Configure Application Reverse Proxy

Configure SaaS Application Reverse Proxy

You configure SaaS application reverse proxy on Versa Concerto, which supports the following reverse proxy flows:

• SaaS application-initiated flow—You configure the SaaS application with VCG as the IdP. When a user accesses a SaaS application, the SaaS provider (for example, box.com) redirects the endpoint to the Versa IdP broker, which applies policies before redirecting the endpoint to its actual IdP (such as Azure AD or Okta). After authentication, the IdP shares an assertion with the Versa IdP broker. Then, it validates the SAML response and redirects the endpoint to the application reverse proxy.  The VOS software ensures that the Versa reverse proxy comes in the path to SaaS application and enforces zero-trust network access (ZTNA), secure web gateway (SWG), cloud access security broker (CASB), data loss prevention (DLP), and other security features.
• IdP-initiated flow—You configure the SaaS application to authenticate the user directly with the third-party IdP. When the user tries to access a SaaS or private application, as the user is already authenticated by the IdP, it presents the SAML assertion to the Versa IdP broker (that is, the assertion consumer service (ACS) URL points to the Versa IdP broker. The ACS URL is an endpoint on a service provider that receives a SAML response from the IdP). The IdP then redirects the user to the Versa reverse proxy, which comes in the path of the SaaS application and enforces ZTNA, SWG, CASB, DLP, and other security features.
• IdP-redirected flow—When a user accesses a SaaS application directly, the user is prompted for IdP (Azure or Okta) authentication. After successful authentication, it redirects the user to Versa IDP broker. After SAML response validation, user is redirected to the application reverse proxy for enforcement of real-time protection policies for that application.​

This section describes how to set up application reverse proxy to integrate with an IdP and a sanctioned SaaS application provider.

To configure application reverse proxy for SaaS applications:

1. Go to Configure > Security Service Edge > Secure Access > Clientless Access > Application Reverse Proxy.
   
   
   
   The Application Reverse Proxy screen displays with the SaaS Applications tab selected by default.  
   
   
2. Click the  Add icon to add a SaaS application. The Add SaaS Application Reverse Proxy screen displays.
3. In Step 1, Settings, enter information for the following fields.
   
   
    

   Field	Description
   Application	Select an application from the drop-down list for which you want to grant access (here, Salesforce). The predefined applications are: Box Dropbox Google Office Salesforce
   Identity Provider (IdP) URL	Enter the location to submit the SAML authentication request. This is the location of the IdP service that authenticates and authorizes user access to protected resources.
   ACS URL	Enter the location to submit SAML assertion. This is the location where the service provider's security software receives and processes SAML response messages containing user authentication information from the IdP.
   Identity Provider (IdP) Certificate	Select the IdP certificate for authentication. The IdP uses this digital certificate to sign SAML messages in Single Sign-On (SSO). You can download it from the IdP SSO service endpoint, or the IdP can share it through email or other means. For more information, see Step 5 in Configure Okta for User Web Portal Authentication below.
   Add New	Click to add a new IdP certificate. Note that the certificate must be in .crt, .cer, or .pem format.   Enter the CA chain name. Click Upload File to upload the certificate from your local device. Click Add.

4. Click Next, and then enter the name of the application. You can also enter a description and tags. 
   
   
5. Click Save.

Configure Private Application Reverse Proxy

Private application reverse proxy provides secure and controlled access to internal applications or services from external networks. By configuring a private application reverse proxy, you enable users or systems outside the private network to access certain applications securely, without directly exposing them to the internet.

To configure a private application reverse proxy: 

1. Go to Configure > Security Service Edge > Secure Access > Clientless Access > Application Reverse Proxy. The Application Reverse Proxy screen displays. 
   
   
2. Select the Private Applications tab.
3. Click the  Add icon to add an application. The Add Private Application Reverse Proxy screen displays.
4. In Step 1, Settings, enter the following information.
   
