is it possible to forward clients with paloalto for websense ?

[panos]

Hi all,

There is a topology like below.Clients using Cisco vpn and they are enforced to use some proxies(enforced from Active Directory)

There is a Local Websense but it cannot be used because of that enforcement.

Can Paloalto firewall decrypt that SSL traffic and make websense available to use ?

is that possible ?

Cisco Any Connect Client--------------(No PAloalto at this time ,bu will be here) -------------------------INTERNET------------------------Cisco ASA

                                                    |

                                                    |

                                             Websense

[reaper]

Hi

A Palo Alto Firewall would be able to decrypt the tunnel if it is ssl based and perform URL filtering with our built-in URL filtering, but this cannot be achieved with a 3rd party URL filtering solution.

We do have a feature called "decryption port mirror" which allows you to export decrypted data which you could get analysed by a 3rd party URL filtering solution, but only for logging purposes

How to Configure a Decrypt Mirror Port on PAN-OS 6.0

[panos]

Thanks but the thing is we need to forward decrytped data and get back it to PAN to forward.I think this will not be possible as I see.

[hshah]

Hi PAN-OS,

This feature is just like SPAN in Cisco world. But you can say its decrypt-SPAN.

So you get the information, but can not take any action on it. So, its not possible to force websense to take any action on decrypted data.

Let me know if this helps.

Regards,

Hardik Shah