This article applies to:

• SWG 9.x deployed in transparent mode
• SWG 10.x deployed in transparent mode

Question:

• What is the purpose of virtual redirection hostname ?

Information:

When SWG is deployed transparently, it can't authenticate clients using the "HTTP 407 Proxy Authentication" method that it uses in explicit mode.Rather, it must use the same type of response that a web server would send "HTTP 401 Unauthorized".

In order to facilitate this, SWG redirects the traffic to a "virtual authentication hostname".

The virtual authentication hostname must resolve to an external IP so that SWG will have a chance to intercept the traffic and issue an authentication challenge.

The end-user then closes the session and opens a new session for the virtual host (which does not actually exist). When Vital Security identifies a request for the virtual host, it knows that it must perform user authentication, and it responds to the end-user with HTTP 401 – Authentication Required. 

The end-user then sends the credentials, and the Scanning Server authenticates the end-user against the Active Directory.

It is recommended to change the virtual authentication hostname to vhost (without ".finjan.com") and hosting the DNS entry for vhost on local DNS servers.

For testing/evaluation purposes we have been using public DNS server addresses, i.g. 8.8.8.8 or 8.8.4.4.