CacheGuard-OS
User's Guide - Version UF-2.6.1

General Modes

A CacheGuard appliance is an integrated system that secures and optimises internet traffic by providing a comprehensive range of features. To achieve an optimised configuration, it is recommended that you activate only the features you actually need and deactivate all others. However, if required, all available features can be activated simultaneously on the same appliance, and they will operate seamlessly together.

The mode command allows you to activate or deactivate different features known as modes. For almost all modes, there is a command with the same name that allows you to configure that mode. For example, the embedded firewall can be activated using the mode firewall on command, and the firewall can be configured using the firewall command. There are two main groups of modes: network modes and function modes. The sections below provide a brief description of all available modes. Note that the apply command must be invoked after activating or deactivating a mode.

Network Modes

This section provides a brief description of all network modes. Available network modes operate at the IP and TCP/UDP layers.

• Network Router
• DHCP Server
• Caching DNS
• High Availability
• Passive FTP
• Quality of Service
• Source NAT
• Transparent Web
• Transparent Web SNAT
• Tagged VLANs

Network Router

A CacheGuard appliance can act as a network router supporting static routes and multi-gateway configurations. Use the mode router on command to activate the router. To configure routing, use the ip route command.

DHCP Server

A CacheGuard appliance integrates a DHCP server to dynamically assign IP addresses to connected devices. To activate the DHCP server, use the mode dhcp on command. You can configure the DHCP server using the dhcp command. This command allows you to define dynamic IP ranges and, if necessary, reserve IP addresses for specific devices.

Caching DNS

A CacheGuard appliance integrates a caching-only Domain Name Server that can be used by all other integrated services as well as by external clients. To activate the integrated DNS server and make it available for external use, execute the following commands:

• dns raz
• dns add localhost
• mode dns on

High Availability

Two or more CacheGuard appliances can be deployed in HA (High Availability) mode using the VRRP protocol. In addition, network interfaces (external, internal, etc.) of a CacheGuard appliance can be associated with multiple physical interfaces to provide link redundancy. To activate HA, use the mode ha on command. Once HA mode is activated, use the vrrp command to associate one or more VRRP IP addresses with at least one network interface. To associate more than one physical network interface with a logical interface, use the link command.

Passive FTP

By default, a CacheGuard appliance uses the passive FTP protocol to initiate FTP sessions with external FTP servers. To use active FTP mode instead, you must deactivate passive FTP mode by using the mode ftppassive off command. Note that switching between passive and active FTP modes is done globally (it cannot be set per FTP session).

Quality of Service

A CacheGuard appliance can shape and schedule network traffic to offer QoS (Quality of Service) to users and applications. Using the QoS manager in a CacheGuard appliance allows you to reserve network bandwidth for critical applications. To activate QoS, use the mode qos on command. You can then configure traffic shaping using the qos command. All traffic destined for services (proxy, antivirus, etc.) running on the appliance itself, as well as routed traffic passing through it, is managed by the QoS system.

Source NAT

A CacheGuard appliance can perform Source Network Address Translation (SNAT) on all outgoing traffic through its external interface, replacing the source IP with its own external IP address. This mode is called snat and can be activated using the mode snat on command.

Transparent Web

A CacheGuard appliance can be deployed transparently in a network to intercept web traffic for management (caching, filtering, etc.). In transparent mode, there is no need to configure web browsers to use the CacheGuard appliance as a web proxy. The simplest way to implement a CacheGuard appliance transparently is to use it as the default gateway to the internet. This mode is called tweb (or transparent) and can be activated using the mode tweb on (or mode transparent on) command. The transparent (or tweb) command can then be used to selectively intercept web traffic.

As HTTP is increasingly being replaced by HTTPS, the capabilities of transparent mode are significantly reduced. Fortunately, a CacheGuard appliance can also intercept HTTPS traffic. The transparent interception of HTTPS traffic is referred to as sslmediate mode and is described in the Function Modes section below. This mode is considered a function mode rather than a network mode because it involves managing SSL CA certificates in addition to network configuration. SSL mediation requires the deployment of a trusted CA certificate generated by the integrated mini PKI.

Transparent Web SNAT

In transparent mode (tweb), intercepted web traffic can either preserve real source IP addresses or be translated using Source NAT with the CacheGuard appliance's external IP address. The tnat (transparent NAT) mode activates (on) source IP address translation for transparently intercepted web traffic. The tnat mode is activated by default. To deactivate it, use the mode tnat off command. Note that when tnat is deactivated, routed web traffic must not be asymmetric with respect to the CacheGuard appliance (i.e. all incoming and outgoing web traffic exchanged with clients should pass through the same network interface).

Tagged VLANs

A CacheGuard appliance supports IEEE 802.1Q VLAN (Virtual LAN) tagging on its internal network interface to secure and isolate predefined functional traffic such as admin, web, rweb, and other functional networks. To activate VLANs, use the mode vlan on command. Once VLAN mode is activated, use the vlan and ip commands to define VLANs and assign IP addresses.

If both web and rweb modes are activated on the same appliance, and SSL offloading is configured (where HTTPS traffic between the CacheGuard appliance and real web servers is unencrypted), it is recommended to use a distinct VLAN for rweb traffic. Refer to the rweb command to learn how to configure the rweb mode for SSL offloading.

