External Web Proxy

[chens]

Hi.

Have someone working with next hop fwd proxy ? 

I need post firewall solution for additional files types blocks (like Trellix)

[OtakarKlier]

Hello,

Would you mind elaborating on your question?

Regards,

[chens]

i am forwarding (BPF) to SkyHigh Web Gateway (on-prem),

SkyHigh Web Gateway has a wonderful solution for identifying (and block) dozens of file-mimes (unlike the short list of Palo Alto file types).

https://success.skyhighsecurity.com/Skyhigh_Secure_Web_Gateway_(On-Prem)/Secure_Web_Gateway_Product_...

My plan is to to use Palo Alto (as default gateway) content inspection (TP and WF and all the protection modules), and then forward to SkyHigh (2nd hop)

SkyHigh Proxy is listening on port 9090, and gets the traffic.

Both PA and SkyHigh (and clients) using same SSL certificate.

The issue is that the SkyHigh doesn't like the new SSL re-encryption from Palo Alto (1st hop).

Seems like the SSL content inspection doesn't work when traffic comes not directly from clients (SSL is being handled by Palo Alto as MITM)

Ideas?

[LoganSmith]

To configure an external web proxy on Palo Alto Networks, choose explicit or transparent mode. Explicit requires client setup, while transparent intercepts traffic.