You configure an access policy to authenticate users on behalf of a proxy server.

Note: You can configure any type of authentication that Access Policy Manager^® (APM^®) supports for the access profile type (SWG-Explicit or SWG-Transparent) that is used in your forward proxy configuration.

This example uses LDAP.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. Locate the access profile for the forward proxy configuration you are updating.
   Look in the Profile Type field for SWG-Explicit or SWG-Transparent.
3. In the Per-Session Policy column, click the Edit link
   The visual policy editor opens the access policy in a separate screen.
4. Click the (+) icon anywhere in the access policy to add a new item.
   Note: Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
   A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
5. On the Logon tab, select Logon Page and click the Add Item button.
   The Logon Page Agent properties screen opens.
6. Click Save.
   The properties screen closes and the policy displays.
7. On a policy branch, click the (+) icon to add an item to the policy.
8. On the Authentication tab, select LDAP Auth and click Add Item.
   A Properties screen opens.
9. For Server, select the LDAP server you want to use from the list.
   Servers are defined in the Access > Authentication area of the Configuration utility.
10. For SearchDN, type the base node of the LDAP server search tree where you want to start the search.
11. For SearchFilter, type the search criteria to use when querying the LDAP server for the user's information.
    Session variables are supported as part of the search query string.
    When you type a string, enclose it in parentheses.
    For example, type (sAmAccountName=%{session.logon.last.username}) or (sAmAccountName=%{subsession.logon.last.username}).
12. For UserDN, specify the Distinguished Name (DN) of the user.
13. Click Save.
    The properties screen closes and the policy displays.
14. Click the Apply Access Policy link to apply and activate the changes to the policy.

1. On the Main tab, click Access > Profiles / Policies > Per-Request Policies .
   The Per-Request Policies screen opens.
2. If you are not going to update an existing policy, all you need to do to create a new one is click Create, type a name that is unique among all access profile and per-request policy names, and click Finished.
3. In the Name field, locate the policy that you want to update, then in the Per-Request Policy field, click the Edit link.
   The visual policy editor opens in another tab.
4. On a policy branch, click the (+) icon to add an item to the policy.
   A small set of actions are provided for building a per-request policy.
   A popup screen displays actions on tabs, such as General Purpose and Authentication, and provides a search field.
5. On the General Purpose tab, select Proxy Select and click Add Item.
   A Properties popup screen opens.
6. From the Pool list, select a pool of one or more proxy servers from which to select the next hop.
   Important: All proxy servers in the pool that you select must support the forward proxy mode that you specify in the Upstream Proxy Mode setting.
7. From Upstream Proxy Mode, select Explicit or Transparent.
8. For Username and Password, most of the time you can retain the default values (blank).
   These fields support the use of static credentials to authenticate the user at the next hop using HTTP Basic authentication.
9. Click Save.
   The properties screen closes. The visual policy editor displays.

1. On the Main tab, click Access > Profiles / Policies > Per-Request Policies .
   The Per-Request Policies screen opens.
2. If you are not going to update an existing policy, all you need to do to create a new one is click Create, type a name that is unique among all access profile and per-request policy names, and click Finished.
3. In the Name field, locate the policy that you want to update, then in the Per-Request Policy field, click the Edit link.
   The visual policy editor opens in another tab.
4. On a policy branch, click the (+) icon to add an item to the policy.
   A small set of actions are provided for building a per-request policy.
   A popup screen displays actions on tabs, such as General Purpose and Authentication, and provides a search field.
5. On the General Purpose tab, select Proxy Select and click Add Item.
   A Properties popup screen opens.
6. From the Pool list, select a pool of one or more proxy servers from which to select the next hop.
   Important: All proxy servers in the pool that you select must support the forward proxy mode that you specify in the Upstream Proxy Mode setting.
7. From Upstream Proxy Mode, select Explicit or Transparent.
8. For Username and Password, most of the time you can retain the default values (blank).
   These fields support the use of static credentials to authenticate the user at the next hop using HTTP Basic authentication.
9. Click Save.
   The properties screen closes. The visual policy editor displays.

