topic Reverse Proxy in General Topics

Reverse Proxy

bwilliams2 — Fri, 04 Mar 2011 16:39:13 GMT

Can the PaloAlto do reverse proxy like ISA can?

If I have an internal web server hosting multiple sites how do I publish that through the PaloAlto?

Re: Reverse Proxy

gafrol — Fri, 04 Mar 2011 16:46:25 GMT

As far as I know PAN is not a reverse proxy in terms of a WebApp Firewall. Although it can break up inbound SSL traffic in order to analyze traffic destined for internal webservers. Roland

Re: Reverse Proxy

KGC — Fri, 04 Mar 2011 18:03:51 GMT

I think you could probably rig it up with URL filters and application policies to achieve the same thing ISA does today. But for a basic web server I can't imagine you would need more than a basic NAT policy terminating on the untrust side and a basic security policy to allow web-browsing / ssl to your web server.

Re: Reverse Proxy

jpeadro — Sat, 05 Mar 2011 23:17:48 GMT

@bwilliams2,

I am wondering the same thing. If you come across any articles on configurating PA as a reverse proxy please post them to this thread. I have not seen a config option that would allow inbound URL's to be passed to internal destinations based on the inbound URL request.

i.e.

Internet request to www.website1.com --> Palo Alto --> Web Server 1 - 10.0.0.1

Internet request to www.website2.com --> Palo Alto --> Web Server 2 - 10.0.0.2

Internet request to www.website3.com --> Palo Alto --> Web Server 3 - 10.0.0.3

Thanks,
Jeff

Re: Reverse Proxy

Ryan_Firth — Sun, 06 Mar 2011 05:13:57 GMT

I'm interested in this, as well. We'll have to keep our Cisco ASA online just for its reverse proxy functionality. (WebVPN)

Re: Reverse Proxy

migration — Sun, 06 Mar 2011 14:11:57 GMT

Hi,

ISA not only does a reverse proxy but much more. The "publishing" concept is more complex than a simple NAT. ISA interacts in authentication process, single sing-on, kerberos delegation, AD integration, publishing certificates, etc.

PAN is a firewall ISA is a firewall + publisher for MS infrasctructure.

Regards

Re: Reverse Proxy

bwilliams2 — Tue, 08 Mar 2011 14:52:59 GMT

Per my sales engineer.

" I recall your ISA is doing reverse proxy for one public IP pointing to multiple private IPs. We do not support this configuration."

So in short answer. No.

Thanks for all the responses.

Re: Reverse Proxy

Jonathan_Runyan — Wed, 10 May 2023 19:24:17 GMT

I'm also interested in finding a similar reverse proxy solution. I want to have a single external IP translated to multiple internal IPs based upon URL. Thus I want an external clients to reach my different internal webservers, based by the dns name they are browsing to; with all webservers FQDNs resolving to the same IP address.