PA SSL decryption for web traffic and squid

[Alex_Samad]

Hi

Where should I be doing the decryption

client -> pa (l3) -> squid -> internet

or

client -> squid -> pa (l3) -> internet

I thinking the first one, then I can also see who is making the request 

A

[Remo]

The problem with on the suggested solution is that palo then only sees http-proxy traffic and nothing else - no url logs and decryption isnt'possible this way.

So you have to use your second possibility.

[Alex_Samad]

Hi

I'm already doing 1 but with out decrypt and it works fine, it looks into the info and knows its in tunnel mode.

[Remo]

So you have url logs or only the app http-proxy in the traffic log with the username?

[Alex_Samad]

Hi

With what i have right now, which is no decryption i see and can filter on application type so google-mail , facebook chat, it looks inside the traffic.

My policy is basically

any work ip -> to my proxy server ip and port 3128 or 8080 as the service ports, with application set to general internat. I have had to add things as some sites are not under general internet.

I can also who is the user logged into the client pc.

[Remo]

Ok, in this case I have to thank you for teaching me something new.

Till your post I thought the way to do this in combination with a proxy is 

Client --> proxy --> palo

And then use the x-forwarded-for http header to identify the user on the firewall

As described here: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/policy/identify-users-connected-thro...

[Alex_Samad]

Interesting, but I seem to get all that by doing it before. Plus I don't have the XFF value setup ..

Alex

[Remo]

Hi Alex

If you already have this setup, it should be pretty easy to test if this now also works with decryption (I am also interessted in your results, even if I don't like these traditional proxy servers 😛  )

Edit: Removed sensless sentence

[Alex_Samad]

I'm not running the proxies in transparent mode.

and I want all traffic going to proxy for outbound traffic