You configure an access policy to authenticate users on behalf of a proxy server.

Note: You can configure any type of authentication that Access Policy Manager^® (APM^®) supports for the access profile type (SWG-Explicit or SWG-Transparent) that is used in your forward proxy configuration.

This example uses LDAP.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. Locate the access profile for the forward proxy configuration you are updating.
   Look in the Profile Type field for SWG-Explicit or SWG-Transparent.
3. In the Per-Session Policy column, click the Edit link
   The visual policy editor opens the access policy in a separate screen.
4. Click the (+) icon anywhere in the access policy to add a new item.
   Note: Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
   A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
5. On the Logon tab, select Logon Page and click the Add Item button.
   The Logon Page Agent properties screen opens.
6. Click Save.
   The properties screen closes and the policy displays.
7. On a policy branch, click the (+) icon to add an item to the policy.
8. On the Authentication tab, select LDAP Auth and click Add Item.
   A Properties screen opens.
9. For Server, select the LDAP server you want to use from the list.
   Servers are defined in the Access > Authentication area of the Configuration utility.
10. For SearchDN, type the base node of the LDAP server search tree where you want to start the search.
11. For SearchFilter, type the search criteria to use when querying the LDAP server for the user's information.
    Session variables are supported as part of the search query string.
    When you type a string, enclose it in parentheses.
    For example, type (sAmAccountName=%{session.logon.last.username}) or (sAmAccountName=%{subsession.logon.last.username}).
12. For UserDN, specify the Distinguished Name (DN) of the user.
13. Click Save.
    The properties screen closes and the policy displays.
14. Click the Apply Access Policy link to apply and activate the changes to the policy.

1. On the Main tab, click Access > Profiles / Policies > Per-Request Policies .
   The Per-Request Policies screen opens.
2. If you are not going to update an existing policy, all you need to do to create a new one is click Create, type a name that is unique among all access profile and per-request policy names, and click Finished.
3. In the Name field, locate the policy that you want to update, then in the Per-Request Policy field, click the Edit link.
   The visual policy editor opens in another tab.
4. On a policy branch, click the (+) icon to add an item to the policy.
   A small set of actions are provided for building a per-request policy.
   A popup screen displays actions on tabs, such as General Purpose and Authentication, and provides a search field.
5. On the General Purpose tab, select HTTP Headers and click Add Item.
   A Properties screen opens.
6. In the HTTP Header Modify area, click Add new entry.
7. For Header Operation, retain the default value insert.
8. In the Header Name field, type X-Authenticated-User.
9. In the Header Value field, type the value of a successfully authenticated username.
   For example, type %{session.logon.last.userrname}.
10. To also add an X-Forwarded-For HTTP header, perform these substeps:
    1. In the HTTP Header Modify area, click Add new entry.
    2. In the Header Name field, type X-Forwarded-For.
    3. In the Header Value field, type the value of the client IP address.
       For example, type %{session.user.clientip}.
11. Click Save.
    The properties screen closes. The visual policy editor displays.
12. Add any additional items you want to the policy.
13. Click the (+) icon anywhere in the per-request policy to add a new item.
14. On the General Purpose tab, select Proxy Select and click Add Item.
    A Properties popup screen opens.
15. From the Pool list, select a pool of one or more proxy servers from which to select the next hop.
    Important: All proxy servers in the pool that you select must support the forward proxy mode that you specify in the Upstream Proxy Mode setting.
16. From Upstream Proxy Mode, select Explicit or Transparent.
17. For Username and Password, most of the time you can retain the default values (blank).
    These fields support the use of static credentials to authenticate the user at the next hop using HTTP Basic authentication.
18. Click Save.
    The properties screen closes. The visual policy editor displays.

Before configuring Access Policy Manager^® (APM^®) to forward X-Authenticated-User and X-Forwarded-For headers to a third-party proxy server, consider the capabilities of the specific proxy server. How a proxy server responds to X-Authenticated-User and X-Forwarded-For headers is completely dependent on the proxy server capabilities, and on the settings that a proxy server might provide for resource protection. Not all proxy servers can process the headers. Others might process and trust the headers but, based on configuration settings, require authentication regardless.

