Pan vs proxy???

cancel
Showing results for 
Search instead for 
Did you mean: 

Pan vs proxy???

L2 Linker

Hi all!

I am newer and I meet some problems with PA 2050

I want use PA 2050 to monitor traffic in my network.

I setup PAN in Mode Layer 1 ( virtual wire)

I setup Polices is aler ( not block - i sure it)

I have a proxy, client can access internet through Proxy or not, all ok!

But after i put PAN, client can't not access internet through Proxy,

but if client doesn't user proxy, it will ok!!!

PAN VS RPOXY.png

Something wrong?

Pls helpme!

thanks

2 REPLIES 2

L2 Linker

i just remeber.

Client and proxy on two diffirent subnet?

and not not config tag allow?

Maybe it is cause?

( now i can't reconfig to check )

Not applicable

This is what I would recommend you do first.

1. Security rules.

The firewall needs to allow the LAN access to the proxy on the port they are configured to use. Most companies use port 8080 but it might be different for you. If it's the case, a rule should be in place to allow the entire LAN to communicate to the proxy's IP address only on port 8080. Remember that if an explicit proxy is configured, workstations won't even perform DNS queries, the proxy will.

Another security rule needs to be in place to allow access from the proxy. The proxy will need access to the internet on ports 80, 443, and also DNS services (probably others too like NTP but that will depend on the proxy)

2. Address translation rules.

Without knowing a lot on the network, it is hard for me to provide an exact answer but in most cases, this is how NAT is configured

- When the LAN access the proxy's IP address, no address translation is configured. This allows the proxy to see the real IP address of the workstation instead of all connections coming from the firewall

- When the Proxy access the internet, address translation needs to happen. In most cases a one to one rule is created (one public IP address dedicated to the proxy's internal IP)

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!