topic Re: policy based forwarding to proxy in General Topics

policy based forwarding to proxy

dieter_b — Tue, 26 Apr 2011 14:22:14 GMT

We use ntlm (CP) to authenticate our users against the PA.

We want any http traffic forwarded to a proxy. The proxy would have http access to the internet through the PA. I was thinking of using a policy based forwarding rule to forward service-http to the proxy. Similar to how e.g. a Cisco router can intercept http traffic and forward it to a proxy using the WCCP protocol (or any other implementation of the same).

This way all authentication and traffic logging stays on the PA, easier to monitor...

But will it work ? In which order are rulesets processed ? For it to work, it would have to process the CP ntlm authentication rule before the PBF rule. Is that the case ? If not, can I set a processing order for rulesets ?

Re: policy based forwarding to proxy

skrall — Fri, 06 May 2011 18:14:54 GMT

I am attaching a slide from our documentation literature. If this fails to answer your question you probably need to open a case with Support.

You can use these commands to see which policy is processing traffic.

show session all filter source <ip_addr>

show session id xxxxx

xxxxx = the ID number shown by the first command.

Steve Krall

Re: policy based forwarding to proxy

dieter_b — Tue, 03 Apr 2012 11:15:37 GMT

Picking up an old thread... have'nt had the chance to try or implement yet.

Seems like your attachment went missing. Can you get it back for me, please ?

Re: policy based forwarding to proxy

sjamaluddin — Thu, 05 Apr 2012 18:30:21 GMT

Your CP authentication should take place first

Policy Based forwarding takes precedence over whatever is in your routing

If you'd like to foward all your https/ http traffic over to a proxy outside of the PAN FW, then you should be able to enable UserID (via CP) and then route to the Proxy Server via the PBF

https://live.paloaltonetworks.com/docs/DOC-1628

Hope this helps.

Re: policy based forwarding to proxy

dieter_b — Fri, 06 Apr 2012 06:32:07 GMT

Thank you, exactly the answer and document I was looking for.