Application recognition inside http-proxy traffic

[mkopcic]

Hello!

Is it possible to make policy rules for web applications which are inside proxy traffic? In our company proxy is mandatory 😞

I positioned PAN firewall in front of the proxy to see users, but now I don't see which web applications are used. If I put PAN behind the proxy, I'll see applications, but I won't see users.

Workaround may be URL filtering profiles, but that is the last option (if nothing else is possible).

Regards,

Maja

[gafrol · Accepted solution]

Hello Maja,

I think this should be possible by adding x-forwarded-for to your proxy and place the PAN FW after the proxy. This way the PAN gets the real users IP address. Downside , this header will be visible in the destination webservers logfiles. In PAN-OS 4.0 this x-forwarded-for header can be stripped out again.

This document might be useful:

https://live.paloaltonetworks.com/docs/DOC-1128

rgds Roland

[mkopcic]

Thank you for the answer. It is working.

Regards,

Maja

[James]

Hi There,

You should see the applications inside http-proxy app.  If not, then I suggest logging a suport call.

Best Regards

James

[migration]

Hi,

so, I just installed a PAN 2020 between client and proxy.

Can you explain to me how can I see the real application transported inside http-proxy, as in attach?

The placement is:

10.170.184.0/24 ----PAN 2020----PROXY----INTERNET

I'm using 3.1.4 release.

I need to see the apps used.

Any workaround is appreciated.

Thanks in advance

[migration]

Sorry for my post.

Now I can see my apps.

Thanks