topic Re: Palo Alto Explicit Proxy Traffic Issue in Next-Generation Firewall Discussions

Palo Alto Explicit Proxy Traffic Issue

Kalpesh2025 — Thu, 14 Nov 2024 10:05:54 GMT

Hello Team,

We have configured the Palo Alto firewall as an Explicit Proxy using Kerberos authentication in alignment with the Admin Guide. However, we’re noticing that the designated traffic is not routing through the Proxy as expected and is failing to initiate from the Proxy-Zone to the Internet-Zone.

When attempting to access a webpage from a user’s device, we’re encountering the following error: "upstream connect error or disconnect/reset before headers, reset reason: connection failure."

Could someone provide guidance on troubleshooting this issue? Insights on potential configuration aspects or logs to review would be greatly appreciated.

Thanks

Re: Palo Alto Explicit Proxy Traffic Issue

Rando000100 — Thu, 14 Nov 2024 16:14:57 GMT

I'm literally setting this up for a client now, first time!

I have the same issues as you've seen. I expect the interfaces for the proxy all need to be in a dedicated VR with the default route routing via the 'external' proxy network (therefore forcing it out of that interface/zone).

Re: Palo Alto Explicit Proxy Traffic Issue

Kalpesh2025 — Sun, 17 Nov 2024 04:32:09 GMT

Hello,

As per the documentation, the interfaces should be within the same virtual routers and the same virtual systems.

Do update, if you were able to make it work.

Re: Palo Alto Explicit Proxy Traffic Issue

shawn.norman — Mon, 06 Jan 2025 21:07:38 GMT

Did you ever figure this out? I am having the same issue.

Re: Palo Alto Explicit Proxy Traffic Issue

GauravRajpal — Thu, 30 Jan 2025 05:32:53 GMT

Anything on this -- observing the same

Re: Palo Alto Explicit Proxy Traffic Issue

Parsek — Wed, 23 Apr 2025 14:47:53 GMT

Guys, please share your solution to the problem if you have one.

Re: Palo Alto Explicit Proxy Traffic Issue

DBalasa — Thu, 29 May 2025 12:39:51 GMT

Hi Kalpesh,

I'm also trying to configure it on the Palo Alto firewall and I am struggling with the config: did you use a loopback interface for the incoming traffic or you used an external interface you have configured on the firewall? Also, for the DNS proxy config, have you selected your external interface/loopback or the internal? I have read different articles and everyone has their own of doing it.

Re: Palo Alto Explicit Proxy Traffic Issue

Kalpesh2025 — Thu, 29 May 2025 12:53:08 GMT

We used the steps mentioned in below document from palo alto:

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-networking-admin/dns/configure-a-web-proxy/configure-explicit-proxy

Recalling, we had run below powershell command, to invoke a web request and to authenticate the same and it trigerred to resolve the issue,

Basic Proxy Usage:
$proxy = "http://proxyserver:8080"
$response = Invoke-WebRequest -Uri "http://example.com" -Proxy $proxy
Write-Output $response.Content

Proxy with Credentials:
$proxy = "http://proxyserver:8080"
$proxyCredentials = Get-Credential
$response = Invoke-WebRequest -Uri "http://example.com" -Proxy $proxy -ProxyCredential $proxyCredentials
Write-Output $response.Content

Hope it helps!

Re: Palo Alto Explicit Proxy Traffic Issue

DBalasa — Thu, 29 May 2025 16:03:11 GMT

Thank you for this. I am following the same article you shared, however I am struggling with these bits:

Create a security policy rule to allow traffic from the client to the interface you selected as the listening interface.
Configure a security policy rule to allow traffic from the zone that contains the upstream interface to the internet.
Configure a security policy rule to allow traffic from the DNS proxy zone to the internet.

For me, based on the doc, the upstream interface and the DNS proxy zone interface are the same: loopback 1. The confusing bit is that I thought the loopback interface should be only used for DNS resolution and incoming traffic from the Internet.