|
| 1 | +<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> |
| 2 | +<HTML> |
| 3 | + <HEAD> |
| 4 | + <TITLE> [squid-users] Squid integration with Netskope forward to proxy |
| 5 | + </TITLE> |
| 6 | + <LINK REL="Index" HREF="index.html" > |
| 7 | + <LINK REL="made" HREF="mailto:squid-users%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-users%5D%20Squid%20integration%20with%20Netskope%20forward%20to%20proxy&In-Reply-To=%3C4e8c3148-4508-426d-b152-715cc27ea55f%40measurement-factory.com%3E"> |
| 8 | + <META NAME="robots" CONTENT="index,nofollow"> |
| 9 | + <style type="text/css"> |
| 10 | + pre { |
| 11 | + white-space: pre-wrap; /* css-2.1, curent FF, Opera, Safari */ |
| 12 | + } |
| 13 | + </style> |
| 14 | + <META http-equiv="Content-Type" content="text/html; charset=us-ascii"> |
| 15 | + <LINK REL="Previous" HREF="027757.html"> |
| 16 | + <LINK REL="Next" HREF="027741.html"> |
| 17 | + </HEAD> |
| 18 | + <BODY BGCOLOR="#ffffff"> |
| 19 | + <H1>[squid-users] Squid integration with Netskope forward to proxy</H1> |
| 20 | + <B>Alex Rousskov</B> |
| 21 | + <A HREF="mailto:squid-users%40lists.squid-cache.org?Subject=Re%3A%20%5Bsquid-users%5D%20Squid%20integration%20with%20Netskope%20forward%20to%20proxy&In-Reply-To=%3C4e8c3148-4508-426d-b152-715cc27ea55f%40measurement-factory.com%3E" |
| 22 | + TITLE="[squid-users] Squid integration with Netskope forward to proxy">rousskov at measurement-factory.com |
| 23 | + </A><BR> |
| 24 | + <I>Wed Jan 14 15:14:25 UTC 2026</I> |
| 25 | + <P><UL> |
| 26 | + <LI>Previous message (by thread): <A HREF="027757.html">[squid-users] Squid integration with Netskope forward to proxy |
| 27 | +</A></li> |
| 28 | + <LI>Next message (by thread): <A HREF="027741.html">[squid-users] Can I safely increase MAX_URL to 12KByte? |
| 29 | +</A></li> |
| 30 | + <LI> <B>Messages sorted by:</B> |
| 31 | + <a href="date.html#27760">[ date ]</a> |
| 32 | + <a href="thread.html#27760">[ thread ]</a> |
| 33 | + <a href="subject.html#27760">[ subject ]</a> |
| 34 | + <a href="author.html#27760">[ author ]</a> |
| 35 | + </LI> |
| 36 | + </UL> |
| 37 | + <HR> |
| 38 | +<!--beginarticle--> |
| 39 | +<PRE>On 2026-01-13 07:45, Ben Goz wrote: |
| 40 | + |
| 41 | +><i> I'm using ssl-bump it's cooperate with https_port? |
| 42 | +</I> |
| 43 | +* https_port in an "intercept" or "tproxy" mode supports SslBump (and |
| 44 | +requires an "ssl-bump" option). |
| 45 | + |
| 46 | +* https_port in other modes, including the default forward proxy mode, |
| 47 | +does not support SslBump (and prohibits an "ssl-bump" option). |
| 48 | + |
| 49 | +Squid will correctly reject unsupported configurations, but the |
| 50 | +corresponding documentation is missing. That is a known Squid bug: |
| 51 | +<A HREF="https://bugs.squid-cache.org/show_bug.cgi?id=5092">https://bugs.squid-cache.org/show_bug.cgi?id=5092</A> |
| 52 | + |
| 53 | +We tried to fix that documentation bug, but failed: |
| 54 | +<A HREF="https://github.com/squid-cache/squid/pull/1981">https://github.com/squid-cache/squid/pull/1981</A> |
| 55 | + |
| 56 | +Alex. |
| 57 | + |
| 58 | + |
| 59 | +><i> ‫בתאריך יום ב׳, 12 בינו׳ 2026 ב-19:12 מאת ‪Amos Jeffries‬‏ |
| 60 | +</I>><i> <‪<A HREF="https://lists.squid-cache.org/listinfo/squid-users">squid3 at treenet.co.nz</A> <mailto:<A HREF="https://lists.squid-cache.org/listinfo/squid-users">squid3 at treenet.co.nz</A>>‬‏>:‬ |
| 61 | +</I>><i> |
| 62 | +</I>><i> On 12/01/2026 21:44, Matus UHLAR - fantomas wrote: |
| 63 | +</I>><i> > On 11.01.26 16:58, Ben Goz wrote: |
| 64 | +</I>><i> >> My customer netskope cloud configures forward to proxy to my |
| 65 | +</I>><i> squid proxy. |
| 66 | +</I>><i> >> The forwarding works only if Netskope's ssl decryption disabled, |
| 67 | +</I>><i> If ssl |
| 68 | +</I>><i> >> decryption enabled |
| 69 | +</I>><i> >> I can't see in the access log the traffic forwards to squid from |
| 70 | +</I>><i> >> Netskope. |
