Configuration Overview

The Secure Proxy architecture requires that only the minimum amount of configuration information be stored in the DMZ. It includes two components: the Configuration Manager (CM) and an engine. Configuration data is stored at CM, is encrypted, and does not require a database. CM is installed on the internal or trusted network.

The engine resides in the DMZ and receives configuration data from CM. The engine stores engine properties on disk in the DMZ, and the files are encrypted. The engine properties contain the minimum information required to accept and secure a connection from CM. It includes the IP address and port that the Secure Proxy engine listens on for the CM connection. It also includes the SSL key certificate, trusted certificate, and encryption cipher that will be used to secure the connection with CM.

When the engine is first started, it does not have configuration information. It listens on the configured IP address and port for a connection from CM, which tries to connect to the engine at a configurable interval. When CM connects to the engine, they negotiate an SSL session and secure the connection.

After the channel is secure, CM pushes the configuration to the engine. The engine reads the configuration and starts the appropriate proxy services. When you update a configuration in CM, CM transfers the updates to the engine.

Following is an illustration of the Secure Proxy flow of a configuration push: