Behavior Change

The BIG-IP APM SSLVPN Client has the ability to download and merge remote proxy PAC files to facilitate browsing via proxy while preserving the security posture defined in the Network Access settings. Previously, problems in this process were always considered critical errors. These critical errors would cause BIG-IP Edge Client to disconnect the tunnel because the security settings could not be correctly applied. However, in some deployments it is expected that the PAC files and their security settings are configured but unavailable (404, DNS or routing trouble, etc). In this situation the desired behavior is for the client to ignore the problem and continue as if the proxy PAC was not configured at all. In v12.1.0 or later, this behavior is controlled by a new setting called 'Ignore Client Proxy Autoconfig Script Download Failure' on the BIG-IP system. For other fixed versions (12.0.0 HF1, 11.6.1 HF1, 11.5.4 HF2), the fix is implemented using the Visual Policy Editor (VPE) to add a Variable Assign policy item in the access policy. To do so, perform the following procedure: 1. Log in to the Configuration utility. 2. Navigate to Access Policy :: Access Profiles :: Access Profiles List. 3. For the access policy you want to configure, click Edit. 4. In the VPE, at the point in the access policy where you want to insert the Variable Assign agent, click the Add icon (+). 5. Click the Assignment tab. 6. Click Variable Assign and click Add Item. 7. Click Add new entry. 8. Click change next to empty. 9. In the left list, click Configuration Variable. 10. For Type, click Network Access. 11. For Name, click the appropriate network resource. 12. For Property, click client_proxy_settings. 13. In the right list, click Custom Expression. 14. In the Custom Expression box, enter the following syntax: {<client_proxy_settings><client_proxy_ignore_auto_config_error>0</client_proxy_ignore_auto_config_error><client_proxy_script>http://example.com/proxy.pac</client_proxy_script><client_proxy>yes</client_proxy></client_proxy_settings>} Note: Replace http://example.com/proxy.pac with the actual URL of your server where the PAC file is located. 15. Click Finished. 16. Click Save. 17. Click Apply Access Policy. 18. Click Close.