topic Proxy filtering or paloalto filtering in General Topics

Proxy filtering or paloalto filtering

NetworkGeek — Fri, 07 Apr 2017 18:27:04 GMT

Hi All,

i have proxy in my network which is responsible for all filtering and categorizaing , also i bought a licnese for url filtering on paloalto so, is there any benefit to allow filtering and categoriziang on both ?

or no need for filtering on paloalto since i have proxy

Re: Proxy filtering or paloalto filtering

bradk14 — Fri, 07 Apr 2017 19:31:03 GMT

the question may be do you have need for the proxy? what is it doing that the palo can't do? I don't believe it makes sense to have both performing policy based on URL categorization because unless they're both using bright cloud as a source, there's a good chance they won't always agree and that may cause confusion.

Re: Proxy filtering or paloalto filtering

BPry — Fri, 07 Apr 2017 20:36:24 GMT

From my experiance nothing that I've used a proxy for in the past couldn't be accomplished with the Palo Alto besides...the ability to limit users to 'x' amount of time on a category or specific website. Keeping an existing proxy and utilizing the PA URL filtering and categorization would simply add complexity in troubleshooting any issues.

Re: Proxy filtering or paloalto filtering

bradk14 — Fri, 07 Apr 2017 21:07:23 GMT

also what I should have noted before, is if you do have a proxy in front of the palo alto, unless you enable X-Forward-For support on the proxy, the Palo will see the Proxy's IP as the source for all traffic which can lead to additional confusion/headaches, especially when it comes to content-id. If you enable XFF, the PA will use the original client's IP in the logs. Just be sure to enable stripping the XFF in the content ID setup otherwise it can/will leak corporate IPs to the internet, which may or may not be a concern.

Re: Proxy filtering or paloalto filtering

Raido_Rattameister — Sat, 08 Apr 2017 00:06:06 GMT

Unless you need caching or URL rewriting you can usually remove proxy.