topic Re: is it possible to forward clients with paloalto for websense ? in General Topics

is it possible to forward clients with paloalto for websense ?

Retired Member — Thu, 25 Sep 2014 07:54:49 GMT

Hi all,

There is a topology like below.Clients using Cisco vpn and they are enforced to use some proxies(enforced from Active Directory)

There is a Local Websense but it cannot be used because of that enforcement.

Can Paloalto firewall decrypt that SSL traffic and make websense available to use ?

is that possible ?

Cisco Any Connect Client--------------(No PAloalto at this time ,bu will be here) -------------------------INTERNET------------------------Cisco ASA

Websense

Re: is it possible to forward clients with paloalto for websense ?

reaper — Thu, 25 Sep 2014 08:28:27 GMT

A Palo Alto Firewall would be able to decrypt the tunnel if it is ssl based and perform URL filtering with our built-in URL filtering, but this cannot be achieved with a 3rd party URL filtering solution.

We do have a feature called "decryption port mirror" which allows you to export decrypted data which you could get analysed by a 3rd party URL filtering solution, but only for logging purposes

How to Configure a Decrypt Mirror Port on PAN-OS 6.0

Re: is it possible to forward clients with paloalto for websense ?

Retired Member — Thu, 25 Sep 2014 13:27:23 GMT

Thanks but the thing is we need to forward decrytped data and get back it to PAN to forward.I think this will not be possible as I see.

Re: is it possible to forward clients with paloalto for websense ?

hshah — Thu, 25 Sep 2014 17:29:30 GMT

Hi PAN-OS,

This feature is just like SPAN in Cisco world. But you can say its decrypt-SPAN.

So you get the information, but can not take any action on it. So, its not possible to force websense to take any action on decrypted data.

Let me know if this helps.

Regards,

Hardik Shah