FAQ: Blue Coat ProxyOne

What is ProxyOne and who is the target audience?

Blue Coat ProxyOne™ is a low touch malware protection appliance targeted at businesses that want
comprehensive web malware protection, including AV scanning and URL filtering with minimal IT effort required.
ProxyOne comes pre-configured and can be installed on your network in under 5 minutes and can support
businesses with up to 2000 users and up to 100Mbps of web traffic.

The target customers for ProxyOne are businesses that;

• Have few IT resources and consequently have IT generalists that lack security expertise.
• Likely have firewall or UTM devices deployed with URL filtering and AV plug-ins for web security.
• Likely have just one office with some remote workers.

My customers want a complete Web security gateway. Is this a

complete solution?
Yes! ProxyOne integrates web content filtering, inline threat analysis using AV and Malware engines with the
WebPulse™ collaborative cloud defense uniting over 70M diverse users for real time awareness of new Web
content and threats.

This creates a hybrid design providing the best of on-premise controls with the collective intelligence of cloud
service. This protection is extended to remote workers through Blue Coat ProxyClient™. In addition, ProxyOne
provides real time reporting of all user web traffic to better enable customers to refine their internet use policies
and more rapidly isolate potentially infected devices.

How is ProxyOne different from ProxySG?

ProxyOne is based on the same market leading technology as ProxySG however ProxyOne is an integrated,
preconfigured solution combining strong Web malware protection (URL filtering and AV scanning) with in-depth
dashboard reporting on a single appliance. ProxyOne uses a hybrid approach to provide Web malware protection
to both network and remote users with the collaborative defense of the WebPulse Cloud service. It also includes
proxy caching technologies for web and streaming. The integrated on-board reporting is equivalent to that offered
in ProxySG.

ProxyOne supports up to 2000 users at 100Mbps throughput. Organizations that need scalability above 2000
users will need ProxySG with dedicated ProxyAV appliances appropriate for the performance needs of larger
organizations. In addition, ProxyOne provides a straightforward acceptable use policy wizard. Organizations
that want in-depth policy flexibility need to consider ProxySG.

For more details, refer to the ProxyOne vs. ProxySG Feature Comparison Guide.

Can ProxyOne be deployed in enterprise branch offices?

No, ProxyOne is not designed to function as an enterprise branch appliance. Specifically, ProxyOne cannot be
centrally managed by the Blue Coat enterprise Director product. Per above, ProxyOne does not have the policy
richness, deployment flexibility and other features of ProxySG.

Confidential
For Internal and Official Partner Use Only
 1. I’ve been selling SWG Bundles. How is this different?
The Secure Web Gateway bundles were targeted to businesses with up to 1500 users and released as a
precursor to ProxyOne. The SWG bundles include ProxySG, ProxyAV, an SSL license, and licenses for AV,
BCWF and Service for 3 years.

ProxyOne is a true integrated, low touch installation and maintenance product targeted at this same segment but
does not include all the enterprise-level features that come with ProxySG.

ProxyOne is purchased as an appliance plus subscription. The subscription is available in user bands from 100
up to 2000 users, for terms of 1 or 3 years.

When should I sell ProxyOne to a current SWG bundle

opportunity that has not yet closed?
Now! Any opportunities for SWG Bundles are good candidates for ProxyOne if they qualify for ProxyOne based
on the functionality that is included.

For example, a SWG Bundle opportunity that is interested in using policy more than just URL filtering policy rules
does not qualify for ProxyOne.

Many of my customers have UTMs or next generation firewalls.

How is this different?
ProxyOne provides comprehensive, real time Web protection that adds an additional layer of defense critical for
web malware protection that is not provided by network security focused UTM and Next Generation Firewall
devices.

There are several key security features that are provided by ProxyOne that are not provided by a UTM or next
generation firewall devices.

Passive vs. Real-Time: UTM and firewall devices are primarily purchased for network security (blocking threats
from outside the organization). Though they offer add-on licenses for URL filtering and AV scanning, UTMs
generally use freeware to deliver URL and AV ratings. These databases and engines are static and rely on
scheduled updates. ProxyOne is powered by WebPulse with real time rating and real-time inputs from over 70
million users to deliver the most comprehensive web protection. WebPulse is the largest and most advanced
cloud service for web security protection. In contrast, while UTM and firewall vendors claim to have cloud services
for security, these are largely static databases that are updated on a periodic basis. They do not provide real time
ratings to users, which is a critical requirement in the current constantly-changing web environment.

