Configuring the Cato Browser Extension

Oftentimes, organizations have to work with unmanaged devices that are used by 3rd party vendors and contractors. These devices can present a challenge as a potential attack vector to your network because they do not necessarily follow the same rules and guidelines that are mapped out by your organization. The Cato Browser Extension lets you provide secure access to SaaS applications for unmanaged devices without giving them direct access to any of your resources.

Users install the extension in their browser, and when they enable it, traffic is routed to the forward proxy located on the PoP, processed by the security engines, and from there, to the relevant SaaS application.

Cato also lets you force your users to connect to the extension whenever they wish to use their unmanaged devices. They can create a rule in the conditional access policies for their IdP or Saas providers that traffic is only accepted if it originates in the Cato Cloud.

High-Level Overview of Configuring the Browser Extension

This section is a high-level overview of the process to configure the Browser Extension for your account. The first two steps are configured by the CMA admin, and the third step is completed by your users with unmanaged devices.

1. (Optional) If you want to use SSO to authenticate, enable SSO for the Cato Browser Extension.

2. Define the rules for the Browser Extension in the Client Connectivity Policy to determine which users are allowed to connect via the extension.

3. Enable the Browser Extension.

4. Install the Browser Extension on the unmanaged devices.

Enable SSO for the Cato Browser Extension

If you want to use SSO to manage authentication for the browser extension, you must first enable the option in the CMA.

To enable SSO for the Cato Browser Extension:

1. Navigate to Access > Single Sign-On.

2. Under Browser Extension Users, select Allow login with Single Sign-On.

3. Select the cookie type and for how long it's valid.

4. Click Save.

5. Ensure that the following URI is listed in your SSO vendor for traffic redirecting:

   https://sso.proxy.catonetworks.com/auth_results

   For more information, refer to the SSO documentation for your vendor.

Create a Rule in the Client Connectivity Policy

To ensure that only authorized users connect via the Browser Extension, create a rule in the Client Connectivity Policy.

Creating a rule

1. Navigate to Access > Client Connectivity Policy.

2. Click New and follow these instructions.

   • Under Users/Groups, select only those users you want to enable to use the Browser Extension.

   • Under Connection Origin, select Browser Extension

   • Under Action, select Allow WAN and Internet

3. Click Apply and then Save.

4. Below this rule, create an additional rule for all other groups who attempt to connect to the Cato Cloud using the Browser Extension and set the Action to Block.

Enable the Browser Extension

You must enable the Browser Extension to let your users connect through it.

Enabling the Browser Extension

1. Navigate to Access > Browser Access Control.

2. Click the Browser Extension slider.

3. Click Save.

Install the Browser Extension

The Browser Extension can be installed on any device running a version of Chrome that supports extensions.

Users can install the Browser Extension through the Google Store, or admins can make it available through a link they receive in the release notes for Client releases.