topic Proxy Authentication in General Topics

Proxy Authentication

ASCIT — Mon, 22 Dec 2014 03:59:57 GMT

I've configured my 3020 for external access via a proxy server. The connection fails when checking for software updates with a generic communication error.

The proxy server shows the connected account as 'anonymous' even though a username is configured (verified with 'show deviceconfig system').

Does the PA support NTLM proxy authentication?

Re: Proxy Authentication

Dz3015 — Mon, 22 Dec 2014 16:21:35 GMT

you used the "secure-proxy-" commands?

Re: Proxy Authentication

Satish — Mon, 22 Dec 2014 16:55:03 GMT

Hi Ascit,

if you are using data panel for Update than you should configure service route for that. source and destination address.(under device tab )

Regards

Satish

Re: Proxy Authentication

pulukas — Mon, 22 Dec 2014 21:00:24 GMT

For windows authentication try the user names in these formats:

domain\username

username@domain.local --- Check the AD properties of the user for which unc name is used on the service account

Re: Proxy Authentication

ASCIT — Mon, 22 Dec 2014 22:13:11 GMT

Yes the following commands have been configured.

secure-proxy-server

secure-proxy-port

secure-proxy-user

secure-proxy-password

Re: Proxy Authentication

ASCIT — Mon, 22 Dec 2014 22:14:46 GMT

I'm just using the management interface which is the default service route for all services. I've also manually configured this interface for the proxy service.

Re: Proxy Authentication

ASCIT — Mon, 22 Dec 2014 22:32:08 GMT

I've tried a combination of domain\user, domain/user, user@domain and mixed up the cases but the user is still appearing on the proxy as 'anonymous'.

FYI I am running PAN-OS 6.1.0

Re: Proxy Authentication

ASCIT — Wed, 07 Jan 2015 02:29:27 GMT

Just following up after PA Support got back to me, PAN-OS only supports Basic Proxy Authentication for its service updates via a Proxy.

Re: Proxy Authentication

pulukas — Wed, 07 Jan 2015 22:40:19 GMT

Thanks for the follow up. This is bad news as the basic authentication encryption has been long since compromised. Make sure the account you use here is a service account with the minimum AD permissions.