Does paloalto FW supports proxy protocol

Eccom-puji — Mon, 26 May 2025 08:16:56 GMT

Hello, everyone, I'm new to PA, I want to know if PA supports proxy protocol v1 or v2? We need to parse the traffic from nginx. Thanks!

Re: Does paloalto FW supports proxy protocol

kiwi — Mon, 26 May 2025 15:33:17 GMT

As far as I know PAN does not support proxy protocol.

There are Feature Requests that you can add your vote to via your local SE: (NSFR-I-27584 - Enable Support for Proxy Support v1/v2).

Instead, Palo Alto Networks supports the X-Forwarded-For (XFF) header for identifying original client IPs in HTTP traffic. This is commonly used in proxy and load balancer scenarios where the client IP needs to be preserved. You'll need to configure your upstream device to insert the XFF header, and then set up the firewall to extract and use it for user identification or logging:
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/identify-users-connected-through-a-proxy-server/use-xff-values-for-ip-based-security-policy-and-logging

Hope this helps,

-Kim.