1. On the Main tab, click Access > Profiles / Policies > Per-Request Policies .
   The Per-Request Policies screen opens.
2. If you are not going to update an existing policy, all you need to do to create a new one is click Create, type a name that is unique among all access profile and per-request policy names, and click Finished.
3. In the Name field, locate the policy that you want to update, then in the Per-Request Policy field, click the Edit link.
   The visual policy editor opens in another tab.
4. On a policy branch, click the (+) icon to add an item to the policy.
   A small set of actions are provided for building a per-request policy.
   A popup screen displays actions on tabs, such as General Purpose and Authentication, and provides a search field.
5. On the General Purpose tab, select Proxy Select and click Add Item.
   A Properties popup screen opens.
6. From the Pool list, select a pool of one or more proxy servers from which to select the next hop.
   Important: All proxy servers in the pool that you select must support the forward proxy mode that you specify in the Upstream Proxy Mode setting.
7. From Upstream Proxy Mode, select Explicit or Transparent.
8. For Username and Password, type the user name and password that APM can use to authenticate to the proxy server.
9. Click Save.
   The properties screen closes. The visual policy editor displays.

The table lists some activities that you might observe with forward proxy chaining between Access Policy Manager^® (APM^®) and a third-party proxy server that uses Basic authentication. The table provides additional explanation.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. In the Per-Session Policy column, click the Edit link for the access profile you want to configure.
   The visual policy editor opens the access policy in a separate screen.
3. Click the (+) icon anywhere in the access policy to add a new item.
   Note: Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
   A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
4. On the Logon tab, select Logon Page and click the Add Item button.
   The Logon Page Agent properties screen opens.
5. Click Save.
   The properties screen closes and the policy displays.
6. On a policy branch, click the (+) icon to add an item to the policy.
7. On the Assignment tab, select SSO Credential Mapping and click Add Item.
   A properties screen opens.
8. Click Save.
   The properties screen closes and the policy displays.

1. On the Main tab, click Access > Profiles / Policies > Per-Request Policies .
   The Per-Request Policies screen opens.
2. If you are not going to update an existing policy, all you need to do to create a new one is click Create, type a name that is unique among all access profile and per-request policy names, and click Finished.
3. In the Name field, locate the policy that you want to update, then in the Per-Request Policy field, click the Edit link.
   The visual policy editor opens in another tab.
4. On a policy branch, click the (+) icon to add an item to the policy.
   A small set of actions are provided for building a per-request policy.
   A popup screen displays actions on tabs, such as General Purpose and Authentication, and provides a search field.
5. On the General Purpose tab, select SSO Configuration Select and click Add Item.
   A Properties screen opens.
6. From SSO Configuration Name, select an SSO configuration, and click Save.
   The properties screen closes. The visual policy editor opens.
7. Add any additional items you want to the policy.
8. Click the (+) icon anywhere in the per-request policy to add a new item.
9. On the General Purpose tab, select Proxy Select and click Add Item.
   A Properties popup screen opens.
10. From the Pool list, select a pool of one or more proxy servers from which to select the next hop.
    Important: All proxy servers in the pool that you select must support the forward proxy mode that you specify in the Upstream Proxy Mode setting.
11. From Upstream Proxy Mode, select Explicit or Transparent.
12. For Username and Password, most of the time you can retain the default values (blank).
    These fields support the use of static credentials to authenticate the user at the next hop using HTTP Basic authentication.
13. Click Save.
    The properties screen closes. The visual policy editor displays.

Example per-request policy with SSO Configuration Select and Proxy Select

Access Policy Manager^® (APM^®) does not support SSO to a resource server for SSL bypass traffic when the resource server performs authentication.

1. Open the Active Directory Users and Computers administrative tool, and create a new user account.
   The user account should be dedicated for delegation, and the Password never expires setting enabled.
2. Set the service principal name (SPN) on the Windows server for the user account.
   For the support tools that you can use and for the commands that you can use, such as setspn and ktpass, refer to Microsoft documentation.
   Note: If you use the ktpass command, it sets the SPN on the Windows server and creates a keytab file. Access Policy Manager^® (APM^®) Kerberos SSO does not need or use a keytab file.
3. Verify the result of setting the SPN.
   This example is purely for illustration. Refer to Microsoft documentation for up-to-date commands and correct usage.

