#Transparent proxy vs reverse proxy Patch

The maximum supported timeout to communicate with endpoints required for identity is 60s with 3 retry attempts.

SSL traffic interception isвЂЇnot supportedвЂЇand can lead to service failures when accessing endpoints. Using this feature, these proxy devices can be configured such that only infrastructure traffic is sent through the transparent proxy, while all tenant traffic is sent through the explicit mode. In scenarios where outbound traffic from Azure Stack Hub is required to flow through an explicit proxy, Sophos and Checkpoint devices provide a dual-mode feature that allows specific ranges of traffic through transparent mode, while other ranges can be configured to pass through an explicit mode.

Integrate Cisco Secure Web Appliance (WSA) with Azure Stack Hub.

Integrate Citrix ADC, Citrix Secure Web Gateway with Azure Stack Hub.

Configure a Sophos XG firewall transparent proxy.

Configure a Check Point Security Gateway transparent proxy.

Review the following documents for validated transparent proxy configurations with Azure Stack Hub:

Route all outbound traffic from the first /27 range of the Azure Stack Hub virtual IP pool to the proxy devices via policy-based routing.ДЇor a sample border configuration, see Example border configuration section in this article.

Route all outbound traffic from Azure Stack Hub to the proxy devices.

External proxy devices must be placed north of the border devices.ДЄdditionally, the border devices must be configured to route traffic from Azure Stack Hub in one of the following ways: The following diagram is an example Azure Stack Hub network configuration with HA Proxies. Microsoft has partnered with leading proxy vendors in the industry to validate Azure Stack HubвЂ™s use case scenarios with a transparent proxy configuration. When configuring a transparent proxy, you can choose to send all outbound traffic or only infrastructure traffic through the proxy. This reason is why Azure Stack Hub does not support a native proxy configuration. Azure does not accept traffic modified by a proxy or TLS/SSL intercepted traffic. The traffic from these services is routed to Azure endpoints.

#Transparent proxy vs reverse proxy Patch

Infrastructure traffic is generated from the first /27 range of the public virtual IP pool assigned to infrastructure services such as identity, patch and update, usage metrics, Marketplace syndication, registration, log collection, Windows Defender, etc. Tenant traffic is generated by tenants by way of virtual machines, load balancers, VPN gateways, app services, etc. Outbound traffic from Azure Stack Hub is categorized as either tenant traffic or infrastructure traffic. If your datacenter requires all traffic to use a proxy, you configure aвЂЇtransparent proxyвЂЇto process all traffic according to policy by separating traffic between the zones on your network. Clients don't need to be aware of the existence of the proxy. A transparent proxy (also known as an intercepting, inline, or forced proxy) intercepts normal communication at the network layer without requiring special client configuration.