topic Re: Palo Alto PA-3220 replace Bluecoat Proxy in General Topics

Palo Alto PA-3220 replace Bluecoat Proxy

deecheung — Wed, 18 May 2022 09:51:37 GMT

Hi Guys,

Does anyone tried to use PA-3220 model as proxy server? Currently the internet traffic of my company is using bluecoat proxy with pac file (config in windows proxy setting), and the proxy also inline with sourcefire for doing SSL interception, IPS/IDS. I'm investigating can this model replace the bluecoat proxy.

Can I define the PAC to point to PA-3220 and forward the traffic to next hop?

Re: Palo Alto PA-3220 replace Bluecoat Proxy

BPry — Wed, 18 May 2022 21:51:59 GMT

@deecheung,

The PA-3220 itself can do SSL inspection and IPS/IDS functionality without any need to have it defined on the host as a proxy. I'd recommend really looking at the capabilities and environment as a whole and seeing if you actually still need this setup.

Re: Palo Alto PA-3220 replace Bluecoat Proxy

deecheung — Thu, 19 May 2022 05:41:18 GMT

@BPry Thanks for the reply. Yes, I indeed need to use PAC as per global design since we have couple of proxy and the pac defined on the host is use for routing different website to different proxy. So my question is can this model run as explicit proxy?

Re: Palo Alto PA-3220 replace Bluecoat Proxy

aleksandar.astardzhiev — Thu, 19 May 2022 06:35:31 GMT

Hi @deecheung ,

Unfortunately no, PAN FW cannot be used as explicit proxy. This topic has been discussed couple of times throughout the years, and if I remember correctly someone mentioned that Palo Alto doesn't event consider adding such functionality.