pertains only to appliances that are running in sensor or hybrid MVX mode. The virtual service pertains only to virtual appliances.

How it works for managed appliances

By default, a managed appliance sends requests for all DTI network services through the Central Management System appliance. You can instead configure the appliance to bypass the Central Management System appliance and send requests for one or more DTI network services through an HTTP proxy server.

For example, the managed appliance could use the Central Management System appliance as the DTI source for software downloads, but for more effective detection and remediation, use the proxy server for detection-related DTI services such as faude and avsuite.

This feature has the following benefits:

Reliability—If the managed appliance uses single-port communication (the default method), requests for all DTI network services will fail over to the HTTP proxy server if the Central Management System appliance becomes unavailable. For example, suppose the Central Management System appliance becomes unavailable during maintenance activities. The managed appliance will automatically use the proxy server to reach the DTI network until its connection with the Central Management System appliance is restored. For details, see Enabling HTTP proxy settings for automatic failover using the CLI on the facing page.
Decentralization —You can limit the amount of traffic passing through the Central Management System appliance when requests for DTI services go through an HTTP proxy server instead of the Central Management System appliance.
Reduced Network Latency—You can send requests through an HTTP proxy server if the managed appliance is geographically closer to the DTI network than it is to the Central Management System appliance.

HTTP proxy settings for a DTI service on a managed appliance will be enabled if all of the following conditions are met:

The HTTP proxy server host address is configured.
The HTTP proxy server is enabled.
HTTP proxy settings for the DTI service are not manually (also known as administratively) disabled.
The active setting for the DTI service is not CMS (<DTIuser>@<address> : singleport) - Managed by CMS. This setting on the managed appliance indicates that the managing Central Management System appliance controls the active setting, and the appliance is using single-port communication.
Note
HTTP proxy settings can be enabled if the active setting is CMS (<DTIuser>@<address>) - Managed by CMS. This indicates that the managing Central Management System appliance controls the active setting, but the appliance is using dual-port communication.

How it works for standalone appliances

By default, standalone appliances send requests for DTI network services directly to the DTI network. You can instead configure the appliance to send requests for one or more DTI services through an HTTP proxy server.

HTTP proxy settings for a DTI service on a standalone appliance will be enabled if all of the following conditions are met:

The HTTP proxy server host address is configured.
The HTTP proxy server is enabled.
HTTP proxy settings for the DTI service are not manually (also known as administratively) disabled.

Prerequisites

Operator or Admin access.
The HTTP proxy server is deployed in your network, and is configured and enabled on the appliance (see Configuring HTTP proxy server settings using the CLI).

Enabling HTTP proxy settings for automatic failover using the CLI

You can configure a managed appliance that uses single-port communication to use the Central Management System appliance for DTI services, but to fail over to the HTTP proxy server if the Central Management System appliance becomes unavailable. This is the default behavior when an HTTP proxy server is configured and enabled on the appliance.

To enable automatic failover for DTI services:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Configure and enable the proxy server as described in Configuring HTTP proxy server settings using the CLI
Verify that the Central Management System appliance controls the active settings for the DTI services, that the HTTP proxy server is enabled, and that HTTP proxy settings are disabled for DTI services:
```
hostname (config) # show fenet dti configuration brief
```
Save your changes:
```
hostname (config) # write memory
```

Example

The following example configures minimal settings for an HTTP proxy server and then enables it. It then shows that the Central Management System appliance currently controls the active settings for DTI services, that the proxy server is configured and enabled on the appliance, and that proxy settings are currently disabled for DTI services.

If the Central Management System appliance becomes unavailable, the values in the ACTIVE SETTINGS section change to DTI, and the values in the ACTIVE SETTINGS FOR HTTP PROXY section change to yes.

hostname (config) # fenet proxy host 192.168.2.3
hostname (config) # fenet proxy enable
hostname (config) # show fenet dti configuration brief


DTI CLIENT CONFIGURATIONS:

  ACTIVE SETTINGS:

    Mode               : online
    Download source    : CMS (User8@10.4.5.6 : singleport) - Managed by CMS
    Upload destination : CMS (User8@10.4.5.6 : singleport) - Managed by CMS
    Mil service        : CMS (User8@10.4.5.6 : singleport) - Managed by CMS
    Faude service      : CMS (User8@10.4.5.6 : singleport) - Managed by CMS
    ...

  ACTIVE SETTINGS FOR HTTP PROXY:

    Http proxy         : @192.168.2.3:8080 (User agent:)
    
    Download source    : no (reason: singleport is in use)
    Upload destination : no (reason: singleport is in use)
    Mil service        : no (reason: singleport is in use)
    Faude service      : no (reason: singleport is in use)
    ...

