Palo Alto PA-3220 replace Bluecoat Proxy

[deecheung]

Hi Guys,

Does anyone tried to use PA-3220 model as proxy server? Currently the internet traffic of my company is using bluecoat proxy with pac file (config in windows proxy setting), and the proxy also inline with sourcefire for doing SSL interception, IPS/IDS. I'm investigating can this model replace the bluecoat proxy. 

Can I define the PAC to point to PA-3220 and forward the traffic to next hop?

[BPry]

@deecheung,

The PA-3220 itself can do SSL inspection and IPS/IDS functionality without any need to have it defined on the host as a proxy. I'd recommend really looking at the capabilities and environment as a whole and seeing if you actually still need this setup. 

[deecheung]

@BPry Thanks for the reply. Yes, I indeed need to use PAC as per global design since we have couple of proxy and the pac defined on the host is use for routing different website to different proxy. So my question is can this model run as explicit proxy?

[aleksandar.astardzhiev · Accepted solution]

Hi @deecheung ,

Unfortunately no, PAN FW cannot be used as explicit proxy. This topic has been discussed couple of times throughout the years, and if I remember correctly someone mentioned that Palo Alto doesn't event consider adding such functionality.