Remote worker protection: UTM and firewall devices do not offer web malware protection for the increasing
number of workers that work remotely or are roaming users. ProxyOne extends full malware protection to roaming
users via ProxyClient which delivers real time intelligence to the client directly from our WebPulse cloud service. If
a UTM device offers a client it is for VPN access not Web Security.

Caching for improved web performance: Turning on the additional functionality for URL filtering and AV
scanning dramatically reduces the performance of UTMs and firewalls. With ProxyOne, full functionality can be
used while caching optimizes web traffic to deliver improved performance.

Confidential
For Internal and Official Partner Use Only
 Video: with the increased consumption of network bandwidth driven by video usage, ProxyOne provides the
added benefit of video caching and stream splitting to optimize the delivery of video. This is yet another unique
advantage over static network security devices such as UTMs and firewalls.

Will ProxyOne compete with “UTM” vendors such as Fortinet or

Palo Alto Networks?
There are many type of networking devices that claim to offer URL filtering and AV scanning as part of their
solution. While the claim is true, in today’s dynamic environment with Web threats changing in minutes, URL links
disappearing, and new Web sites showing up every minute, they simply can’t keep up. Their background is in
network security and they don’t have the expertise or the infrastructure set up to provide true web protection.
What we have found when we see these type of vendors in the field, is that they are following the budget need
and so it is very simple to displace them during an evaluation. Immediately the customer can see that they are not
being fully protected. It is important to position ProxyOne as a layer of defense that works with these UTM
devices to ensure the best Web and Network security.

What are the key selling points for ProxyOne?

The key selling point for ProxyOne is that is provides best in class real time malware protection with integrated
dashboard reporting that is affordable and has a low touch maintenance model with support for all users,
including remote employees.

This functionality integrated into a single appliance powered by the WebPulse cloud service makes ProxyOne a
unique value for businesses that require enterprise grade malware protection offered in a more affordable,
simplified package.

With respect to low touch, what is involved for an IT generalist to

install & deploy ProxyOne?
ProxyOne is a low touch solution that will be up and running to protect your business in less than 5 minutes.
There are 6 simple steps involved in setting the IP address and DNS settings.

The simplicity of the initial configuration wizard can be viewed via the demo at the link below.

https://bluesource.bluecoat.com/webcast/proxyone-overview-se?redirect_count=0

What are the components of ProxyOne?

A completely new and straightforward user interface with:
• The ability to install and configure the box in less than 5 minutes
• Easy selection of categories for blocking/allowing
• One-click access to full reporting dashboard

 URL filtering and dynamic content rating via WebPulse cloud service with:
• Real-time inputs from over 70 million users
• Ratings across 17 different languages
• Multiple technologies to rate new content
• The ability to implement new defenses in the cloud

Support for inline, on-box malware and AV scanning

Support for remote worker content filtering via ProxyClient

Confidential
For Internal and Official Partner Use Only
 Automated software updates to keep the appliance software current; auto-updates can be scheduled
Bandwidth savings and performance improvements from video caching and flash media stream splitting
Bandwidth savings and performance improvements from caching of internet objects

How does ProxyOne reporting differ from ProxySG reporting?

ProxyOne's Reporting has the full functionality of drill-down and customizable reporting of our Enterprise Reporter
version 9.2, but has the administrative features blocked. The reporting username and password is setup to be
identical to the ProxyOne configuration user-interface.

The ProxyOne database is configured to age out log information after 100 days. The reporting subsystem
will update with new logging data every five minutes.

The default dashboard view has been customized to emphasize the malware protection and user compliance
features of ProxyOne, and can be further customized to include other graphics/statistics as desired

Can ProxyOne be upgraded to a ProxySG?

No. ProxyOne is a new product that integrates web malware protection with reporting into a single appliance. As
such, there is no upgrade path between a ProxyOne appliance and a ProxySG appliance

When will ProxyOne be available?

ProxyOne is orderable and generally available (GA) NOW!

