TLS Inspection

If your proxy performs TLS/SSL inspection, the outbound traffic from Action1 agents to the Action1 management server (server.action1.com) and CDN servers should be excluded from inspection. Otherwise, the agents may be unable to connect to the management server or download software packages from CDN servers.

Why does this matter?

Solutions such as Zscaler or Cisco Umbrella can inspect encrypted HTTPS traffic by using TLS/SSL inspection. For that, they intercept the connection, decrypt and inspect the traffic, and then establish a separate encrypted connection to the destination server.

As part of this process, the proxy appliance can present its own substitute TLS certificate to the client instead of the certificate presented directly by the destination server. For Action1 traffic, this certificate substitution may cause certificate validation performed by the Action1 agent to fail. In this case, the agent rejects the connection to the Action1 management server, and the endpoint will appear as Disconnected in the Action1 console.
On the other hand, the proxy appliance may successfully inspect the connection to the Action1 CDN server but block the software package download based on the policy settings. In this case, the agent will be unable to download the package from the Action1 CDN server.

TLS inspection exclusions

Configure your proxy so that the required Action1 destinations are excluded from TLS/SSL inspection.

This refers to the connections:

between the Action1 server and agents (for all operating systems)
between CDN servers and Action1 agents (for Windows and macOS endpoints)
between the Action1 server and Action1 Deployer (if configured in Windows infrastructure)

The destinations to exclude depend on the Action1 account region. For example, an account in the Australia region uses destinations including:

server.au.action1.com — Action1 management server
au-cdn.action1.com — Action1 CDN
au-cdn-action1-com.b-cdn.net — Action1 CDN

The destinations for North America and Europe Action1 regions are listed in the Action1 firewall configuration requirements.

For instructions on creating TLS/SSL inspection exclusions, refer to the documentation provided by your proxy vendor.