topic Re: How PA can replace a Proxy in General Topics

How PA can replace a Proxy

clonesheep — Tue, 28 Jun 2016 12:00:17 GMT

Hi,

i search a easy way to see who is surfing on witch web site. where is it and how can i automatically write it to our file server oder any where else to?

So my dream is to put our proxy out of order.

the PA is connected to LDAP i can see a user but no way for easy seeing with site will be connected to.

Re: How PA can replace a Proxy

Raido_Rattameister — Tue, 28 Jun 2016 12:29:33 GMT

You have to have URL profile added to security policy that matches traffic.

All categories should be at least with "alert" action.

Allow action permits but does not log.

Palo can replace proxy. All you miss is content caching (but nowadays with dynamic websites it is not important) and URL rewrites.

And if you want to export the data then Device > Scheduled Log Export gives you option to export URL filtering log nightly to FTP or SCP server.

Re: How PA can replace a Proxy

Brandon_Wertz — Tue, 28 Jun 2016 13:09:39 GMT

In the stirctest sense the Palo firewall cannot replace a Web Proxy. It can replace a web content filtering service.

Web proxies can perform URL re-writting, among other thing, and are a true MITM that afford significant caching of content. Like Raido has described if all you're wanting to accomplish is WCF replacement the the palo can 100% replace that appliance.

Re: How PA can replace a Proxy

clonesheep — Tue, 28 Jun 2016 13:34:45 GMT

Yes, we dont do re-rwitting or chaching with our proxy so PA can do the Job.

Are there anywhere manuals for the settings or a detailed discription?

Moving the logs sheduled away sounds good.

Re: How PA can replace a Proxy

Brandon_Wertz — Tue, 28 Jun 2016 17:00:19 GMT

@clonesheep This should be what you're looking for:

https://live.paloaltonetworks.com/t5/Learning-Articles/Video-Tutorial-How-to-configure-URL-filtering/ta-p/59300

Essentially you just need:

a URL subscription service and a URL profile applied to the desired security policy. There are tons of other variables though that might needed to be added or tweaked based upon your desired controls.