   C:\Users\Administrator> setspn -L apm4

   Registered ServicePrincipalNames for CN=fproxy1,OU=users,DC=myhostname,DC=lab,DC=mynet,DC=com: HTTP/fproxy1.myhostname.lab.mynet.com where fproxy1 is the name of the user account that you created.
4. Take note of the service principal name.
   Important: You will need to type the service principal name in the Kerberos SSO configuration that you create in APM.
5. Return to the Active Directory Users and Computers screen to open your account again.
   A Delegation tab should appear.
6. Click the Delegation tab.
7. Select Trust this user for delegation to specified services only.
8. Select Use any authentication protocol, and add all your services to the list under Services to which this account can present delegated credentials.
   Every service should have Service Type HTTP (or http) and host name of the forward proxy server that you will use in your configuration.
9. Click OK.
   This creates the new delegation account.

1. On the Main tab, click Access > Single Sign-On > Kerberos .
   The Kerberos screen opens.
2. Click Create.
   The New SSO Configuration screen opens.
3. In the Name field, type a name for the SSO configuration.
4. From the Log Setting list, select one of the following options:
   • Select an existing APM log setting.
   • Click Create to create a new log setting.
5. In the Credentials Source area, specify the credentials that you want cached for Single Sign-On.
6. In the Kerberos Realm field, type the name of the realm in uppercase.
   For example, type MYHOSTNAME.LAB.MYNET.COM.
7. In the Account Name field, type the name of the Active Directory account configured for delegation.
   Type the account name in SPN format.
   In this example HTTP/fproxy1.myhostname.lab.mynet.com@MYHOSTNAME.LAB.MYNET.COM, fproxy1 is the delegation account, fproxy1.myhostname.lab.mynet.com is its fully qualified domain name, and MYHOSTNAME.LAB.MYNET.COM is the realm.
8. In the Account Password and Confirm Account Password fields, type the delegation account password.
9. Click Finished.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. Locate the access profile for the forward proxy configuration you are updating.
   Look in the Profile Type field for SWG-Explicit or SWG-Transparent.
3. In the Per-Session Policy column, click the Edit link.
   The visual policy editor opens the access policy in a separate screen.
4. Click the (+) icon anywhere in the access policy to add a new item.
   Note: Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
   A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
5. On the Logon tab, select HTTP 401 Response and click Add Item.
   A Properties screen opens.
6. From the HTTP Auth Level list, select negotiate and click Save.
   In a transparent forward proxy configuration, APM does not support Kerberos request-based authentication
   The properties screen closes.
7. Click the (+) icon on the negotiate branch.
   A popup screen opens.
8. For Kerberos authentication to work correctly with forward proxy, you must assign the domain name for the forward proxy virtual server to a session variable:
   1. On the Assignment tab, select Variable Assign and click Add Item.
   2. Click Add new entry.
      An empty entry appears in the Assignment table.
   3. Click the change link in the new entry.
      A popup screen opens.
   4. In the left pane, retain the selection of Custom Variable and type this variable name: session.server.network.name.
   5. In the right pane, in place of Custom Variable, select Text and type the domain name for the proxy virtual server.
   6. Click Finished.
      The popup screen closes.
   7. Click Save.
      The properties screen closes. The policy displays.
9. On a policy branch, click the (+) icon to add an item to the policy.
10. On the Assignment tab, select SSO Credential Mapping and click Add Item.
    A properties screen opens.
11. Click Save.
    The properties screen closes and the policy displays.