What is the pricing for ProxyOne?

ProxyOne is priced based on an annual subscription fee plus a onetime up-front fee for the hardware appliance.
Subscriptions are available in bands from 100 to 2000 users with terms of 1 or 3 years. Support is included in the
subscription with choices of Next Business Day or Same Day Shipment hardware service. Optionally, BlueTouch
Support Partners (BTSP) will also be able to support ProxyOne.

For example, 400 users for a 3 year agreement will cost $X for the 400 user, 3 year subscription plus the onetime
cost of the appliance.

Who can sell ProxyOne?

Any official Blue Coat Channel partner can sell ProxyOne.

2. Is the user count licensing enforced on ProxyOne?

Yes. The ProxyOne subscription licenses must be purchased for the number of users that will be accessing the
web. When the active user count exceeds the licensed limit of the ProxyOne, the appliance will queue, or delay
new users until another user closes their Internet connections.

Are any hardware upgrades available on ProxyOne?

No. ProxyOne is available on a single platform, with selection of user band subscriptions.

Are subscription upgrades available on ProxyOne?

Yes. Customers may purchase a subscription upgrade to increase their user count or term length.

Confidential
For Internal and Official Partner Use Only
What is the upgrade process?
When increasing the user count on an existing ProxyOne subscription, the customer will buy the complete new
required user count for 1 or 3 years according to the price list. A credit will then be applied from the remainder of
the existing license.

Can a customer opt out of receiving auto-updates?

No. All appliances will receive auto updates when new software is available. Customers will be able to select the
time of day when the appliance will be automatically updated.

How do I size ProxyOne for a customer?

The ProxyOne appliance comes in a single model for the user range up to 2000 users. ProxyOne subscriptions
are sold in user bands. The user count selected must match the number of total end users, including employees,
contractors, customers, business partners that have remote user access to the network through the company’s
VPN.

For more information, refer to the ProxyOne Sizing Guide.

What is the throughput of ProxyOne?

ProxyOne can sustain 100Mbps of throughout of which 50% is estimated to be web traffic. For additional details
please refer to the ProxyOne Sizing Guide available on BlueSource.

Can ProxyOne handle high bandwidth for a low number of users?

Yes, while ProxyOne has enforced user count license, the throughput is limited only by the appliance hardware.
Consequently, in the event that a low user count, say 100 users, generate traffic of 100 Mbps, the ProxyOne
appliance will sustain that throughput.

Does ProxyOne support High Availability?

The ProxyOne appliance has some built-in HA features, including redundant power supplies and dual hard disk
drives with RAID. Complete redundancy, active/active clustering, and automated failover is not supported.
However, customers can purchase a second appliance for automated failover configured using a load balancer or
with the use of PAC files.

This question may indicate a customer who may be better served by buying the ProxySG and ProxyAV
combinations.

Can ProxyOne be deployed with a ProxySG?

Yes, but while ProxyOne can be deployed in the same network as ProxySG, ProxyOne is not designed to be an
enterprise branch solution. ProxySG policy and configuration cannot be transferred to ProxyOne. In addition,
ProxyOne cannot be managed by the Director product which manages multiple ProxySG appliances.

3. What are the guidelines for when to recommend ProxySG and

when to recommend ProxyOne?
Below is a checklist of qualifiers that identifies when ProxyOne is the right solution and when ProxySG is the
appropriate solution.

Confidential
For Internal and Official Partner Use Only
 ProxyOne is appropriate for ProxySG is appropriate for customers
customers whose needs are met by who require the following additional
the following; functionality;
Installation Pre-configured, installs in under 5 minutes Customizable installation

Sizing 100 to 2000 users, up to 100Mbps Highly scalable line of appliances for large
throughput enterprise and service providers.

Policy Only URL filtering policy Flexible, with many policy options
services (time based, file type based, quota based etc)

Authentication Windows SSO type only 11 authentication types

(LDAP, Kerberos, etc)

Deployment Only explicit or physically inline Multiple deployment options

(WCCP, etc)

Management Not supported Director product offers central management of

ProxySG devices.