   
    

   Field	Description
   Application URL	Enter the URL to access the private application. For example, www.marketing.companyname.com.
   Application Display Name	Enter the name of the application to display on the applications portal. If not specified, the name from the review page is used.
   Application Logo URL	Enter the URL from where to display the logo on the applications portal. The URL must include the complete path to the image file hosted on your enterprise network and must be accessible from SSE gateways without requiring authentication. If not configured, the application displays the default logo.
   URL Pattern	Enter the FQDN or pattern to match for the proxy. For example, marketing.company.com; intranet.company.com.
   Use HTTP	Click and enable the toggle button if the application is hosted over HTTP.
   Rewrite URL	Click and enable the toggle button to allow modifying the URL or the headers of a request before passing it to the backend server. It is recommended that you keep this enabled.
   Private Application Certificate	Select or upload a certificate for the private application. If Rewrite URL is disabled, the certificate's SAN must contain the FQDN of the proxied application. If it is enabled, the SAN must contain the FQDN of the SSE service provider domain.
   Add New	Click to add a new IdP certificate. The file you upload must be in .zip format and must contain a key file and a certificate file. The key file must have the .key extension. There is no restriction on the certificate file extension.   Enter a name for the certificate. Select a CA-Chain name. (Optional) Enter the pass phrase for the certificate. Click Upload File to upload the file from your local device. Click Add.
   Identity Provider (IdP) URL	Enter the location to submit the SAML authentication request. This is the location of the IdP service that authenticates and authorizes user access to protected resources.
   ACS URL	Enter the location to submit SAML assertion. This is the location where the service provider's security software receives and processes SAML response messages containing user authentication information from the IdP.
   Identity Provider (IdP) Certificate	Select the digital certificate for authentication that the IdP uses to sign SAML messages in single sign-on (SSO). You can download it from the IdP SSO service endpoint, or the IdP can share it through email or other means. For more information, see Step 5 in Configure Okta for User Web Portal Authentication below.

5. Click Next, then enter the name of the application. You can also enter a description and tags. 
   
   
6. Click Save.

Configure Clientless Application Policy Rules

Before you configure policy rules for application reverse proxy, you must configure an authentication profile and at least one application reverse proxy as described in Configure SaaS Application Reverse Proxy and Configure Private Application Reverse Proxy, above.

You must also configure a SAML authentication profile before you configure an application reverse proxy policy rule.

To configure a clientless application policy rule:

1. Go to Configure > Security Service Edge > Secure Access > Clientless Application Access > Policy Rules.
   
    
   
   If you have not configured a reverse proxy, the following screen displays. Note that if you have not configured an authentication profile, Create Authentication Profile is enabled. To add a policy rule, click Let's Go. 
   
   
   
   The following screen displays if you have configured an authentication profile, at least one application reverse proxy, and an access rule. This screen displays the web portal URL that a clientless user uses to access SaaS and private applications.
   
   
2. Click + Add. The Create Clientless Application Access Rule screen displays with User and Groups selected by default. By default, all users and user groups are included in the match, which means that no filtering is done on the basis of users and user groups.
   
   
3. To accept the default, click Next to continue to Source Geo Location and Source IP Address match criteria. Go to Step 9 for more information. 
4. To change the users and user groups to include in the match list, click Customize. The following screen displays with Known Users selected by default.  
   
   
5. To accept the default, click Next to continue to Source Geo Location and Source IP Address match criteria.
6. To select users and user groups, select Selected Users. The following screen displays.
   
   
7. Select a user and device authentication profile, and then select a group or groups from the groups associated with the profile. Note that if you select an LDAP-based user and device authentication profile, you have an option to add user groups or users. For other type of profiles, you can select the user groups or users already associated with the profile, as shown in the screenshot above for a SAML-based profile. For more information, see Configure User and Device Authentication.
   1.  If you select an LDAP-based user and device authentication profile, the User Groups tab displays the + Add New User Group option: 
      
      
   2. To add a user group, click + Add New User Group.
   3. In the Add User Group window, enter a user group name and a distinguished name (DN).
      
      
   4. Click Add.
8. To add users, select the Users tab in the Users and Groups screen. Similar to the Groups tab, if you select an LDAP-based user and device authentication profile, you have an option to add users. For other type of profiles, you can select the users already associated with the profile, as shown in the following screenshot for a RADIUS-based profile. For more information, see Configure User and Device Authentication.
   