Function Modes

This section provides a brief description of all function modes. Available function modes operate at the application layer and are as follows:

• Forwarding Web Proxy
• Web Caching
• HTTP Compression
• Anonymous Browsing
• Web Authentication
• URL Guarding
• Stateful Firewall
• Antivirus
• SSL Mediation
• Traffic Logging
• IPsec VPN
• Reverse Web Proxy
• Web Application Firewall
• OCSP Responder
• Mini PKI

Forwarding Web Proxy

A CacheGuard appliance integrates a high-performance forwarding web proxy that provides secure and optimised access to web resources. The web proxy is the core component responsible for applying web filtering, caching, authentication, antivirus scanning, SSL mediation, compression, and logging policies. To activate the use of the forwarding web proxy in explicit, use the mode web on command. Explicit mode means that clients must explicitly use the forwarding web proxy by specifying the appliance's internal IP address and web proxy port (see the port command).

Web Caching

A CacheGuard appliance can cache web content to reduce bandwidth consumption, improve response times, and decrease the load on origin servers. Frequently accessed objects are stored locally and served to clients whenever possible, while respecting standard HTTP caching directives. To activate web caching, use the mode cache on command. Cache behaviour is configured using the cache command.

HTTP Compression

A CacheGuard appliance can reduce bandwidth usage by compressing HTTP responses before delivering them to web clients. HTTP compression improves perceived performance for compressible content while reducing network utilisation. To activate HTTP compression, use the mode compress on command.

Anonymous Browsing

A CacheGuard appliance can modify certain HTTP headers to make web requests anonymous. To activate anonymous browsing, use the mode anonymous on command. Note that activating this mode may lead to being blocked by certain websites; therefore, it is recommended to keep this mode deactivated unless required.

Web Authentication

The embedded web proxy in a CacheGuard appliance can request LDAP or Kerberos servers to authenticate web clients before granting them access to the web (or web servers in reverse mode). To activate authentication, use the mode authenticate on command. You must then configure authentication using the authenticate command. HTTPS services rely on certificates managed by the integrated mini PKI.

URL Guarding

A CacheGuard appliance provides URL guarding to control access to web resources based on categories, blacklists, whitelists, regular expressions, and custom policies. URL guarding protects users from malicious or inappropriate websites while enforcing organisational browsing policies. To activate URL guarding, use the mode guard on command. Guarding policies are configured using the guard and urllist commands.

Stateful Firewall

A CacheGuard appliance integrates a stateful firewall that enables control of routed network traffic based on source and/or destination IP addresses and protocols. In addition, the firewall supports source and destination NAT. To activate firewall, use the mode firewall on command. The firewall is configured using the firewall command.

Antivirus

A CacheGuard appliance embeds an antivirus that blocks malware (viruses, trojans, and worms) in web traffic destined for web clients (human or machine) as well as web servers. The antivirus can also be used as a service by external systems such as an MTA (Mail Transfer Agent). To activate antivirus, use the mode antivirus on command. The antivirus command is used to configure it.

SSL Mediation

SSL mediation enables a CacheGuard appliance to decrypt, inspect, and re-encrypt HTTPS traffic. This capability allows antivirus scanning, web caching, and traffic logging to operate on encrypted communications. SSL mediation requires the deployment of a trusted Certificate Authority (CA) certificate on client devices. To activate SSL mediation, use the mode sslmediate on command. Configuration is performed using the sslmediate command.

Traffic Logging

A CacheGuard appliance can record detailed information about web and network traffic for auditing, troubleshooting, and reporting purposes. Logged information may include client identities, requested resources, security events, and other traffic-related information. To activate traffic logging, use the mode log on command. Logging behaviour is configured using the log command.

IPsec VPN

A CacheGuard appliance integrates an IPsec VPN gateway that enables secure site-to-site and remote-access connectivity over untrusted networks. IPsec VPNs provide encrypted communications between remote offices, cloud infrastructures, and enterprise networks. To activate IPsec VPN, use the mode vpnipsec on command. VPN tunnels are configured using the vpnipsec command.

Reverse Web Proxy

A CacheGuard appliance can operate as a reverse web proxy to securely publish internal web applications and services. The reverse proxy provides load balancing, SSL offloading, authentication, caching, compression, antivirus scanning, and Web Application Firewall protection for backend servers. To activate reverse proxy, use the mode rweb on command. Reverse proxy services are configured using the rweb command.

Web Application Firewall

A CacheGuard appliance integrates a Web Application Firewall (WAF) to protect web applications against common attacks such as SQL injection, cross-site scripting (XSS), command injection, protocol violations, and other application-layer threats. The WAF operates together with the reverse web proxy to inspect HTTP and HTTPS traffic before they reach backend servers. To activate WAF, use the mode waf on command. WAF policies are configured using the waf command.

OCSP Responder

A CacheGuard appliance integrates an Online Certificate Status Protocol (OCSP) responder that provides certificate revocation status information to clients. The OCSP responder can be used together with the integrated mini PKI (Public Key Infrastructure). To activate OCSP responder, use the mode ocsp on command. The responder is configured using the tls command. The OCSP responder can be used together with the integrated mini PKI.

Mini PKI

A CacheGuard appliance integrates a mini PKI (Public Key Infrastructure) to manage digital certificates used by its embedded services. The mini PKI includes a Certificate Authority (CA), certificate signing requests (CSRs), an Online Certificate Status Protocol (OCSP) responder. It can issue certificates for SSL mediation, reverse web proxy services, and other TLS-enabled features. The mini PKI is configured using the tls command.