topic Migrating existing Explict proxy to Palo alto Transparent Proxy in GlobalProtect Discussions

Migrating existing Explict proxy to Palo alto Transparent Proxy

praveen.dharmaraj — Tue, 09 Sep 2025 06:08:30 GMT

HI ,

We want to migrate existing legacy Explicit proxy to palo alto in transparent proxy mode , we have palo alto with panorama , all the branches using legacy explicit proxy , Legacy Explicit proxy device in HQ and all the branch traffic is redirecting to explicit proxy.

we want to remove explicit proxy .

Is it possible using Global Protect we can redirect all the web traffic from branches to HQ palo alto in transparent proxy mode ?

Re: Migrating existing Explict proxy to Palo alto Transparent Proxy

JustinWoodman — Tue, 09 Sep 2025 13:45:19 GMT

Not exactly enough information for me to understand what you are asking for. But transparent proxy means all your internal routes to the internet, run through the palo device, regardless. Basically the default method most edge firewalls operate in. Explicit proxy basically means without the explicit proxy setup, traffic is going some different way to the internet, potentially. Can you do this transparent proxy with gp, yes, but not all devices support gp, like multi-function printers, guest wifi networks. You would want gp in a always connected method. Internet is used broad here, it could mean just the real internet, but could also include internal sites as well, that need more security.

You could also do this with mpls, sdwan or ipsec tunnels, and have all the internal networks setup with default routes that end them up at the palo alto. The far end devices don't even have to be palo devices to do this, they just have traffic end up at the hq palo device.

Re: Migrating existing Explict proxy to Palo alto Transparent Proxy

praveen.dharmaraj — Thu, 11 Sep 2025 11:03:29 GMT

Hi ,

Thank you , solution which we are looking only for the laptop /desktop . branches instead of using explicit proxy we want to use transparent proxy using global protect . now all the sites are interconnected using fortigate sdwan solution . only interested traffic is reaching to HQ . palo alto firewall is poisoned as perimeter firewall in HQ .

is there is any way we can use Global Protect to redirect traffic (Http+Https) from the branches to HQ in-order to remove explicit proxy architecture .