Routing Traffic Through a Site Web Proxy (EA)

Note: This is an Early Availability (EA) feature that is only available for limited release. For more information, contact your Cato Networks representative or send an email to ea@catonetworks.com.

Extend the Entra SCIM provisioning schema to synchronize the following attributes from Microsoft Entra ID into the Cato SCIM application:

• onPremisesSamAccountName: The legacy Windows logon name. It is used by Windows authentication and legacy applications that require the sAMAccountName attribute

• onPremisesDomainName: The fully qualified domain name (FQDN) of the on-premises Active Directory domain associated with the user account. It is used together with onPremisesSamAccountName to identify the user during Kerberos authentication.

Note:

• This configuration must be applied before user provisioning begins. If this is not possible, for the synchronization to the Cato SCIM application again

• Before editing the schema, it is recommended to save a copy of the JSON document. This allows you to restore the original configuration if an error occurs

• If you are only configuring proxy instances with unauthenticated traffic, this step is not required

To map user identity attributes:

1. In the Entra Admin Center, navigate to Enterprise Applications.

2. Open the Cato Networks SCIM application.

3. Click on Provisioning then Edit Provisioning.

4. Expand the Mapping section and click Provision Azure Active Directory Users, then Show advanced options.

5. Click Review your schema here.
   A JSON schema document opens.

6. To expose the Entra source attributes so they can be used in provisioning mappings, using Ctrl+F, search for "name": "Microsoft Entra ID'.

7. Identify the "attributes" array (directories[] > "Microsoft Entra ID" > objects[] > User > attributes[]), the final attribute object is onPremisesSecurityIdentifier .

8. Add a comma after the final attribute and paste the following entries before the closing ]
   {
     "anchor": false,
     "caseExact": false,
     "defaultValue": null,
     "flowNullValues": false,
     "multivalued": false,
     "mutability": "ReadWrite",
     "name": "onPremisesSamAccountName",
     "required": false,
     "type": "String",
     "apiExpressions": [],
     "metadata": [],
     "referencedObjects": []
   },
   {
     "anchor": false,
     "caseExact": false,
     "defaultValue": null,
     "flowNullValues": false,
     "multivalued": false,
     "mutability": "ReadWrite",
     "name": "onPremisesDomainName",
     "required": false,
     "type": "String",
     "apiExpressions": [],
     "metadata": [],
     "referencedObjects": []
   }

9. To add the corresponding target SCIM extension attributes to the Cato SCIM schema, using Ctrl+F, search for "name: "Cato Networks Provisioning"

10. Identify the "attributes" array (directories[] > "Microsoft Entra ID" > objects[] > User > attributes[]), the final attribute object is dirSyncEnabled .

11. Add a comma after the final attribute and paste the following entries before the closing ]
    {
      "anchor": false,
      "caseExact": false,
      "defaultValue": null,
      "flowNullValues": false,
      "multivalued": false,
      "mutability": "ReadWrite",
      "name": "urn:ietf:params:scim:schemas:extension:catonetworks:2.0:User:sAMAccountName",
      "required": false,
      "type": "String",
      "apiExpressions": [],
      "metadata": [],
      "referencedObjects": []
    },
    {
      "anchor": false,
      "caseExact": false,
      "defaultValue": null,
      "flowNullValues": false,
      "multivalued": false,
      "mutability": "ReadWrite",
      "name": "urn:ietf:params:scim:schemas:extension:catonetworks:2.0:User:onPremisesDomainName",
      "required": false,
      "type": "String",
      "apiExpressions": [],
      "metadata": [],
      "referencedObjects": []
    }

12. To create the synchronization mappings between Entra attributes and Cato SCIM attributes, using Ctrl+F, search for "Provision Azure Active Directory Users" .