Enabling HTTP proxy settings on a single-port managed appliance using the CLI

Use the commands in this topic to enable a managed appliance that uses single-port communication to send DTI service requests through an HTTP proxy server.

To enable HTTP proxy settings for a DTI service:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

View the current DTI service configuration:

hostname (config) # show fenet dti configuration brief

Move control of the DTI service to the managed appliance.

For the download service:

hostname (config) # no fenet dti source override enable

For the enrollment, faude, mil, or virtual service:

hostname (config) # no fenet dti <service> service override enable

For the upload destination service:

hostname (config) # no fenet dti upload destination override enable

View the current DTI service configuration:

hostname (config) # show fenet dti configuration brief

If the value for the service in the ACTIVE SETTINGS FOR HTTP PROXY section is no, enable proxy settings for the service.
- For the source service:
```
hostname (config) # fenet dti source proxy enable
```
- For the enrollment, faude, or virtual service:
```
hostname (config) # fenet dti <service> service proxy enable
```
- For the upload destination service:
```
hostname (config) # fenet dti upload destination proxy enable
```

Verify your changes:

hostname (config) # show fenet dti configuration brief

Save your changes:
```
hostname (config) # write memory
```

Examples

The following example moves control of the faude service to the managed appliance, which enables HTTP proxy settings for the service.

hostname (config) # show fenet dti configuration brief

DTI CLIENT CONFIGURATIONS:

  ACTIVE SETTINGS:
    
    Mode               : online
    Download source    : CMS (User8@10.4.5.6 : singleport) - Managed by CMS
    Upload destination : CMS (User8@10.4.5.6 : singleport) - Managed by CMS
    Mil service        : CMS (User8@10.4.5.6 : singleport) - Managed by CMS
    Faude service      : CMS (User8@10.4.5.6 : singleport) - Managed by CMS
    ...

  ACTIVE SETTINGS FOR HTTP PROXY: 

    Http proxy         : @myproxy.mycompany.com:8080 (user agent:)

    Download source    : no (reason: singleport is in use)
    Upload destination : no (reason: singleport is in use)
    Mil service        : no (reason: singleport is in use)
    Faude service      : no (reason: singleport is in use) 
    ....

hostname (config) # no fenet dti faude service override enable
hostname (config) # show fenet dti configuration brief

DTI CLIENT CONFIGURATIONS:

  ACTIVE SETTINGS:
    
    Mode               : online
    Download source    : CMS (User8@10.4.5.6 : singleport) - Managed by CMS
    Upload destination : CMS (User8@10.4.5.6 : singleport) - Managed by CMS 
    Mil service        : CMS (User8@10.4.5.6 : singleport) - Managed by CMS
    Faude service      : DTI (User8@unity.fireeye.com) - Managed by Appliance
    ...

  ACTIVE SETTINGS FOR HTTP PROXY: 

    Http proxy         : @myproxy.mycompany.com:8080 (user agent:)

    Download source    : no (singleport is in use)
    Upload destination : no (singleport is in use)
    Mil service        : no (singleport is in use)
    Faude service      : yes
    ...

The following example re-enables HTTP proxy settings for the source service.

hostname (config) # show fenet dti configuration brief

DTI CLIENT CONFIGURATIONS:

  ACTIVE SETTINGS:
    
    Mode               : online
    Download source    : DTI (User8@staticcloud.fireeye.com) - Managed by Appliance
    ...

  ACTIVE SETTINGS FOR HTTP PROXY: 

    Http proxy         : @myproxy.mycompany.com:8080 (user agent:)
    Download source    : no (reason: administratively disabled)
    ...

hostname (config) # fenet dti source proxy enable
hostname (config) # show fenet dti configuration brief

DTI CLIENT CONFIGURATIONS:

  ACTIVE SETTINGS:
    
    Mode               : online
    Download source    : DTI (User8@staticcloud.fireeye.com) - Managed by Appliance
    ...

  ACTIVE SETTINGS FOR HTTP PROXY: 

    Http proxy         : @myproxy.mycompany.com:8080 (user agent:)
    Download source    : yes
    ...

Enabling HTTP proxy settings on a dual-port managed appliance using the CLI

Use the commands in this topic to enable a managed appliance that uses dual-port communication to send DTI service requests through an HTTP proxy server.

Note
When the appliance uses dual-port communication, requests can either be sent directly to the HTTP proxy, or through the Central Management System appliance to the HTTP proxy (the default behavior).