1. On the Main tab, click Access > Profiles / Policies > Per-Request Policies .
   The Per-Request Policies screen opens.
2. If you are not going to update an existing policy, all you need to do to create a new one is click Create, type a name that is unique among all access profile and per-request policy names, and click Finished.
3. In the Name field, locate the policy that you want to update, then in the Per-Request Policy field, click the Edit link.
   The visual policy editor opens in another tab.
4. Click the (+) icon anywhere in the subroutine to add a new item.
   A small set of actions are provided for building a subroutine.
   A popup screen displays actions on tabs, such as General Purpose and Authentication, and provides a search field.
5. On the General Purpose tab, select SSO Configuration Select and click Add Item.
   A Properties screen displays.
6. From SSO Configuration Name, select a Kerberos SSO configuration.
7. Click the (+) icon anywhere in the per-request policy to add a new item.
8. Click Save.
   The properties screen closes. The visual policy editor displays.
9. Add any additional items you want to the policy.
10. Click the (+) icon anywhere in the per-request policy to add a new item.
11. On the General Purpose tab, select Proxy Select and click Add Item.
    A Properties popup screen opens.
12. From the Pool list, select a pool of one or more proxy servers from which to select the next hop.
    Important: All proxy servers in the pool that you select must support the forward proxy mode that you specify in the Upstream Proxy Mode setting.
13. From Upstream Proxy Mode, select Explicit or Transparent.
14. For Username and Password, most of the time you can retain the default values (blank).
    These fields support the use of static credentials to authenticate the user at the next hop using HTTP Basic authentication.
15. Click Save.
    The properties screen closes. The visual policy editor displays.

Per-request policy that selects SSO before selecting a next hop proxy server

1. Open the Active Directory Users and Computers administrative tool and create a new user account.
   The user account should be dedicated for delegation, and the Password never expires setting enabled.
2. Set the service principal name (SPN) on the Windows server for the user account.
   For the support tools that you can use, and for the commands, such as setspn and ktpass, refer to Microsoft documentation.
   Note: If you use the ktpass command, it sets the SPN on the Windows server and creates a keytab file. APM Kerberos SSO does not need or use a keytab file.
3. Verify the result of setting the SPN.
   This example is purely for illustration. Refer to Microsoft documentation for up-to-date commands and correct usage.

   C:\Users\Administrator> setspn -L apm4

   Registered ServicePrincipalNames for CN=apm4,OU=users,DC=yosemite,DC=lab,DC=dnet,DC=com: HTTP/apm4.yosemite.lab.dnet.com where apm4 is the name of the user account that you created.
4. Return to the Active Directory Users and Computers screen to open your account again.
   A Delegation tab should appear.
5. Click the Delegation tab.
6. Select Trust this user for delegation to specified services only.
7. Select Use any authentication protocol, and add all your services to the list under Services to which this account can present delegated credentials.
   Every service should have Service Type HTTP (or http) and host name of the pool member or web application resource host that you will use in your configuration.
8. Click OK.
   This creates the new delegation account.

1. On the Main tab, click Access > Single Sign-On > Kerberos .
   The Kerberos screen opens.
2. Click Create.
   The New SSO Configuration screen opens.
3. In the Name field, type a name for the SSO configuration.
4. From the Log Setting list, select one of the following options:
   • Select an existing APM log setting.
   • Click Create to create a new log setting.
5. In the Credentials Source area, specify the credentials that you want cached for Single Sign-On.
6. In the Kerberos Realm field, type the name of the realm in uppercase.
   For example, type MY.HOST.LAB.MYNET.COM.
7. In the Account Name field, type the name of the Active Directory account configured for delegation.
   Type the account name in SPN format.
   In this example HTTP/apm4.my.host.lab.mynet.com@MY.HOST.LAB.MYNET.COM, apm4 is the delegation account, apm4.my.host.lab.mynet.com is its fully qualified domain name, and MY.HOST.LAB.MYNET.COM is the realm.
8. In the Account Password and Confirm Account Password fields, type the delegation account password.
9. Required: For Send Authorization, select On 401 Status Code.
10. Click Finished.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. Locate the access profile for the forward proxy configuration you are updating.
   Look in the Profile Type field for SWG-Explicit or SWG-Transparent.
3. In the Per-Session Policy column, click the Edit link.
   The visual policy editor opens the access policy in a separate screen.
4. Click the (+) icon anywhere in the access policy to add a new item.
   Note: Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
   A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
5. On the Logon tab, select HTTP 401 Response and click Add Item.
   A Properties screen opens.
6. From the HTTP Auth Level list, select negotiate and click Save.
   In a transparent forward proxy configuration, APM does not support Kerberos request-based authentication
   The properties screen closes.
7. Click the (+) icon on the negotiate branch.
   A popup screen opens.
8. For Kerberos authentication to work correctly with forward proxy, you must assign the domain name for the forward proxy virtual server to a session variable:
   1. On the Assignment tab, select Variable Assign and click Add Item.
   2. Click Add new entry.
      An empty entry appears in the Assignment table.
   3. Click the change link in the new entry.
      A popup screen opens.
   4. In the left pane, retain the selection of Custom Variable and type this variable name: session.server.network.name.
   5. In the right pane, in place of Custom Variable, select Text and type the domain name for the proxy virtual server.
   6. Click Finished.
      The popup screen closes.
   7. Click Save.
      The properties screen closes. The policy displays.
9. On a policy branch, click the (+) icon to add an item to the policy.
10. On the Assignment tab, select SSO Credential Mapping and click Add Item.
    A properties screen opens.
11. Click Save.
    The properties screen closes and the policy displays.

