Configure proxies

Register a proxy in Server & Workload Protection

1. In the Server & Workload Protection console, go to Administration → System Settings → Proxies.
2. In the Proxy Servers area, click New → New Proxy Server.
3. In the Name and Description fields, enter a friendly name and description for your proxy.
4. For the Proxy Protocol, select either HTTP, SOCKS4, SOCKS5, or Proxy Auto-Configuration (PAC). Not all protocols are supported by all components. See Supported proxy protocols for details.
   The proxy in the PAC file only supports HTTP and direct connection PACs.
5. In the Address and Port fields, enter the IP address or URL of the proxy as well its port (by default 8080 or 80 for HTTP; 3128 for the Squid HTTP proxy; 443 for HTTPS; and 1080 for SOCKS 4 and 5).
6. Enable Proxy requires authentication credentials if you previously set up your HTTP or SOCKS 5 proxy to require authentication from connecting components. Enter those credentials in the User Name and Password fields.

Supported proxy protocols

Connect to the primary component update source via proxy

Note The primary component update source for the new improved relay is the Server & Workload Protection relay. Deep Security Agent 20.0.0-3964 and later can connect to Server & Workload Protection relays via this proxy setting.

1. Ensure that you are using agent version 10.0 or later. Only 10.0 and later supports connections through a proxy.
2. Register a proxy in Server & Workload Protection.
3. In the Server & Workload Protection console, select the Administration → System Settings → Proxies tab.
4. In the Proxy Server Use area, change the Primary Component Update Proxy used by Agents, Appliances, and Relays setting to point to the new proxy.
5. Click Save.
6. Restart the agents.

Connect to Server & Workload Protection via proxy

Connect an agent to Server & Workload Protection via a proxy using a deployment script

1. Ensure that you are using the agent version 10.0 or later, as they support connections through a proxy.
2. Register a proxy in Server & Workload Protection.
3. In the top right-hand corner of the Server & Workload Protection console, click Administration → Updates → Software → Local → Generate Deployment Scripts.
4. From Proxy to contact Server & Workload Protection, select a proxy.
5. Copy the script or save it.
6. Run the script on the computer.

Connect an agent to Server & Workload Protection via a proxy using dsa_control

cd C:\Program Files\Trend Micro\Deep Security Agent\
dsa_control -u myUserName:MTPassw0rd
dsa_control -x dsm_proxy://squid.example.com:443

/opt/ds_agent/dsa_control -u myUserName:MTPassw0rd
/opt/ds_agent/dsa_control -x dsm_proxy://squid.example.com:443

Connect to relays via proxy

Connect an agent to relays via a proxy using a deployment script

1. Ensure that you are using the agent version 10.0 or later, as they support connections through a proxy.
2. Register a proxy in Server & Workload Protection.
3. In the top right-hand corner of the Server & Workload Protection console, click Administration → Updates → Software → Local → Generate Deployment Scripts.
4. From Proxy to contact Relay(s), select a proxy.
5. Copy the script or save it.
6. Run the script on the computer.

Connect an agent to relays via a proxy using dsa_control

cd C:\Program Files\Trend Micro\Deep Security Agent\
dsa_control -w myUserName:MTPassw0rd
dsa_control -y relay_proxy://squid.example.com:443

/opt/ds_agent/dsa_control -w myUserName:MTPassw0rd
/opt/ds_agent/dsa_control -y relay_proxy://squid.example.com:443

Connect to Server & Workload Protectionor Relay via Proxy Auto_Configuration (PAC) proxy

1. Ensure that you are using agent version 20.0.0-6680 or later, as only these versions support connections through a PAC-resolved proxy.
2. Register the proxy in Server & Workload Protection.
3. In the top right-hand corner of the Server & Workload Protection console, click Administration → Updates → Software → Local → Generate Deployment Scripts.
4. From Proxy to contact Server & Workload Protection/Relay, select a proxy.
5. Copy the script or save it.
6. Run the script on the computer.

cd C:\Program Files\Trend Micro\Deep Security Agent\
dsa_control --pacproxyunpw myUserName:MTPassw0rd
dsa_control --pacproxy http://pac.example.com:80/proxy.pac

/opt/ds_agent/dsa_control --pacproxyunpw myUserName:MTPassw0rd
/opt/ds_agent/dsa_control --pacproxy http://pac.example.com:80/proxy.pac

Connect to the Smart Protection Network via proxy

1. Register a proxy in Server & Workload Protection.
2. In the Server & Workload Protection console, click Policies at the top.
3. In the main pane, double-click the policy that you use to protect computers that are behind the proxy.
4. Set up a proxy to the Global Census, Good File Reputation, and Predictive Machine Learning Services as follows:
   1. Click Settings on the left.
   2. In the main pane, select the General tab.
   3. In the main pane, look for the Network Setting for Census and Good File Reputation Service, and Predictive Machine Learning section.
   4. If Inherited is selected, the proxy settings are inherited from the parent policy. To change the settings for this policy or computer, deselect Inherited.
   5. Select When accessing Global Server, use proxy and in the list, select your proxy, or select New to specify another proxy.
   6. Save your settings.
5. Set up a proxy to the Smart Protection Network for use with Anti-Malware:
   1. Click Anti-Malware on the left.
   2. In the main pane, select the Smart Protection tab.
   3. Under Smart Protection Server for File Reputation Service, if Inherited is selected, the proxy settings are inherited from the parent policy. To change the settings for this policy or computer, deselect Inherited.
   4. Select Connect directly to Global Smart Protection Service.
   5. Select When accessing Global Smart Protection Service, use proxy and in the list, select your proxy or select New to specify another proxy.
   6. Specify your proxy settings and click OK.
   7. Save your settings.
6. Set up a proxy to the Smart Protection Network for use with Web Reputation:
   1. Click Web Reputation on the left.
   2. In the main pane, click the Smart Protection tab.
   3. Under Smart Protection Server for Web Reputation Service, set up your proxy the same way you did under Anti-Malware in a previous step.
   4. With Web Reputation still selected, select the Advanced tab.
   5. In the Ports section, select a group of port numbers that includes your proxy's listening port number, and then click Save.
      For example, if you are using a Squid proxy server, you would select the Port List Squid Web Server. If you do not see an appropriate group of port numbers, go to Policies → Common Objects → Lists → Port Lists, and then click New to set up your ports.
   6. Save your settings.
7. Send the new policy to your agents. See Send policy changes manually.

Remove a proxy

To remove a proxy between agent and Server & Workload Protection, or agent and relay

To remove a proxy between any other components