13. In that object, identify the "attributeMappings" array.

14. At the end of that array, find the last }, add a comma paste the following entries before the closing ]
    {
      "defaultValue": "",
      "exportMissingReferences": false,
      "flowBehavior": "FlowWhenChanged",
      "flowType": "Always",
      "matchingPriority": 0,
      "targetAttributeName": "urn:ietf:params:scim:schemas:extension:catonetworks:2.0:User:sAMAccountName",
      "source": {
        "expression": "[onPremisesSamAccountName]",
        "name": "onPremisesSamAccountName",
        "type": "Attribute",
        "parameters": []
      }
    },
    {
      "defaultValue": "",
      "exportMissingReferences": false,
      "flowBehavior": "FlowWhenChanged",
      "flowType": "Always",
      "matchingPriority": 0,
      "targetAttributeName": "urn:ietf:params:scim:schemas:extension:catonetworks:2.0:User:onPremisesDomainName",
      "source": {
        "expression": "[onPremisesDomainName]",
        "name": "onPremisesDomainName",
        "type": "Attribute",
        "parameters": []
      }
    }
     

15. Click Save. A Schema Text Editor save successful message is displayed.
    

     

16. In the Cato Networks SCIM application, click on Provisioning then Edit Provisioning.

17. Expand the Mapping section and click Provision Azure Active Directory Users, then Show advanced options. 

18. After a few minutes, ensure these mappings appear:

    1. sAMAccountName → onPremisesSamAccountName

    2. onPremisesDomainName → onPremisesDomainName

Step 2: Creating a Proxy Instance

The proxy instance defines the sites, endpoint, and authentication method. The supported authentication options are:

• Kerberos: The proxy authenticates each request against the identity in the device’s Kerberos ticket, tying every session to a specific user. This enables user-based policies to be applied. 
  To use Kerberos authentication, generate a KEYTAB file on the Kerberos Key Distribution Center (KDC). The KEYTAB file contains the secrets that allow the Cato PoP to validate Kerberos tickets and verify the user's identity.

• No Authentication: The proxy does not apply user authentication. User-based policies are not applied.

   

To create a proxy instance:

1. {{snippet.Site Web Proxy path}}

2. Click New, then New Proxy.

3. Add a name for the proxy instance and choose the site(s) to associate with the proxy.

4. Enter the FQDN that devices use to connect to the proxy and a port for the proxy instance.
   Note: The Corresponding IP is displayed for DNS resolution. 
   

    

5. Select the Authentication Method.
   

    

6. If Kerberos is selected as the Authentication Method, upload the KEYTAB file. If you are creating an unauthenticated proxy instance, this step is not required. 

7. Click Apply and Create Rule. 
   The Proxy instance is created.

Once the proxy instance is created, define its network rules. Each rule consists of a source, a destination, and an action. The available actions depend on the Authentication Method of the proxy instance.

• A Kerberos proxy instance supports these actions:

  • Authenticate: Traffic requires Kerberos authentication

  • Allow: Traffic is permitted without authentication. Use an Allow rule when specific devices, services, or destinations can bypass authentication. Allow rules must be ordered above any Authenticate rules
    Note: The Allow action refers to Kerberos authentication. Unauthenticated traffic is inspected by security engines and may be blocked by a security policy.

• For an unauthenticated proxy instance, only the Allow action is available

Traffic that doesn’t match a rule in the Site Web Proxy rulebase is blocked by the final system rule.

To define a network rule:

1. {{snippet.Site Web Proxy path}}

2. Click New, then New Proxy Rule. 
   The New Proxy Rule panel opens. 
   Note: If you are defining a network rule immediately after creating a proxy instance, the New Proxy Rule panel is automatically displayed.

3. Enter a Name for the rule, choose the Proxy the rule applies to, and choose the Position of the rule within the rulebase.

4. Add the Source to be enforced by the rule. The supported sources are IP addresses or Network subnets.
   Note: To apply the rule to all Sources, leave this section blank.

5. Define the Destinations the rule applies to. 
   Note: To apply the rule to all Destinations, leave this section blank.

6. Choose the Action that is applied by the rule.

7. Click Apply.

8. Click Publish.

9. Set the Site Web Proxy toggle to Enabled.