   
   1. If you select an LDAP-based user and device authentication profile, the Users tab displays + Add New User:
      
      
   2. To add a user, click + Add New User.
   3. In the Add User window, enter the user name and an official email address for the user. 
      
      
   4. Click Add.
9. Click Next to continue to Source Geo Location and Source IP Address match criteria. The following screen displays. By default, all source and destination geographic locations are included in the match list, which means that no filtering is done based on geographic location and so traffic flows to all destinations.
   
   
10. To accept the default, click Next to continue to Application Reverse Proxy. Go to Step 10 for more information.
11. To change the source geographic locations to include in the match list, click Customize under Source Geolocation. The following screen displays.
    
    
12. In the Select Country field, select one or more countries. The map changes to highlight the countries you select. You can allow or deny access to Versa SASE client for the locations you select. 
13. To change the source IP addresses to include in the match list, click Customize under Source IP Address. The following screen displays. Enter information for the following fields.
    
    
     

    Field	Description
    Address Group	Select an IP address group or click + Add New to add an address group. The Create Address Group window displays. Enter the required values and click Next. Enter a name for the address group and click Save.
    IP Subnet	Enter a list of IPv4 or IPv6 subnets.
    IP Range	Enter a list of IP address ranges.
    IP Wildcard	Enter a list of IP address wildcard values.
    Source Address Negate	Select to apply the rule to any source addresses except the configured addresses.

14. Click Back to return to the previous screen.
15. Click Next to continue to Application Reverse Proxy. The following screen displays.
    
    
16. Click Customize to select SaaS or private application reverse proxies to associate with the rule. The following screen displays.
    
    
17. Select the application reverse proxies.
18. To add a SaaS or private application reverse proxy, click + Add SaaS Application or + Private Applications. For more information, see Configure SaaS Application Reverse Proxy and Configure Private Application Reverse Proxy above.
19. Click Next to go to the Review and Configure screen.
    
    
20. In the General section, enter a name for the rule. You can also enter a description and tags for the rule.
21. By default, the rule is enabled. To disable the rule, slide the Rule is Enabled toggle button.
22. Click the Edit icon next to any section to make changes.
23. Click Save.

Configure IdP and Service Provider for SaaS Applications 

The following sections describe how to configure IdP authentication and SaaS service provider settings for SaaS application reverse proxy. 

Example: Clientless User Login to Web Portal

This section shows an example of how a user can navigate to the Web portal to access available SaaS and private applications.

1. User uses the URL, for example: https://tenant.myapps.demo.versanow.net/userportal/applications.html. Here, the tenant can be your company name, and versanow.net is the Versa root domain.
2. The user is redirected to the IdP portal for login as shown in the following screenshot.
   
   
   
   After the user logs in, the application portal displays the SaaS and private applications that the user has privileges to access. The following example shows that the user has access to Salesforce (SaaS service provider), the company's private application, RDP, and SSH applications (this is a sample screenshot and the portal display depends on your company's portal settings):
   
   
3. If the user clicks on Go to Salesforce, the Salesforce homepage displays.
   
   
4.  Similarly, the user can access RDH and SSH applications by clicking on the relevant link.
5. If the user tries to perform an action on a private application for which there is no permission, the action is blocked and a message displays. For example, the following image displays when a user tries to upload files without having the required privileges. 
   
    

View Application Reverse Proxy Logs

You can view data loss prevention (DLP) logs for blocking of user actions based on application reverse proxy rules.

To view the DLP logs, go to Analytics > Dashboard > DLP:

You can also view files that were blocked from upload or download.

To view files that were blocked from upload or download, go to Analytics > Dashboard > Logs > Threat Detection > Anti Virus:

Supported Software Information 

Releases 12.2.1 and later support all content described in this article.

Additional Information

Configure API-Based Data Protection Policy for SaaS
Configure User and Device Authentication
Generate CA and EE Certificates Using OpenSSL
Configure CA Certificates, Key File, and CA Chains