Introduction

Secure Web Gateway Integration (SWGI) provides enterprise customers with the functionality to allow their users to visit designated sites securely via Silo, rather than through their default browser.

The primary purpose of this guide is to provide Silo administrators with the SWGI configuration steps, along with a general guide on installation and set-up.

Technical Details

When a user attempts to access a SWGI designated site, either vxia a link or by entering a URL, the user is authenticated and the site is rendered in Silo, and not in the default browser.

The URL forwarding process is completed by setting proxy service tokens for the designated sites.

Prerequisites

1. A working Silo enterprise installation.
2. Silo Access Portal must be enabled.
3. A good working knowledge of your proxy service and the setting of tokens.

User Experience

There are three basic SWGI user paths:

1. A first time pass on a device with Silo not installed, requires a user to download and install Silo while stepping through the SWGI process.
2. A first time pass on a device with Silo installed, allows the user to skip the Silo setup process and go directly to launching Silo.
3. For all subsequent SWGI access after the initial pass, the user will see at most a single page regarding the launching of Silo.

Configuration

The basic SWGI configuration steps are:

1. Silo Portal Configuration
2. Determine the designated sites to be rendered in Silo.
3. Request an SWGI token from Authentic8 to be used.
4. Configure your proxy service with the SWGI tokens for the designated sites, based on your customized needs.

Note: It is advised to review your SWG service provider's documentation prior to starting.

Silo Portal Configuration

The Silo Portal configuration step consists of setting the Silo Access Portal URL; this URL must be set with an active link for the SAML configuration to work.

This is a custom URL that your users will go to when accessing the Silo Access Portal.

From the Silo Admin Console, navigate to the Silo Portal configuration page.

Set the Silo Access Portal URL

Press Save

SWGI Token Settings

SWGI functionality is driven by using tokens to validate URL handling requests from the customer and forwarding all designated sites to be rendered in Silo.

The general syntax is: getsilo.com/launch/<Portal ID>/<token>/?url=destination URL

Required Settings

Note: Please contact Support if you have any questions or require further assistance on SWGI tokens.

Customization Settings

The SWGI page flow can be customized by using these customization settings.

Proxy Setting Examples

Here are four standard examples:

Notes

1. The default settings (i.e., when the argument is not present) for require_click is True and for skip_welcome is False.

2. Please contact Support if you have any questions or require further assistance on SWGI setup.

SWGI Process Pages

SWGI functionality has a set of process pages, which primarily deal with ensuring that Silo is installed and that SWGI will correctly work.

SWGI Page Definition

This table lists the SWGI pages, along with a general description and display frequency.

SWGI Page Flow

The following diagram details the SWGI page flow for both Single Sign-on (SSO) and Pin customers.

SWGI Page Definition

Please see SWGI Process Pages for complete display, content and navigation information, for all SWGI pages.

Additional Requirements and Best Practices

This section provides a set of additional requirements and best practices that need to be reviewed, since some tasks are required to make the SWGI process work.

The additional requirements and best practices are divided into three areas:

• HTTP/HTTPS Whitelisting

• User Interface (UI) Limitations

• Forwarded Traffic Limitations

HTTP/HTTPS Whitelisting

This table lists the URLs to be whitelisted, along with the reason for whitelisting and if whitelisting the URL is required or optional for SWGI to perform properly.  The URLs that are listed as required, must be whitelisted or the SWGI process will not successfully run.

Additionally, proxy rules for the HTTP/HTTPS set should be restricted to HTTP/HTTPS protocols. Narrowing the rules to these protocols varies by proxy vendor and it's advised to review the proxy vendor's documentation.

User Interface (UI) Limits

Beyond the underlying limitations, the UI also enforces various limits around URL length. For instance, the browser address bar is capped at 2047 characters. Start> Run is limited to 259 characters (the MAX_PATH limit is 260,which leaves one character for the null-terminator).  Internet Explorer versions up to version 11 do not allow you to bookmark URLs longer than 260 characters. The Windows RichEdit v2 control’s Automatic Hyperlink behavior (EM_AUTOURLDETECT) truncates the link after around 512 characters; this limit is higher in RichEdit5Wcontrols.

Notes

1. Microsoft Internet Explorer has a maximum uniform  resource locator (URL) length of 2,083 characters.Internet Explorer also  has a maximum path length of 2,048 characters. This limit applies to  both POST request and GET request URLs.  If you are using the GET  method, you are limited to a maximum of 2,048 characters, minus the  number of characters in the actual path.  However, the POST method is  not limited by the size of the URL for submitting name/value pairs.  RFC  2616,"Hypertext Transfer Protocol -- HTTP/1.1," does not specify any  requirement for URL length. These pairs are transferred in the header  and not in the URL.

This section is taken from Microsoft's help page: IE'sMaximum URL Length.  For your convenience, the help page has been copied in its entirety.

2. For additional information please see thisMicrosoft sponsored blog: IEURL Length Limits.

Forwarded Traffic Limitations

For the best SWGI performance, forwarded traffic should be limited to HTTP/HTTPS traffic only.

Resources

• SWGI End User Guide
• SWGI Process Pages
• IE'sMaximum URL Length
• IEURL Length Limits

Additional Notes  

Please contact Support if you have any additional questions and/or require further information.