how can i create a PBF rule to send traffic to a http/https proxy?

[ptingalls]

when i'm trying to set up the rule, where the next hop is the IP of the proxy - i get an error that this IP "does not match subnets defined on the PBF interface" - which is correct, it's on different subnet. What are my options? Do i have to have the proxy on the same subnet as the interface?

[TomYoung · Accepted solution]

Hi @ptingalls ,

Yes, the proxy has to be on the same subnet as the interface.  The NGFW will not change the IP header of the original packet.  So, it cannot be routed over the network.  It must be forwarded to the proxy MAC address.

One way to get around that limitation is with a GRE tunnel if the web proxy supports it.  Here is a doc for PBF with GRE for Netskope.  https://docs.netskope.com/en/netskope-help/integrations-439794/ipsec-and-gre/netskope-gre-with-palo-...

If the web proxy does not support GRE, then you will need to extend the VLAN to the NGFW.  I could be wrong, but I think those are your only 2 options.

Thanks,

Tom