Bridge (Transparent) Mode vs. Proxy Mode

Note: available Webinars for this Topic include:

iPrism Technical Support Installation and Deployment Webinars (see Bridge/Proxy Webinar)

This article is meant to contrast Bridge mode (aka "Transparent") and Proxy mode operation. These two modes of operation differ in the following  areas:

1. Physical Installation of iPrism

2. Packet Handling

Physical Installation

A key decision when installing iPrism is whether you wish to use Bridge-Mode or Proxy-Mode (illustrated below). Bridge-Mode uses two NIC connections, and is said to be an "in-line" installation. Proxy-Mode uses 1 NIC connection. See iPrism Appliance Specifications, and use "Panel" links to examine connectors. Note: Routing Mode is no longer supported as of iPrism v4.1. You must re-configure for Bridge or Proxy Mode.

Packet Traffic - Transparent vs. Proxy

A key concept in understanding iPrism is that "Proxy" packet traffic is generated by reconfiguring client browsers to point at the iPrism, which sets an iPrism Destination-IP address, an iPrism Port number (3128 by default), and a reference to "Proxy" protocol in the packet.  

In contrast to the above, "Transparent"packet traffic has a Web-Server Destination-IP address, a Web Port number (80 for example), and a reference to a "web" protocol (like HTTP) in the packet.

Knowing the above, it is easy to understand how single-interface Proxy-Mode supports "Proxy" packet traffic (i.e., explicitly redirected to iPrism) ...  and how dual-interface Bridge-Mode quite naturally supports "Transparent" packet traffic due to in-line installation.  Note however, that if you wanted to, you could set all users to explicitly proxy to an iPrism installed in Bridge-Mode, and it would work!  Of course, you would not be taking advantage of various Bridge-Mode advantages, or avoiding client configuration. A more realistic example of sending Proxy packet traffic to a Bridge-Mode iPrism is when you need to support Terminal Server users.  In conclusion, Bridge-Mode typically implies handling Transparent packet traffic, but may also handle Proxy packet traffic when needed. Because a Proxy-Mode installation uses a single-interface and is not "in-line", iPrism will only handle Proxy packet traffic explicitly directed to it. One final note; below is a link to an article on "Transparent Proxy Mode" which simply means directing traffic to a single-interface iPrism (a.k.a. Proxy-Mode) without configuring clients. This is typically done with a Layer-3 switch or a router, perhaps by implementing WCCP. "Transparent" in this case means two things, 1) packet redirection without client-side configuration, and 2) Transparent packet traffic since the original internet-destined packet is what iPrism see's. In summary:

• Bridge-Mode (transparent (web) and proxy (iPrism) packet traffic, dual NICs)

• Proxy-Mode (proxy (iPrism) packet traffic only, single NIC)

• Transparent Proxy-Mode (transparent (web) packet traffic, switch or WCCP router, single NIC)