Changes between Version 8 and Version 9 of Documentation/Community/HowTo/SelectRightHTTPproxyDesign

Timestamp:

05/23/12 09:48:35 (12 months ago)

Author:

christian (IP: 178.250.211.240)

Comment:

typos, rephrasing and HTTPS on non std ports

Documentation/Community/HowTo/SelectRightHTTPproxyDesign

@@ -16 +16 @@
 Proxy can be deployed either on Intranet for internal servers or between Intranet and Internet. This is the main usage of Zentyal Proxy component.
 
-Proxy can be configured either in transparent or non transparent mode. This document aims at explaining difference between these 2 designs so that you can make the right choice, understanding pros and cons of each design.
+Proxy can be configured either in '''transparent''' or non transparent ('''explicit''') mode. This document aims at explaining difference between these 2 designs so that you can make the right choice, understanding pros and cons of each design.
 
 Before starting such discussion, let's clarify some points:
 Proxy, because this is one more component in the middle between client and server, will not improve performance until, if cache is used, there is a significant number of users benefiting from cache.
-Latency will not be shorter except for pages in cache but there is more and more “PRAGMA NO CACHE” tags :-([[BR]] On the other hand, proxy will bring a lot of added value in term of security and control.
+Latency will not be shorter except for pages in cache but there is more and more “PRAGMA NO-CACHE” tags :-([[BR]] On the other hand, proxy will bring a lot of added value in term of security and control.
 
-Let's assume proxy is deployed on Zentyal server with one connection inside (Intranet) and one connection outside (Internet) as described in the “Perfect Zentyal Gateway setup” document.
-
+Let's assume proxy is deployed on Zentyal server with one connection inside (Intranet) and one connection outside (Internet) as described in the “Perfect Zentyal Gateway setup” document. [http://trac.zentyal.org/wiki/Documentation/Community/HowTo/GatewaySetup
+]
 === Transparent proxy mode: ===
 
@@ -36 +36 @@
    * Transparent proxy '''MUST''' be deployed at subnet default gateway otherwise clients will never reach it.
    * As this is transparent, no authentication and therefore profiling based on name or group membership can apply. This also means no access control.
+   * Doesn't work (easily) if Zentyal has only one NIC.
 
-=== Non transparent proxy mode: ===
+=== Explicit (non transparent) proxy mode: ===
 
-In this mode, browser “knows” there is a proxy to be used. Different mechanisms can be involved to provide this information that will be explained later.
+In this mode, browser “knows” there is a proxy to be used. Different mechanisms can be implemented to automatize client setup.
 
 ==== Pros: ====
-   * Proxy can be deployed anywhere on Intranet, no need to match default gateway IP.
-   * Authentication and therefore access control and profiling ''can'' be enable.
-   * HTTPS is handled by proxy. No need for extra firewall rules. Content filtering doesn't work because of encrypted session between client and server (TLS). Domain filtering works. No need for extra firewall filtering rules.
+   * Proxy can be deployed anywhere on Intranet, no need to match default gateway IP. (thus is works with "single NIC Zentyal")
+   * Authentication and therefore access control and profiling ''can'' be enabled.
+   * HTTPS is handled by proxy. No need for extra firewall rules. Content filtering doesn't work because of encrypted session between client and server (TLS) but domain filtering works.
+   * No need for extra firewall filtering rules.
+   * WPAD can bring additional control on how proxy is used.
 ==== Cons: ====
    * Browser configuration: if browser is not configured to use proxy, it doesn't work.
    * Users are aware that proxy is used (and therefore control and logs can be enabled)
- 
-On large environments, maintaining configuration on each and every machine (client) can be painful and time-consuming. This is the reason why:
+   * HTTPS to "non standard" HTTPS ports (i.e. 443) requires customized configuration.
+
+On large environments, maintaining configuration client side can be painful and time-consuming. Many services aim at easing this:
    * DNS exist to avoid local /etc/hosts file management
    * DHCP exists to avoid configuring IP address on each device. (IP address is a shortcut. DHCP can manage much more network related stuff)
@@ -105 +109 @@
 If you have set up such name in your DNS pointing to web server described above, you're done :-)  [[BR]]
 
-Another option, starting with Zentyal 2.2, is to maintain SRV and TXT records. Notice I didn't try it yet. I will do soon.
+Another option, starting with Zentyal 2.2, is to maintain SRV and TXT records.
 {{{
 wpad            IN      A       192.168.0.10  (your wpad address here... if CNAME is not used)