To enable HTTP proxy settings for a DTI service:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

View the current DTI service configuration:

hostname (config) # show fenet dti configuration brief

To send DTI service requests directly to the HTTP proxy (optional): Move control of the DTI service to the managed appliance.
- For the download service:
```
hostname (config) # no fenet dti source override enable
```
- For the enrollment, faude, mil, or virtual service:
```
hostname (config) # no fenet dti <service> service override enable
```
- For the upload destination service:
```
hostname (config) # no fenet dti upload destination override enable
```

View the current DTI service configuration:

hostname (config) # show fenet dti configuration brief

If the value for the service in the ACTIVE SETTINGS FOR HTTP PROXY section is no, enable proxy settings for the service.
- For the source service:
```
hostname (config) # fenet dti source proxy enable
```
- For the enrollment, faude, or virtual service:
```
hostname (config) # fenet dti <service> service proxy enable
```
- For the upload destination service:
```
hostname (config) # fenet dti upload destination proxy enable
```

Verify your changes:

hostname (config) # show fenet dti configuration brief

Save your changes:
```
hostname (config) # write memory
```

Examples

The following example moves control of the source service to the managed appliance. This allows the managed appliance to bypass the Central Management System appliance and send requests for software updates directly to the HTTP proxy server.

hostname (config) # show fenet dti configuration brief

DTI CLIENT CONFIGURATIONS:

  ACTIVE SETTINGS:
    
    Mode               : online
    Download source    : CMS (User8@10.4.5.6) - Managed by CMS
    ...

  ACTIVE SETTINGS FOR HTTP PROXY: 

    Http proxy         : @myproxy.mycompany.com:8080 (user agent:)
    Download source    : yes
    ...

hostname (config) # no fenet dti source override enable
hostname (config) # show fenet dti configuration brief

DTI CLIENT CONFIGURATIONS:
 
  ACTIVE SETTINGS:
    
    Mode               : online
    Download source    : DTI (User8@staticcloud.fireeye.com) - Managed by Appliance
    ...

  ACTIVE SETTINGS FOR HTTP PROXY: 

    Http proxy         : @myproxy.mycompany.com:8080 (user agent:)
    Download source    : yes
    ...

The following example re-enables HTTP proxy settings for the faude service. In this example, the Central Management System appliance controls the DTI services, so DTI requests are sent to the HTTP proxy through the Central Management System appliance.

hostname (config) # show fenet dti configuration brief

DTI CLIENT CONFIGURATIONS:
 
  ACTIVE SETTINGS:
    
    Mode               : online
    Download source    : CMS (User8@10.4.5.6) - Managed by CMS
    Upload destination : CMS (User8@10.4.5.6) - Managed by CMS 
    Mil service        : CMS (User8@10.4.5.6) - Managed by CMS
    Faude service      : CMS (User8@10.4.5.6) - Managed by CMS
    ...

  ACTIVE SETTINGS FOR HTTP PROXY: 

    Http proxy         : @myproxy.mycompany.com:8080 (user agent:)

    Download source    : yes
    Upload destination : yes
    Mil service        : yes
    Faude service      : no (reason: administratively disabled)   
    ...

hostname (config) # fenet dti faude service proxy enable
hostname (config) # show fenet dti configuration brief

DTI CLIENT CONFIGURATIONS:
 
  ACTIVE SETTINGS:
    
    Mode               : online
    Download source    : CMS (User8@10.4.5.6) - Managed by CMS
    Upload destination : CMS (User8@10.4.5.6) - Managed by CMS 
    Mil service        : CMS (User8@10.4.5.6) - Managed by CMS
    Faude service      : CMS (User8@10.4.5.6) - Managed by CMS
    ...

  ACTIVE SETTINGS FOR HTTP PROXY: 

    Http proxy         : @myproxy.mycompany.com:8080 (user agent:)

    Download source    : yes
    Upload destination : yes
    Mil service        : yes
    Faude service      : yes
    ...

Enabling HTTP proxy settings on a standalone appliance using the CLI

Use the commands in this topic to enable a standalone appliance to send DTI service requests to the DTI network through an HTTP proxy server.

To enable HTTP proxy settings for a DTI service:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

View the current DTI service configuration:

hostname (config) # show fenet dti configuration brief

If the value for the service in the ACTIVE SETTINGS FOR HTTP PROXY section is no, enable proxy settings for the service.
- For the source service:
```
hostname (config) # fenet dti source proxy enable
```
- For the enrollment, faude, or virtual service:
```
hostname (config) # fenet dti <service> service proxy enable
```
- For the upload destination service:
```
hostname (config) # fenet dti upload destination proxy enable
```

Verify your changes:

hostname (config) # show fenet dti configuration brief

Save your changes:
```
hostname (config) # write memory
```

Example

The following example enables HTTP proxy settings for the faude and avsuite DTI services.

hostname (config) # show fenet dti configuration brief

DTI CLIENT CONFIGURATIONS:

  ACTIVE SETTINGS:
    
    Mode               : online
    Download source    : DTI (User8@staticcloud.fireeye.com) 
    Upload destination : DTI (User8@up-staticcloud.fireeye.com)
    Mil service        : DTI (User8mil-staticcloud.fireeye.com)
    Faude service      : DTI (User8@unity.fireeye.com)
    AVSuite service    : DTI (User8@unity.fireeye.com)
    ...

