So proxy servers are not as prevalent as they once were.
They were pretty ubiquitous on enterprise networks probably in the 1990s,
early 2000s or so.
Not as common today,
but they are still available and still around and still in use today,
so you may encounter a scenario in which you need to define a proxy
server's configuration for your Always On VPN endpoints.
There's a couple of different ways to do this.
The first is to explicitly define the proxy server,
meaning tell the client to use this proxy server
for all of its internet requests.
And again,
that proxy server hostname is just defined directly in the configuration.
It's rather indiscriminate.
If it's a web request, it's going to go to the proxy and that's it.
You can also use proxy auto‑configuration with the proxy server settings
stored in a proxy auto‑configuration, or PAC, file.
So this PAC file is stored on a web server on your internal network or
somewhere that's reachable by the endpoint, and then it essentially reads
this file, and this file, the auto‑configuration file, contains some
intelligence to route traffic according to,
you know, divine policies and things like that.
So there's a little more intelligence there and a little more functionality
and a little more granular control for using the PAC file.
It's important to understand, however,
that the proxy settings that we're talking about for configuration for
Always On VPN are only supported when you're using force tunneling. If
you are using split tunneling, the proxy configuration settings here
do not apply. In that scenario, you would define a system proxy, and
you would do that using Group Policy or Intune or Endpoint Manager
policies.
So let's move onto the next demonstration where
I'll configure VPN proxy settings.
So once again, we're back in the Endpoint Manager admin center. We'll
click on our Always On VPN User Tunnel, and this time we'll scroll down
to our Configuration settings and choose Edit. In here, we're going to
select the Proxy section, or expand the Proxy section. And here is our
options to use a proxy server.
We can define an automatic configuration script, and this
is typically done using a URL and a full URL to the
specific path of the PAC file itself.
So for example, in my lab, it is https://proxy.lab.richardhicks.net/proxy.pac.
And if I was using the auto‑configuration script, that's all I would do.
So, if I wanted to use the explicit proxy configuration,
I would simply remove this setting, and I would define my proxy server
here. And in this case, it's just asking for the hostname. And in this
case, I would also supply my port number, and I also have the option to
bypass the proxy for local addresses. Now, it would appear in this
management console that both an auto‑configuration and an explicit proxy
configuration would be supported.
So if I were to put my URL here to my auto‑configuration file,
it would accept all of these.
My suggestion is to use one or the other. I'm not exactly sure what the
behavior is going to be like if you specify both an explicit and an
auto‑configuration file. That may yield some unintended consequences, so my
advice to you is choose one or the other,
but avoid setting both of those. To configure proxy servers in XML, add the
code on your screen here to your XML configuration file.
This is the code you'll use for the explicit proxy, and then this is the
code that you will use for the auto‑configuration.
You'll see that it is slightly different.
If we were to take a look at this in our actual XML file,
we'll open this with Notepad here, and you'll see that our
proxy server is defined in this block here.
Now,
one thing you'll notice is that I've included both the manual
configuration and the auto‑configuration URL. As I said before,
I don't recommend that. I've just done this for
demonstration purposes so that you can see what this looks
like in the actual XML file itself.
So please remember to choose one or the other,
but not both because I think setting both of these at the same time may yield some unexpected results