1. On the Main tab, click Access > Profiles / Policies > Per-Request Policies .
   The Per-Request Policies screen opens.
2. If you are not going to update an existing policy, all you need to do to create a new one is click Create, type a name that is unique among all access profile and per-request policy names, and click Finished.
3. In the Name field, locate the policy that you want to update, then in the Per-Request Policy field, click the Edit link.
   The visual policy editor opens in another tab.
4. Click the (+) icon anywhere in the subroutine to add a new item.
   A small set of actions are provided for building a subroutine.
   A popup screen displays actions on tabs, such as General Purpose and Authentication, and provides a search field.
5. On the General Purpose tab, select SSO Configuration Select and click Add Item.
   A Properties screen displays.
6. From SSO Configuration Name, select a Kerberos SSO configuration.
7. Click the (+) icon anywhere in the per-request policy to add a new item.
8. Click Save.
   The properties screen closes. The visual policy editor displays.
9. Add any additional items you want to the policy.
10. Click the (+) icon anywhere in the per-request policy to add a new item.
11. On the General Purpose tab, select Proxy Select and click Add Item.
    A Properties popup screen opens.
12. From the Pool list, select a pool of one or more proxy servers from which to select the next hop.
    Important: All proxy servers in the pool that you select must support the forward proxy mode that you specify in the Upstream Proxy Mode setting.
13. From Upstream Proxy Mode, select Explicit or Transparent.
14. For Username and Password, most of the time you can retain the default values (blank).
    These fields support the use of static credentials to authenticate the user at the next hop using HTTP Basic authentication.
15. Click Save.
    The properties screen closes. The visual policy editor displays.

Per-request policy that selects SSO before selecting a next hop proxy server

Access Policy Manager^® (APM^®) does not support Kerberos SSO to a resource server for SSL traffic when: the resource server performs Kerberos authentication; and, the next hop proxy server simply passes the Kerberos credential to the resource server without performing Kerberos authentication.

1. On the Main tab, select Local Traffic > Profiles > Other > HTTP Proxy Connect .
2. Click Create.
3. Type a name for the profile and, for the Parent Profile setting, retain http-proxy-connect.
4. In the Settings area, for Default State clear the Enabled check box.
5. Click Finished.

1. On the Main tab, click Local Traffic > Virtual Servers .
   The Virtual Server List screen opens.
2. Click the name of the virtual server you want to modify.
3. In the Configuration area from HTTP Proxy Connect Profile, select a profile that you know to be configured with the Default State setting disabled.
4. Click Update to save the changes.

F5 recommends multiple virtual servers for configurations where Access Policy Manager^® (APM^®) acts as an explicit or transparent forward proxy. This table lists forward proxy configurations, the virtual servers recommended for each, and whether an access profile and per-request policy should be specified on the virtual server.