  ACTIVE SETTINGS FOR HTTP PROXY: 

    Http proxy         : @myproxy.mycompany.com:8080 (user agent:)

    Download source    : no (reason: administratively disabled)
    Upload destination : no (reason: administratively disabled)
    Mil service        : no (reason: administratively disabled)
    Faude service      : no (reason: administratively disabled)
    AVSuite service    : no (reason: administratively disabled) 
    ....

hostname (config) # fenet dti faude service proxy enable
hostname (config) # fenet dti avsuite service proxy enable
hostname (config) # show fenet dti configuration brief

DTI CLIENT CONFIGURATIONS:

  ACTIVE SETTINGS:
    
    Mode               : online
    Download source    : DTI (User8@staticcloud.fireeye.com)
    Upload destination : DTI (User8@up-staticcloud.fireeye.com) 
    Mil service        : DTI (User8@mil-staticcloud.fireeye.com)
    Faude service      : DTI (User8@unity.fireeye.com)
    AVSuite service    : DTI (User8@unity.fireeye.com)
    ...

  ACTIVE SETTINGS FOR HTTP PROXY: 

    Http proxy         : @myproxy.mycompany.com:8080 (user agent:)

    Download source    : no (reason: administratively disabled)
    Upload destination : no (reason: administratively disabled)
    Mil service        : no (reason: administratively disabled)
    Faude service      : yes
    AVSuite service    : yes
    ...

Disabling HTTP proxy settings for DTI services

Use the commands in this section to disable HTTP proxy settings for a specific DTI service.

To disable HTTP proxy settings for a DTI service:

For the source service:

hostname (config) # no fenet dti source proxy enable

For the upload destination service:

hostname (config) # no fenet dti upload destination proxy enable

For the mil, faude, enrollment, avsuite, or virtual service:

hostname (config) # no fenet dti <service> service proxy enable

Note
If the managed appliance uses single-port communication to communicate with the Central Management System appliance, you can alternatively move control of the DTI service back to the Central Management System appliance. This automatically disables the HTTP proxy for that service. Use one of the following commands:
fenet dti source override enable
fenet dti upload destination override enable
fenet dti <service> service override enable

Examples

The following example disables HTTP proxy settings for the source service on a managed appliance that uses single-port communication.

hostname (config) # no fenet dti source proxy enable
hostname (config) # show fenet dti configuration brief

DTI CLIENT CONFIGURATIONS:

  ACTIVE SETTINGS:
    ...
    Download source    : DTI (User8@staticcloud.fireeye.com) - Managed by Appliance

  ACTIVE SETTINGS FOR HTTP PROXY:

    Http proxy         : bsmith@192.168.2.3:8080 (user agent:)

    Download source    : no (reason: administratively disabled)
    ...

The following example moves control of the source service on a managed appliance that uses single-port communication to the Central Management System appliance. This action disables the HTTP proxy settings for the service.

hostname (config) # fenet dti source override enable
hostname (config) # show fenet dti configuration brief

DTI CLIENT CONFIGURATIONS:

ACTIVE SETTINGS:
    ...
    Download source    : CMS (User8@10.4.5.6 : singleport) - Managed by CMS

  ACTIVE SETTINGS FOR HTTP PROXY:

    Http proxy         : bsmith@192.168.2.3:8080 (user agent:)

    Download source    : no (reason: singleport is in use)
    ...

The following example disables HTTP proxy settings for the source service on a managed appliance that uses dual-port communication.

hostname (config) # no fenet dti source proxy enable
hostname (config) # show fenet dti configuration brief
...

  ACTIVE SETTINGS FOR HTTP PROXY:

    Http proxy         : bsmith@192.168.2.3:8080 (user agent:)
   
    Download source    : no (reason: admnistratively disabled)
    ...

The following example disables HTTP proxy settings for the faude and avsuite services on a standalone appliance.

hostname (config) # no fenet dti faude service proxy enable
hostname (config) # no fenet avsuite service proxy enable
hostname (config) # show fenet dti configuration brief

DTI CLIENT CONFIGURATIONS:
  ...

  ACTIVE SETTINGS FOR HTTP PROXY:

    Http proxy          : bsmith@192.168.2.3:8080 (user agent:)

    ...
    Faude service       : no (reason: administratively disabled)
    AVSuite service     : no (reason: administratively disabled)
    ...