Forum Discussion

Pedro_Roure's avatar
Pedro_Roure
Icon for Cirrus rankCirrus
Jun 25, 2018

[HELP] - APM SWG deployment not working

Anyone here has deployed APM SWG through the iApp ( from "F5 Downloads" ) with sucess ? I made the deploy using a explicit forward proxy configurantion. But only HTTP traffic works, when the traffics is HTTPS don't works. When I try to access an HTTPS site (like ) i received from BIGIP a "503 service unavailable" response with the following message in the response body: "Host:

 

 

The proxy could not connect to the site you've requested. The site is either down or the network connection cannot be made. Please check your spelling and try again if you feel you've encountered this message in error.".

 

Any ideas of what is happening and how can I fix this ? How can I troubleshoot SWG ?

 

PS: I tested with curl on the command line access to many HTTPS sites and is working well. Is not a firewall issue.

 

Thanks.

 

BIG-IP
BIG-IP Access Policy Manager (APM)
security
  • Pedro_Roure's avatar
    Pedro_Roure
    Icon for Cirrus rankCirrus
    Jun 27, 2018

    Initially, i was running version 12.1.2. But as I suspected that the problem was version related, i upgrade to version 12.1.3.5. Created a new application service using the iapp, but the problem remained. So, i tried upgrade to version 13.1.0.7. Deleted the application service and created a new again, but again the problem remained. So i decided to try the configuration manually, following the swg documentation and all works sucessfully. If helps, that is how my system is configured:

    1) I have a route domain called "rd-proxy" with ID 2 ;

    2) I hava a partition called "PROXY" ;

    3) The default route domain for partition "PROXY" is the route domain "rd-proxy" ;

    4) I have two VLANS:

    - internal-proxy: used for traffic from clients to the vs forward proxy ;
- external-proxy: used for outboud traffic for internet ;

    5) I have two routes: 

    - Internal route to network 10.0.0.0/8 through vlan "internal-proxy" ;
    - External (default) route through vlan "external-proxy" ;

    Thanks,