| 71 | +</I>><i> >> |
| 72 | +</I>><i> >> I suspect that Netskope forwards encrypted data to squid but I'm |
| 73 | +</I>><i> not sure |
| 74 | +</I>><i> >> that is the case because the Connect request is never encrypted |
| 75 | +</I>><i> and I |
| 76 | +</I>><i> >> don't |
| 77 | +</I>><i> >> see it on the access log. |
| 78 | +</I>><i> > |
| 79 | +</I>><i> > |
| 80 | +</I>><i> >> Anyones know how Netskope and squid can work together without |
| 81 | +</I>><i> disabling |
| 82 | +</I>><i> >> Netskope decryption (MITM)? |
| 83 | +</I>><i> > |
| 84 | +</I>><i> > This is completely issue of netskope proxy. |
| 85 | +</I>><i> > |
| 86 | +</I>><i> > If netskope proxy decides to forward or not to forward request to |
| 87 | +</I>><i> squid, |
| 88 | +</I>><i> > squid can't do anything with it. |
| 89 | +</I>><i> |
| 90 | +</I>><i> |
| 91 | +</I>><i> Nod. If there is no CONNECT tunnel request reaching Squid then it is |
| 92 | +</I>><i> not |
| 93 | +</I>><i> being forwarded in the classical "over-HTTP" way. |
| 94 | +</I>><i> |
| 95 | +</I>><i> I would check to see what is happening on port 443 when the traffic is |
| 96 | +</I>><i> "forwarded". HTTPS may actually be routed rather than relayed/proxied. |
| 97 | +</I>><i> Or perhapse it is being sent to some other port number, though how to |
| 98 | +</I>><i> find that may require asking your customer or Netskope directly for |
| 99 | +</I>><i> more |
| 100 | +</I>><i> details on how it is setup there. |
| 101 | +</I>><i> |
| 102 | +</I>><i> |
| 103 | +</I>><i> FWIW, Squid can receive HTTPS/443 traffic fine. Just use "https_port" |
| 104 | +</I>><i> (note the 's') to receive it instead of the regular HTTP port, and will |
| 105 | +</I>><i> need a SSL server certificate (can be self-signed) for your Squid which |
| 106 | +</I>><i> the customer software trusts. |
| 107 | +</I>><i> |
| 108 | +</I>><i> |
| 109 | +</I>><i> HTH |
| 110 | +</I>><i> Amos |
| 111 | +</I>><i> |
| 112 | +</I>><i> _______________________________________________ |
| 113 | +</I>><i> squid-users mailing list |
| 114 | +</I>><i> <A HREF="https://lists.squid-cache.org/listinfo/squid-users">squid-users at lists.squid-cache.org</A> |
| 115 | +</I>><i> <mailto:<A HREF="https://lists.squid-cache.org/listinfo/squid-users">squid-users at lists.squid-cache.org</A>> |
| 116 | +</I>><i> <A HREF="https://lists.squid-cache.org/listinfo/squid-users">https://lists.squid-cache.org/listinfo/squid-users</A> |
| 117 | +</I>><i> <<A HREF="https://lists.squid-cache.org/listinfo/squid-users">https://lists.squid-cache.org/listinfo/squid-users</A>> |
| 118 | +</I>><i> |
| 119 | +</I>><i> |
| 120 | +</I>><i> _______________________________________________ |
| 121 | +</I>><i> squid-users mailing list |
| 122 | +</I>><i> <A HREF="https://lists.squid-cache.org/listinfo/squid-users">squid-users at lists.squid-cache.org</A> |
| 123 | +</I>><i> <A HREF="https://lists.squid-cache.org/listinfo/squid-users">https://lists.squid-cache.org/listinfo/squid-users</A> |
| 124 | +</I> |
| 125 | +</PRE> |
| 126 | + |
| 127 | +<!--endarticle--> |
| 128 | + <HR> |
| 129 | + <P><UL> |
| 130 | + <!--threads--> |
| 131 | + <LI>Previous message (by thread): <A HREF="027757.html">[squid-users] Squid integration with Netskope forward to proxy |
| 132 | +</A></li> |
| 133 | + <LI>Next message (by thread): <A HREF="027741.html">[squid-users] Can I safely increase MAX_URL to 12KByte? |
| 134 | +</A></li> |
| 135 | + <LI> <B>Messages sorted by:</B> |
| 136 | + <a href="date.html#27760">[ date ]</a> |
| 137 | + <a href="thread.html#27760">[ thread ]</a> |
| 138 | + <a href="subject.html#27760">[ subject ]</a> |
| 139 | + <a href="author.html#27760">[ author ]</a> |
| 140 | + </LI> |
| 141 | + </UL> |
| 142 | + |
| 143 | +<hr> |
| 144 | +<a href="https://lists.squid-cache.org/listinfo/squid-users">More information about the squid-users |
| 145 | +mailing list</a><br> |
| 146 | +</body></html> |
0 commit comments