TLS Inspection

If your proxy firewall, antivirus, or other security solution performs TLS/SSL inspection, the outbound traffic from Action1 agents to the Action1 management server, Action1 Desktop Relay servers, and CDN servers should be excluded from inspection. Otherwise, the agents may be unable to connect to the management server or download software packages from CDN servers; traffic to Desktop Relay servers will be delivered with delay.

Why does this matter?

An IT infrastructure can include security appliances or software solutions that analyze traffic by performing deep packet inspection (DPI), for example:

• Endpoint-based security software — installed locally on an endpoint. These can be endpoint protection or network-analysis solutions (e.g., Sophos Endpoint), and, depending on their configuration and capabilities, security agents (e.g., SentinelOne).
• Network-based security solutions — part of the network infrastructure. These can be hardware or software firewalls (e.g., Cisco ASA, Cisco Umbrella Secure Web Gateway, Zscaler Internet Access), next-generation firewalls and IDS/IPS solutions (e.g., Palo Alto Networks firewalls), and other security-capable routers, gateways, or appliances.

Solutions like Zscaler or Cisco Umbrella can inspect encrypted HTTPS traffic by using TLS/SSL inspection. For that, they intercept the connection, decrypt and inspect the traffic, and then establish a separate encrypted connection to the destination server.

TLS inspection can affect Action1 traffic in several ways:

• As part of the TLS inspection process, the proxy or security appliance can present its own substitute TLS certificate to the client instead of the certificate presented directly by the destination server. For Action1 traffic, this certificate substitution may cause certificate validation performed by the Action1 agent to fail. In this case, the agent rejects the connection to the Action1 management server, and the endpoint will appear as Disconnected in the Action1 console.
• Since TLS inspection occurs before the traffic is forwarded to the destination server, it can introduce additional latency, affecting the connection between the Action1 agent and the Action1 Remote Desktop Relay server.
• On the other hand, the proxy or security appliance may successfully inspect the connection to the Action1 CDN server but block the software package download based on the file-filtering policies. In this case, the agent will be unable to download the package from the Action1 CDN server.

TLS inspection exclusions

Configure your proxy or security appliance so that the required Action1 destinations are excluded from TLS/SSL inspection.

This refers to the following connections:

• between the Action1 server and agents (for all operating systems)
• between CDN servers and Action1 agents (for Windows and macOS endpoints)
• between the Action1 Desktop Relay server and Action1 agents (for Windows endpoints)
• between the Action1 server and Action1 Deployer (if configured in Windows infrastructure)

The destinations to exclude depend on the Action1 account region. For example, for an Action1 account registered in the Australia region, you may need to exclude the following destinations:

• server.au.action1.com — Action1 management server

• au-cdn.action1.com — Action1 CDN server

• *.relay.server.action1.com — Action1 Desktop Relay servers (if you are using Zscaler)

For the corresponding destinations for North America and Europe  Action1 regions, refer to the Action1 firewall configuration requirements.

For instructions on creating TLS/SSL inspection exclusions, refer to the documentation provided by your proxy vendor. For example, see Cisco Umbrella documentation article or Zscaler Support Troubleshooting Runbook.