How PA can replace a Proxy

[clonesheep]

Hi,

i search a easy way to see who is surfing on witch web site. where is it and how can i automatically write it to our file server oder any where else to?

So my dream is to put our proxy out of order.

the PA is connected to LDAP i can see a user but no way for easy seeing with site will be connected to.

[Raido_Rattameister]

You have to have URL profile added to security policy that matches traffic.

All categories should be at least with "alert" action.

Allow action permits but does not log.

Palo can replace proxy. All you miss is content caching (but nowadays with dynamic websites it is not important) and URL rewrites.

And if you want to export the data then Device > Scheduled Log Export gives you option to export URL filtering log nightly to FTP or SCP server.

[Brandon_Wertz]

In the stirctest sense the Palo firewall cannot replace a Web Proxy.  It can replace a web content filtering service.

Web proxies can perform URL re-writting, among other thing, and are a true MITM that afford significant caching of content.  Like Raido has described if all you're wanting to accomplish is WCF replacement the the palo can 100% replace that appliance.

[clonesheep]

Yes, we dont do re-rwitting or chaching with our proxy so PA can do the Job.

Are there anywhere manuals for the settings or a detailed discription?

Moving the logs sheduled away sounds good.

[Brandon_Wertz]

@clonesheep This should be what you're looking for:


https://live.paloaltonetworks.com/t5/Learning-Articles/Video-Tutorial-How-to-configure-URL-filtering...

Essentially you just need:

a URL subscription service and a URL profile applied to the desired security policy.  There are tons of other variables though that might needed to be added or tweaked based upon your desired controls.