Solutions

Issue downloading a PAC file hosted on the ProxySG in a NAT environment.

Solutions ID:    KB4692
Version:    1.0
Status:    Published
Published date:    10/12/2011
 

Problem Description

ProxySG can host two different PAC files:  proxy_pac_file and accelerated_pac_base.pac.

Only the second one can be edited. For more information about this topic, see the following KB: https://kb.bluecoat.com/index?page=content&id=KB1395

Resolution

In this example, the ProxySG has an interface configured with IP 10.91.22.2 and we will use CURL (with -H argument to modify the HTTP Header to IP 1.1.1.1) to perform some tests.

The two PAC files are accessible at these URLs via HTTP and HTTPS, on both management and non-management ports. For example:

http://10.91.22.2/proxy_pac_file

http://10.91.22.2/accelerated_pac_base.pac

 

http://10.91.22.2:8080/proxy_pac_file

http://10.91.22.2:8080/accelerated_pac_base.pac

 

https://10.91.22.2:8082/proxy_pac_file

https://10.91.22.2:8082/accelerated_pac_base.pac

 

http://10.91.22.2:8081/proxy_pac_file

http://10.91.22.2:8081/accelerated_pac_base.pac

 

The connection on port 80 and port 8080 will be established only if the ProxySG is configured to intercept traffic on those ports.

The connection on port 8081 and 8082 will be established only if the HTTP and HTTPS management is enabled on those ports. (Management on HTTP 8081 is disabled by default.)

If a browser requests a PAC file to a non-management port (either port 80 or 8080; it doesn’t make any difference), with a host header content different from the ProxySG IP, the ProxySG will generate an exception.

A typical example is a NATed environment, where the destination IP is changed from a public to a private one, but the host header still contains the public IP.

root@debian:~# curl http://10.91.22.2/proxy_pac_file -H Host:1.1.1.1

<HTML><HEAD>

<TITLE>Network Error</TITLE>

</HEAD>

<BODY>

<FONT face="Helvetica">

<big><strong></strong></big><BR>

</FONT>

<blockquote>

<TABLE border=0 cellPadding=1 width="80%">

<TR><TD>

<FONT face="Helvetica">

<big>Network Error (tcp_error)</big>

<BR>

<BR>

</FONT>

</TD></TR>

<TR><TD>

<FONT face="Helvetica">

A communication error occurred: "Operation timed out"

</FONT>

</TD></TR>

<TR><TD>

<FONT face="Helvetica">

The Web Server may be down, too busy, or experiencing other problems preventing it from responding to requests. You may wish to try again at a later time.

</FONT>

</TD></TR>

<TR><TD>

<FONT face="Helvetica" SIZE=2>

<BR>

For assistance, contact your network support team.

</FONT>

</TD></TR>

</TABLE>

</blockquote>

</FONT>

</BODY></HTML>

root@debian:~#

From a PCAP, we can see the REQUEST with the “wrong” host header:

PCAP Host Header 1.1.1.1

The same example works fine on a management port. We will use the "--insecure" CURL argument in order to bypass untrusted certificate errors.

As you can see in the following scenario, also with a different host header, the PAC file can be downloaded.

root@debian:~# curl https://10.91.22.2:8082/proxy_pac_file --insecure -H Host:1.1.1.1

function FindProxyForURL(url, host)

{

        if( url.substring(0, 5) == "http:" )

        {

                return "PROXY 10.91.22.2:8080; DIRECT";

        }

        else if( url.substring(0, 6) == "https:" )

        {

                return "PROXY 10.91.22.2:8080; DIRECT";

        }

        else if( url.substring(0, 4) == "ftp:" )

        {

                return "PROXY 10.91.22.2:8080; DIRECT";

        }

        else

        {

                return "DIRECT";

        }

}

 

Considerations and workarounds in a NATed environment:

  • The simplest thing to do is to always use management port to provide PAC file when possible.
  • You can host the PAC file on an external web server.
  • The NAT device, if smart enough, can be used to modify the HTTP REQUEST Host value as well. (In our example, from public IP 1.1.1.1 to the Proxy IP 10.91.22.2.)
  • Configure a virtual IP on the ProxySG with the public IP address (in our case 1.1.1.1) . Please note that this configuration can generate network issues in particular routing environments. For information about virtual IPs, see the following KB article: https://kb.bluecoat.com/index?page=content&id=KB1301 .

As you can see, the request now works fine:

root@debian:~# curl http://10.91.22.2:8080/accelerated_pac_base.pac -H Host:1.1.1.1

function FindProxyForURL(url, host)

{

if( url.substring(0, 5) == "http:" )

{

  return "PROXY 10.91.22.2:8080; DIRECT";

}

else

                        {

return "DIRECT";

}

}

 The NAT device, if smart enough, can be used to completely remove the value of the host header. As you can see, the request now works fine:

root@debian:~# curl http://10.91.22.2:8080/accelerated_pac_base.pac -H Host:;

function FindProxyForURL(url, host)

{

if( url.substring(0, 5) == "http:" )

{

return "PROXY 10.91.22.2:8080; DIRECT";

}

else

{

 return "DIRECT";

}

}

root@debian:~#

 

HTTPS Note:

If the certificate is invalid, when Firefox (v 7.0.1) tries to download the PAC file, it will generate a certificate error. From this error window, it is not possible to install the certificate.

You can easily import the certificate browsing the management GUI (https://10.91.22.2:8082 in our example) and installing it when the certificate error pops up. Then after you close and reopen the browser, the PAC file should be downloaded correctly.

Firefox certificate error with PAC file

 

IE 8 will silently drop the PAC file if the certificate is invalid. You can install the certificate using the following procedure:

  1. Browse the management GUI  (https://10.91.22.2:8082).
  2. Choose Continue to this website (not recommended).
  3. Select Tools > Internet Options.
  4. Select Security > Trusted sites > Sites.
  5. Add https://10.91.22.2:8082 to the list.
  6. Refresh the current page.
  7. Choose Continue to this website (not recommended).
  8. Click Certificate Error at the right of the address bar and select View certificates.
  9. Click on Install Certificate, then in the wizard, click Next.
  10. On the next page, select Place all certificates in the following store.
  11. Click Browse, select Trusted Root Certification Authorities, and click OK.
  12. In the wizard, click Next, then Finish.
  13. If you get a Security Warning message box, click Yes.

The certificate should now be trusted, and the PAC file correctly downloaded.


Rate this Page

Please take a moment to complete this form to help us better serve you.

Did this document help answer your question?
 
 
If you are finished providing feedback, please click the RATE CONTENT button. Otherwise, please add more detail in the following text box and then click RATE CONTENT.
 
 

Your response will be used to improve our document content.

Ask a Question