WAN Not supported ProxySG supports application acceleration

Optimization

DLP Not supported Blue Coat DLP can be supported via ICAP with
ProxySG

Email Not supported ProxySG can be deployed with Proofpoint per

our partnership

Below are some sample customer scenarios to provide examples on how to qualify ProxyOne vs. ProxySG;

Scenario 1: The customer is a manufacturing business located in Seattle with 1500 users at 15 distributed sites.
All the sites connect directly to the internet.

Currently the customer uses firewalls with desktop AV only. Their current URL filtering license will be EOL (end of
life) within 6 months, which is driving the sale. The customer requires a global filtering policy, with an exception for
the CEO and more restrictive access for the support team. Based on a recent company merger, support for
multiple windows domains is also required.

Solution for Scenario 1: Although this is an ideal scenario for ProxyOne, the need for multiple windows domains
requires ProxySG. The reseller or sales rep may propose consolidation of domains into 1 for simplification (via
reseller pro services or vendor services) which can then make it a ProxyOne opportunity. Also based on the
distributed sites, the need for central management should be validated along with timing to determine of
ProxyOne will meet the need without central management, or if ProxySG is truly required with the Director product
for management.

Scenario 2: The customer is a law firm with 500 users at 1 site with up to 50 remote workers.

Currently the customer uses a firewall with AV and URL licenses running on the firewall for web security as well
as a client for the firewall for remote users. The customer requires a global filtering policy, with an exception for

Confidential
For Internal and Official Partner Use Only
 the CEO and more restrictive access for some internal groups. The law firm uses social media for marketing
purposes, wants to allow unrestricted use except for games. This customer has the potential for growth to an
additional site over next 2 years.

Solution for Scenario 2: This is an ideal customer for ProxyOne with ProxyClient! In addition, you can propose
retiring the AV and URL filtering licenses on the firewall as additional cost savings. The firewall clients that are
available are generally used for VPN connections and do not protect remote workers. ProxyClient installed on
remote worker devices provides full web security protection to the policy settings of ProxyOne.

A customer is interested in our Eval or Try-and-Buy program. How

does it work and what is involved?
The Blue Coat Try-and-Buy program is run through the channel partner, and allows the partner to offer an
appliance for evaluation at no upfront cost for a period of 30 days.

A customer that is a qualified opportunity with a high likelihood of purchasing the product would be nominated by
the partner to receive a 30 day Try-and-Buy appliance.

• TAB = Try & Buy; these units are intended for highly qualified evaluation activities, and are delivered with
30 days of subscription and support.
• TAB units activity must have an approved deal registration request.
• TAB units activity must also have a completed Evaluation Plan, which must be approved by Blue Coat.
• TAB orders without a valid DAN # and Eval approval will be rejected.
• TAB units converted to End-User sale must include the product upgrade SKU below, plus the appropriate
per user ProxyOne subscription product code with the number of users.

For more information on the latest Blue Box 2.0 program, please
visit https://bluesource.bluecoat.com/salestools

For more information on ProxyOne, please visit

https://bluesource.bluecoat.com/products/proxyone

Copyright © 2010 Blue Coat Systems, Inc. All rights reserved worldwide. No part of this document may be reproduced by any means nor translated to any
electronic medium without the written consent of Blue Coat Systems, Inc. Specifications are subject to change without notice. Information contained in this
document is believed to be accurate and reliable, however, Blue Coat Systems, Inc. assumes no responsibility for its use. Blue Coat, ProxySG, PacketShaper,
IntelligenceCenter, CacheFlow and BlueTouch are registered trademarks of Blue Coat Systems, Inc. in the U.S. and worldwide. All other trademarks mentioned in
this document are the property of their respective owners.

Copyright © 2010 Blue Coat Systems, Inc. All rights reserved worldwide. No part of this document may be reproduced by any means nor translated to any
Confidential
electronic medium without the written consent of Blue Coat Systems, Inc. Specifications are subject to change without notice. Information contained in this
document is believed to be accurate and reliable,For Internal
however, and
Blue Coat Official
Systems, Partner
Inc. assumes Use Onlyfor its use. Blue Coat, ProxySG, PacketShaper,
no responsibility
IntelligenceCenter, CacheFlow and BlueTouch are registered trademarks of Blue Coat Systems, Inc. in the U.S. and worldwide. All other trademarks mentioned in
this document are the property of their respective owners.