Redirection limitation in reverse proxy mode in InterScan Web Security Virtual Appliance (IWSVA) 6.5

In the following scenario, even if the client has established a connection with IWSVA via SSL, the web server returns an HTTP URL such as http://xxxx.xx.xx/ in the Location header. This causes to switch communication protocol from HTTPS to HTTP because the client tries to access http://xxxx.xx.xx.

Changing the configuration could help to keep the SSL connection although there may be an issue on the web server side. 

Trend Micro strongly recommends that you check the Location header of the web server before using reverse proxy mode.

Workaround

1. Log on to IWSVA as root via SSH (for example with an SSH shell such as PuTTy).

2. Create a backup copy of the file https.conf:

   # cp -p /var/iwss/reverse_proxy/conf/service_conf/https.conf /var/iwss/reverse_proxy/conf/service_conf/https.conf.bak

3. Use vi to edit the file https.conf:

   # vi /var/iwss/reverse_proxy/conf/service_conf/https.conf

4. Insert the "proxy_redirect http:// https://;" string under the proxy_set_header line.
   If the web server is running on port 8080, "proxy_redirect http://$host:8080/ https://$host/;" must be inserted instead.

   Before:

   --------------------------------------------------   server {   ...   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;   proxy_set_header real-host $host;   --------------------------------------------------

   After:

   --------------------------------------------------   server {   ...   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;   proxy_set_header real-host $host;   proxy_redirect http:// https://;   --------------------------------------------------

5. Save the file and quit.

6. Restart the reverse proxy service.

   # /etc/iscan/S99ISreverseproxy restart