The Forcepoint DLP Inline Proxy, which runs locally on the F1E Endpoint Client machine, is the preferred way to enforce web policies and is intended to replace the use of F1E browser extensions.
As described in the Tech Alert Urgent Action Required for DLP Endpoint Customers - Enable Inline Proxy Functionality Before June 2024 and the Inline Proxy FAQ, Google is planning on dropping support for Manifest V2 browser extensions, which includes the Forcepoint extension, starting on June 2024. Customers are recommended to configure and utilize the Inline Proxy as soon as possible on F1E environments.
In the Inline Proxy mode, DLP Administrators can choose how they want the web traffic to be
captured and sent to the inline proxy.
There are 2 options, and both are enabled by default:
By default, both the Driver and PAC are set and used by the Inline Proxy. However, if there is a third-party proxy that is using either a driver or setting the PAC file, then it is possible to choose to use only the System PAC or only the Forcepoint Driver to monitor traffic. If additional Forcepoint Agents are in use, see Inline Proxy Interoperation with Other Forcepoint Products below.
Note that if the Forcepoint Driver is disabled, applications which are not PAC-aware will not have their traffic
redirected to the Inline Proxy.
Starting with F1E v23.04 and DLP v10.0, administrators can add or remove applications for the F1E driver to monitor in the Endpoint Inline Proxy Mode within the Included Applications list found under the Properties Tab of each Endpoint Profile. Removing an application from the list causes the Inline Proxy driver to stop monitoring web traffic originating from that application. The Included Applications list only applies to the Inline Proxy Driver (not related to monitoring using the System PAC) and contains commonly used browser process names by default. The Included Applications list is currently limited to 50 entries.
The Inline Proxy carries out local SSL decryption on the Endpoint Client to perform required DLP analysis of browser SSL communications which may contain sensitive content. Content is decrypted locally and is re-encrypted before leaving the Endpoint.
For websites which perform End-to-End (E2E) encryption (most commonly file sharing websites), the Inline Proxy cannot always inspect the traffic reliably. In response, Forcepoint has introduced a JavaScript Injection feature to F1E. JavaScript Injection is a method used by Forcepoint F1E to intercept actions that the user takes to upload files within a browser. Though initially required to support DLP over End-to-End encrypted sites, such like messaging applications, this functionality is also needed for certain websites in which file uploads are done using chunking or other methods which are not easily decrypted. This feature allows the F1E agent to obtain the file locally and use it for the DLP analysis.
Prior to F1E v23.11, DLP Administrators needed to manually add every website to include for JavaScript Injection, which required a manual change to the configuration using a custom_config file.
As of F1E v23.11, the default behavior was changed to include all websites in general for JavaScript Injection. Instead, F1E now uses an exclusion list to include URLs that are suspected to be experiencing traffic disruptions when using JavaScript Injection.
Manually Creating a JavaScript Injection Exclusion List (Prior to Forcepoint DLP v10.2 & F1E v24.03 only):
Starting from Forcepoint DLP v10.2, the ability to add URLs to the exclusion list was added to the DLP Manager UI within each Endpoint Profile under the Properties Tab > Excluded Domains for JavaScript Injection.
Additionally, the ability to set up port forwarding for third-party agents was also added in DLP v10.1 & F1E v23.11.
Additional information about the Inline Proxy component can be found in the following articles:
The remainder of this article lists Inline Proxy articles relevant to specific F1E versions: