WSAM BYPASS/PASSTHROUGH APPLICATIONS

[meftahur rahman_]

Hi,

We have a lot of juniper boxes in our  network.I was wondering what wsam passthrough applications were.

I understand if i define an appilcation as bypass/passthrough wsam will not intercept the traffic and the traffic from that application will be out through my computers local interface adapter.

My question is where does the traffic go ?if the wsam doesnt intercept the traffic ,the traffic will not reach the IVE .

AM i right ?

[zanyterp_]

Yes, you are correct. It uses the physical adapter & connects out that way

[meftahur rahman_]

well i am not sure....what "connects that way means" .

Lets say this:

i have an ldapbrowser.exe intsllaed in my PC .This the client application. I am trying to connect to an internel LDAP server via this ldap broswer on port 389 of the LDAP server.

I have configured the ldapbrowser.exe as one of the wsam bypass applications and configured the LDAP server as one of the wsam allowed server (Destinations).

When i am on VPN i launch WSAM.Then i start the ldapbrowser.exe .I understand wsam is not going to intercept the traffic for ldapbrowser.exe as it is configured as a bypass application.So the traffic from ldapbrowser.exe will go out from the computers local adpater.Since the traffic from ldapbrowser.exe will never reach the IVE ,how am i going to connect to the internel LDAP server on VPN using ldapbrowser.exe ??

user PC----------------------------------------------------------------IVE---------------------------------(internel corporate  network) 

(ldapbrowser.exe)                                                                                                                                                     |                                                                                                                                                                                                                    |

                                                                                                                                                                                      |  

                                                                                                                                                                           (ldapserver :389)

I have never understood what is the purpose of having wsam bypass applications.

[jayLaiz_]

Hi,

WSAM bypass is meant for applicatins and not backend servers.

If you enter iexplore.exe as a bypass application, all IE traffic will not be intercepted by WSAM

Once you configure an application as a bypass, you will not be able to connect to any internal servers dfined under WSAM destinations using that application.

Hope this helps.

Regards,

Jay

[meftahur rahman_]

Hi Jay,

What you are stating is consistent with my findings.I too think when you define something in wsam bypass applications ,wsam wouldnt intercept the traffic from that application even if there is a matching destination under "wsam allowed servers".

However,I find the othername for wsam bypass application pretty confusing.Its called passthrough application,which would rather mean the application traffic will reach the IVE and IVE will forward it to the backend server even if WSAM doesnt intercept it.

Weird nomenclature...dont you think so ??Even the juniper config guide says something like that.

[zanyterp_]

Not sure about the pass through portion, but the bypass excludes that application traffic from the WSAM L7 tunnel. It is, essentially, a legacy option from when WSAM was an LSP-based connection & those drivers routinely interfered with each other (now it uses TDI). Even prior to that change in 5.4, there were very few instances where manual control was needed. But there are corner cases that still exist so the option remains