Systems Management

I think the KACE agent used the webserver name to connect to the SMA, so you need to make sure that your network routing will resolve the webserver name to the IP address of your SMA. So for example I installed my KACE agent using the IP address of the SMA, however the webserver took over and the agent connects in as direct by the various DNS services that are in place.

well, create the correct routing in your network environment.
Its the basics.

Always keep in mind, that the amp.conf is updated with the webservername under network settings, so you need to make sure, they can reach this target over your route.

the kace agent does not support a transparent web proxy in any way! 

it does not get the proxy informations from internet settings and has no own proxy settings.

you need to exclude the agent traffic (HTTPS / TCP 443) from client to kace SMA (internet or S2S VPN Tunnel) from being proxied.

the easiest way to solve this would be to exclude any traffic to the destination "CloudSMA" from your proxy.

it is known that the Sophos UTM WebProtection / WebFilter proxy can cause issues. Agents not connecting, agents showing wrong IP adresses, agents connecting but not updating inventory, agents connected and doing inventory but not receiving commands like script executions or patching schedules if "Run Now" button was used.

The agent and the SMA are very angry if you touch their SSL certificates they use for communicating with eachother. You could only overcome this issue if you set your own certificate in the SMA Agent settings (is it still possible to be configured in v11?), that is the same certificate on your WebProxy and the SMA. So your Proxy can break HTTPS, look into it, and close it again with the same certificate the agent used initially and the kace SMA is expecting.

If you break or inspect the agents SSL certificate you will get lots of SSL certificate errors on your SMA agent log.