topic Re: PA5020 and Proxy Server in General Topics

PA5020 and Proxy Server

aguley — Wed, 23 Jul 2014 12:18:33 GMT

I have a PA5020 and am using a proxy server to filter internet traffic. In the traffic monitor all the traffic I see going to the web is from the proxy server. I turned this feature on on the firewall. Enabling support for the X-Forwarded-For HTTP header. After enabling this feature I didn't see any difference in the monitor section of the firewall.

Is there anyway I can identify the user or IP address instead of just identifying the proxy server.

Thanks

Re: PA5020 and Proxy Server

kadak — Wed, 23 Jul 2014 13:54:17 GMT

Hello aguley,

I went through Enabling support for the X-Forwarded-For HTTP header. document and didn't see the commit operation mentioned.

If you have enabled it from the configuration mode, lets make sure you commit the configuration:

> configure

# set deviceconfig setting ctd x-forwarded-for yes

#commit force

Regards,

Kunal Adak

Re: PA5020 and Proxy Server

aguley — Wed, 23 Jul 2014 14:22:23 GMT

That's the command that I ran and I commited the changes as well. Still just seeing traffic from proxy. Or possibly I am looking in the wrong place. Should I just see it in the monitor section of the firewall or do I need to dig deeper into some logs?

Thanks

Re: PA5020 and Proxy Server

kadak — Wed, 23 Jul 2014 14:28:42 GMT

Hello aguley,

I hope you are looking into URL logs for X-forwarded information - not the traffic logs.

Reference:

x-forward source user information is not showing in traffic logs

Hope that helps!

Thanks and regards,

Kunal Adak

Re: PA5020 and Proxy Server

aguley — Wed, 23 Jul 2014 14:31:25 GMT

I am looking at the traffic logs. I am getting an error trying to click on your link saying access is restircted. How do I view the URL logs for X-forwarded information?

I am very new to PA so thank you for the very quick responses.

Re: PA5020 and Proxy Server

kadak — Wed, 23 Jul 2014 14:41:26 GMT

Hello aguley,

Under Monitor tab, click on URL filtering logs. Under URL filtering logs, you need to have the 'source user' column. If it doesn't have by default, then you can add the column.

Or you can enable it :

Thanks and regards,

Kunal Adak

Re: PA5020 and Proxy Server

aguley — Wed, 23 Jul 2014 15:07:53 GMT

We are not using the PA url filtering. We are filtering with our proxy. Should I still see the traffic in the URL Filtering of the PA. I am not seeing anything currently in it.

Re: PA5020 and Proxy Server

kadak — Wed, 23 Jul 2014 15:44:09 GMT

Hello aguley,

Since you don't have URL filtering license, I presume you don't have URL filtering profile applied to any of your security policies. If you don't have URL filtering profiles applied to security policies, then you won't see URL filtering logs.

Thanks and regards,

Kunal Adak