What happens to Proxy Setting in place after upgrade?

[ninov_n]

Hello,

I have seen an issue where while using a third party Gateway(Blue Coat) with ePO 5.1.3 there is no issue but after migration to 5.9.1, Software Manager cannot reach McAfee sites anymore. From tcpdumps it seems like ePO does not send same credentials anymore. Performed multiple tests agains account and certificate as per:

https://kc.mcafee.com/corporate/index?page=content&id=KB74029

AddTrustExternalCARoot certificate was imported on both ePO and gateway but it still seems like gateway receives wrong authentication account name even after changing it.

Do you have any ideas about it?

Best regards,

Nino

[cdinet]

Have you validated the proxy settings in the epo server settings, proxy settings section? 

[ninov_n]

The credentials are set properly since same account is set on another ePO 5.1.3 with another gateway. The thing is that after the upgrade to 5.9.1, ePO server sends to the gateway "epohostname$" instead "domain\account" and gateway cuts its internet access, causing failure for Software Catalog update task.

I have tested this in a MWG and it seems that behavior is similar with the authentication by sending "hostname$" instead actual account set for proxy authentication.

I will try to reproduce it with both 5.9.1 and 5.10 upgrade but so far I did not find any additional information about upgrading ePO with proxy settings in place.

[cdinet · Accepted solution]

This is a known issue with bluecoat.  The impersonation has no effect in sending the correct proxy user name during the NTLM handshake because WinInet does not support impersonation (refer: https://docs.microsoft.com/en-us/windows/desktop/wininet/wininet-vs-winhttp).  They are working on changing epo to use winhttp, but we don't know yet what version that will be in.  We have re-added some focus on it, so hopefully we can get that moving, but this is a major change to the way it is currently behaving.  Bottom line, no eta for when that will work as desired.  Can they bypass proxy for epo as a workaround until that is done?

[cdinet]

As to why it previously worked, the code was changed to impersonate the proxy user before connecting to the proxy server where it did not before.

[ninov_n]

Last thing I am curious, is that affecting all currently supported ePO environments - 5.3.x, 5.9.x and 5.10?

[cdinet]

I am sure it is affecting 5.9 and 5.10, but not so sure about 5.3, you would have to test that.  Since it is going end of life next month, I know they won't be fixing anything in that version.