PA-500 problem with ISA Proxy Server

adeldurakovic — Thu, 11 Nov 2010 15:26:27 GMT

Dear,

We have the question concerning using Palo Alto with Microsoft ISA Server.We have implementation of a Palo Alto in the network where Microsoft ISA Server is used as proxy (8080 port). We installed PA in network as Virtual Wire so we don't disturb their current infrastructure. In Monitor we could only se users going to the proxy as the Destination, and proxy as a Source when going outside. We couldn't use filtering by users also ( they have Microsoft's Active Directory). Is there a way we could use PA in the inviroment where ISA is used as Proxy?

Re: PA-500 problem with ISA Proxy Server

blacksan — Thu, 11 Nov 2010 15:38:07 GMT

Not a big fan of this because it shows your real IP Address on the Internet but you can turn on X-Forward Header on the ISA Server and PA-500.

ISA does not perform this function without a plug-in from Winfrasoft or Trustlist.

You will need to CLI into the PA-500 and perform the following:

set deviceconfig setting ctd x-forwarded-for yes

Just make sure the ISA is sending the X-Forward in the correct format: X-Forwarded-For: client1, proxy1, proxy2

topic PA-500 problem with ISA Proxy Server in General Topics

PA-500 problem with ISA Proxy Server

Re: PA-500 problem with ISA Proxy Server