Confirm Readiness Before Install
Most failed SafeSquid pilots are caused by missing prerequisites: wrong sizing, blocked proxy ports, no DNS or NTP, no activation key, or no plan for Root CA deployment. Every one of them is cheaper to fix now than during the cutover window. Work this checklist to completion before starting any installer.Site survey checklist
Site survey checklist
Capture the current egress path before selecting a SafeSquid design:
- Internet circuits, firewalls, NAT devices, and cloud egress points.
- User networks, server networks, guest networks, VPN users, and remote branches.
- Existing proxy, PAC, WPAD, DNS, and browser-management policies.
- Authentication sources, group naming, privileged-user exceptions, and service accounts.
- Internal destinations that must bypass proxy inspection.
- Current log destinations, SIEM ownership, and incident-retention requirements.
- Registered email on the Self-Service Portal.
- C-Code, required for license generation.
- Activation key, downloaded to the administrator workstation.
- Root CA certificate decision: self-signed or enterprise-issued, for HTTPS inspection.
- Proxy hostname or FQDN, for example
proxy.example.com. - Proxy IP address and CIDR, for example
10.200.5.100/24. - Default gateway address.
- Primary and secondary DNS servers.
- AD or LDAP server IP address or FQDN.
- Bind account in UPN format, with its password held under approved credential handling.
- Base DN, for example
dc=example,dc=com. - LDAP domain name.
Validate platform readiness
Confirm:- CPU, RAM, disk, and NIC allocation match the sizing plan from Sizing.
- Storage can handle access logs, reports, support bundles, and update files.
- The host has a stable hostname and static IP address.
- Administrative access is available through an approved management path.
- Backup, snapshot, or rebuild procedure is documented.
Validate network readiness
Confirm:- DNS resolution works from the SafeSquid host network.
- NTP is reachable and synchronized.
- The approved proxy listener port is open only to intended client networks.
- Outbound access exists for activation, updates, category data, and subscription checks.
- The management path is restricted to approved administrators.
Mandatory access controls: SELinux and AppArmor
Mandatory access controls: SELinux and AppArmor
SELinux or AppArmor in enforcing mode can block proxy operations during initial setup, and the failure presents as unexplained permission errors rather than a clear policy denial.Set permissive mode for the setup window, or author a policy that covers SafeSquid before you start:Expected result: the current mode is known and recorded before installation begins.Once the deployment is operational, review the audit log and write a targeted policy rather than leaving mandatory access control permanently disabled. Record which choice was made and who owns the follow-up; “temporarily permissive” that is never revisited is a finding waiting to happen.
Firewall ports to open
Firewall ports to open
Agree these rules with the network owner before installation. Each has a named source scope; none should be opened to
0.0.0.0/0.Inbound to the SafeSquid hostOutbound from the SafeSquid host
The specific licensing, update, and categorization hosts that must be reachable on 80 and 443 are listed in Deployment Planning and Activate Your License.
Mandatory access controls: SELinux and AppArmor
Mandatory access controls: SELinux and AppArmor
SELinux or AppArmor in enforcing mode can block proxy operations during initial setup, and the failure presents as unexplained permission errors rather than a clear policy denial.Set permissive mode for the setup window, or author a policy that covers SafeSquid before you start:Expected result: the current mode is known and recorded before installation begins.Once the deployment is operational, review the audit log and write a targeted policy rather than leaving mandatory access control permanently disabled. Record which choice was made and who owns the follow-up; “temporarily permissive” that is never revisited is a finding waiting to happen.
Validate identity and trust
Confirm:- Activation key is available from Register and Get Your Key.
- Root CA rollout owner is assigned for HTTPS inspection.
- Authentication source is known if user-based policy will be enabled.
- Log-retention owner is assigned. See Log-Retention Planning.
- Change and rollback owners are named.
Verify readiness
Run these checks before installation:- DNS and NTP are reachable from the SafeSquid host network.
- Firewall rules allow required outbound update and subscription paths.
- Proxy listener ports are approved.
- Root CA deployment owner is assigned.
- Rollback owners exist for routing, PAC, GPO, MDM, and firewall changes.
Choose the install method
1
Choose a new appliance
New appliance
Use SafeSquid Appliance Builder for a new VM or hardware appliance with a dedicated target disk.
2
Choose cloud or hybrid egress
Cloud or hybrid egress
Use cloud deployment when security groups, route tables, snapshots, and egress paths are controlled.
3
Choose a managed Linux host
Managed Linux host
Use Linux Server Install only when OS lifecycle, dependencies, monitoring, and rollback are owned.
Verify prerequisite evidence
Store:- Host resource allocation.
- Static IP and DNS record.
- NTP source.
- Firewall approval.
- Activation key storage reference.
- Root CA rollout owner.
- Log retention target.
- Rollback plan.
Troubleshoot readiness failures
Next steps
- SafeSquid Appliance Builder - install the standard appliance.
- Cloud Deployment - deploy in a cloud network.
- Linux Server Install - install on an existing Linux host.