External Web Proxy

chens — Mon, 28 Apr 2025 06:49:19 GMT

Hi.

Have someone working with next hop fwd proxy ?

I need post firewall solution for additional files types blocks (like Trellix)

Re: External Web Proxy

OtakarKlier — Mon, 28 Apr 2025 16:58:44 GMT

Hello,

Would you mind elaborating on your question?

Regards,

Re: External Web Proxy

chens — Tue, 29 Apr 2025 13:42:26 GMT

i am forwarding (BPF) to SkyHigh Web Gateway (on-prem),

SkyHigh Web Gateway has a wonderful solution for identifying (and block) dozens of file-mimes (unlike the short list of Palo Alto file types).

https://success.skyhighsecurity.com/Skyhigh_Secure_Web_Gateway_(On-Prem)/Secure_Web_Gateway_Product_Guide/Media_Type_Filtering/Supported_Media_Types/Secure_Web_Gateway_(SWG)_Supported_MIME_Types

My plan is to to use Palo Alto (as default gateway) content inspection (TP and WF and all the protection modules), and then forward to SkyHigh (2nd hop)

SkyHigh Proxy is listening on port 9090, and gets the traffic.

Both PA and SkyHigh (and clients) using same SSL certificate.

The issue is that the SkyHigh doesn't like the new SSL re-encryption from Palo Alto (1st hop).

Seems like the SSL content inspection doesn't work when traffic comes not directly from clients (SSL is being handled by Palo Alto as MITM)

Ideas?

topic Re: External Web Proxy in General Topics

External Web Proxy

Re: External Web Proxy

Re: External Web Proxy