Access Private Applications Through Trellix ePO -SaaS

Guidelines to access Private Applications from the endpoints managed by Trellix ePO -SaaS

To access private applications from the endpoints managed by ePO, the Client Proxy extension must be installed on ePO and Client Proxy package should be deployed to the endpoints.

Export the tenant credentials

Do the following to export the tenant credentials from SSE to an .xml file:

1. Go to Settings > Infrastructure > Client Proxy Management.
2. In the policy tree, select Global Configuration.
3. Click Tenant Authentication to open Tenant Authentication and Global Settings.
4. From the Actions drop-down list, select Export Credentials.
   Downloads the tenant credentials to an .xml file.

Steps 

1. On the Trellix ePO-SaaS console, select Menu > Configuration > SCP Administration.

2. In the Customer Identifier setting, import the tenant credentials (exported from SSE) to ePO. 

3. Click Save.
4. Go to Policy Catalog > Skyhigh Client Proxy > click New Policy.
5. Enter the policy name in the Create a new policy dialog box.

5. Once the policy is created, select the policy and click Edit.

6.  Go to the Proxy Servers tab and configure the proxy server address. 

7. Go to Client Configuration tab:
   1. Select the Download Policy from Skyhigh SSE checkbox
      • When you select this checkbox and push the policy to all endpoints, the endpoints will synchronize with the SSE SCP policy.
   2. In the Secure Channel for Cloud Proxies, make sure to the Enable Secure Channel checkbox.
   3. In the Traffic Redirection Settings, make sure to select Always redirect network traffic to proxy servers.

8. Click Save.
   Displays the saved Client Proxy policy on the Policy Catalog page.
9. Select the policy and click Edit.
10. From the Actions drop-down list, select Export Policy to File.

11. Select Skyhigh Client Proxy Policy Client File to download the SCP client file. You need to import this file to the SSE UI.

12. Select System Tree 
13. Select the organizational level where you want to assign Client Proxy policy to all endpoints.
14. Go to the Policies tab.
15. Select Edit Assignment.

16. From the Assigned policy drop-down list, select the policy.

17. You can push the policy through ePO to the client or client will pull this policy through Trellix Agent.

Create or import ePO policy on Skyhigh SSE

1. On the Skyhigh SSE navigation bar, click Settings.
2. Select Infrastructure > Client Proxy Management.
3. In the policy tree, select Configuration Policies.
   You can create a new policy or import the policy exported from ePO.
4. Click the highlighted menu icon (...) next to the branch, select Create New Policy or Import Policy. 

• Import Policy - Imports the policy to SSE UI. Export the policy from SSE and importing this policy on ePO is not supported for private applications.
• Create New Policy - Enter the same name as the policy name on ePO. The name is case sensitive. Also, make sure to complete all Client Proxy configurations such as block list, bypass list and so on.

5. Configure the private applications and connector groups. 

6. Once ePO and SCP endpoints synchronize, verify the Policy Revision number in the About Skyhigh Client Proxy window, which should be same as the SSE policy revision number. 

7. Endpoints can now access the private applications.