How to set your first SWG Per-Request Policy with 11.6 release

Hi,

Please find below an how-to explaining how to set your first SWG Policy on 11.6 release with the latest feature "Per-Request Policy".

In this scenario, I control on each request if the website is part of Financial category in order to bypass SSL inspection.

Video here : http://youtu.be/zp269s5fQ-8

 

Published Jan 06, 2015
Version 1.0
BIG-IP Access Policy Manager (APM)
france
paris users
security
  • Philip_Jonsson's avatar
    Philip_Jonsson
    Icon for MVP rankMVP
    Feb 27, 2018

    Hey Matthieu, thanks for a great video! This made the setup look so much easier than going through the entire SWG documentation.

     

    I just got a few follow-up question, since the iApp is configuring the virtual servers, where does the SWG state which of these virtual servers that should be used? Is it defined in the Per-Request Policy depending on which Allow statement you reach? For instance, if you follow the HTTPS branch you will hit the HTTPS VS and if you follow the HTTP branch you hit the HTTP VS?

     

    The reason I'm asking is that I'm currently assisting with troubleshooting a SWG setup and with limited experience working with the product, I have tried to understand the flow by reviewing the configuration in iHealth and I have not found any "proof" as to where this is defined in the configuration.

     

    My guess is that it happens under the hood of the SWG based on the Per-Request Policy.

     

    Also, does SWG support other protocols other than HTTP/HTTPS?

     

  • Matt_Dierick's avatar
    Matt_Dierick
    Icon for Employee rankEmployee
    Jan 22, 2015
    Elle doit arriver sous peu dans DevCentral ou downloads.f5.com. Je me renseigne si on peut la partager en attendant.
  • InnO's avatar
    InnO
    Icon for Nimbostratus rankNimbostratus
    Jan 21, 2015
    Bonjour, Merci pour cette video, c'est exactement ce que je cherchais :) Je ne parviens pas a trouver l'iApp f5.secure_web_gateway.v1.1.0, peux-tu poster le lien si possible ? Merci !