UTM in transparent/bridged mode

There is a significant loss in capability and accountability when you switch to teansparent mode.

I suggest that you enable teansparent mode as a backup to standard mode rather than a replacement.

Hi Douglas,

Thanks for the replies.  The problem is that I don't want to specify proxy settings on my appliances.  We have issues where some applications ignore the system proxy settings and attempt to go straight out through the firewall too.

Thanks

The two proxy methods are not exclusive.   The proxy method determines the port -- UTM standard proxy uses 8080 (by default), while transparent mode monitors 80 and 443 only.  Since the two modes operate on different ports, they can be operate in parallel.   Of course, to use transparent mode, the UTM needs to be on the path to the internet, which was the focus of my previous post.   (That suggestion does not requiring any IP address changes.) 

To use both methods, you have to create a filter profile for each method:  The source IP and port determines the filter profile.  The filter profile (and optionally the device type) determines the authentication method and the https inspection method.   The authentication method determines the user.  The user determines the policy.  The policy determines the filter action, and the filter action determines whether the URL is allowed.

With both modes enabled, the transparent mode proxy will handle any traffic that does not honor the device proxy configuration.    This includes traffic that is configured for DIRECT in your proxy script.  You need to add your Direct destinations into the transparent skiplist (or retest to see if they work acceptably in transparent mode.)

With non-browser applications, they will not have NTLM information needed for automatic user identification.   Consequently, many problems with these applications can be solved with an exception entry to bypass authentication for the destination server.   This works with both proxy modes.

When transparent mode takes effect, firewall rules to block port 80/443 will no longer be relevant, so you may need to create appropriate transparent-mode policies to maintain your desired security posture.

The two proxy methods are not exclusive.   The proxy method determines the port -- UTM standard proxy uses 8080 (by default), while transparent mode monitors 80 and 443 only.  Since the two modes operate on different ports, they can be operate in parallel.   Of course, to use transparent mode, the UTM needs to be on the path to the internet, which was the focus of my previous post.   (That suggestion does not requiring any IP address changes.) 

To use both methods, you have to create a filter profile for each method:  The source IP and port determines the filter profile.  The filter profile (and optionally the device type) determines the authentication method and the https inspection method.   The authentication method determines the user.  The user determines the policy.  The policy determines the filter action, and the filter action determines whether the URL is allowed.

With both modes enabled, the transparent mode proxy will handle any traffic that does not honor the device proxy configuration.    This includes traffic that is configured for DIRECT in your proxy script.  You need to add your Direct destinations into the transparent skiplist (or retest to see if they work acceptably in transparent mode.)

With non-browser applications, they will not have NTLM information needed for automatic user identification.   Consequently, many problems with these applications can be solved with an exception entry to bypass authentication for the destination server.   This works with both proxy modes.

When transparent mode takes effect, firewall rules to block port 80/443 will no longer be relevant, so you may need to create appropriate transparent-mode policies to maintain your desired security posture.