topic Re: Pan vs proxy??? in General Topics

Pan vs proxy???

dat.tran — Fri, 21 Sep 2012 09:43:12 GMT

Hi all!

I am newer and I meet some problems with PA 2050

I want use PA 2050 to monitor traffic in my network.

I setup PAN in Mode Layer 1 ( virtual wire)

I setup Polices is aler ( not block - i sure it)

I have a proxy, client can access internet through Proxy or not, all ok!

But after i put PAN, client can't not access internet through Proxy,

but if client doesn't user proxy, it will ok!!!

Something wrong?

Pls helpme!

thanks

Re: Pan vs proxy???

dat.tran — Fri, 21 Sep 2012 10:02:53 GMT

i just remeber.

Client and proxy on two diffirent subnet?

and not not config tag allow?

Maybe it is cause?

( now i can't reconfig to check )

Re: Pan vs proxy???

npare — Fri, 21 Sep 2012 17:50:24 GMT

This is what I would recommend you do first.

1. Security rules.

The firewall needs to allow the LAN access to the proxy on the port they are configured to use. Most companies use port 8080 but it might be different for you. If it's the case, a rule should be in place to allow the entire LAN to communicate to the proxy's IP address only on port 8080. Remember that if an explicit proxy is configured, workstations won't even perform DNS queries, the proxy will.

Another security rule needs to be in place to allow access from the proxy. The proxy will need access to the internet on ports 80, 443, and also DNS services (probably others too like NTP but that will depend on the proxy)

2. Address translation rules.

Without knowing a lot on the network, it is hard for me to provide an exact answer but in most cases, this is how NAT is configured

- When the LAN access the proxy's IP address, no address translation is configured. This allows the proxy to see the real IP address of the workstation instead of all connections coming from the firewall

- When the Proxy access the internet, address translation needs to happen. In most cases a one to one rule is created (one public IP address dedicated to the proxy's internal IP)