policy based forwarding to proxy

[dieter_b]

We use ntlm (CP) to authenticate our users against the PA.

We want any http traffic forwarded to a proxy. The proxy would have http access to the internet through the PA. I was thinking of using a policy based forwarding rule to forward service-http to the proxy. Similar to how e.g. a Cisco router can intercept http traffic and forward it to a proxy using the WCCP protocol (or any other implementation of the same).

This way all authentication and traffic logging stays on the PA, easier to monitor...

But will it work ? In which order are rulesets processed ? For it to work, it would have to process the CP ntlm authentication rule before the PBF rule. Is that the case ? If not, can I set a processing order for rulesets ?

[skrall]

I am attaching a slide from our documentation literature. If this fails to answer your question you probably need to open a case with Support.

You can use these commands to see which policy is processing traffic.

show session all filter source <ip_addr>

show session id xxxxx

xxxxx = the ID number shown by the first command.

Steve Krall

[dieter_b]

Picking up an old thread... have'nt had the chance to try or implement yet.

Seems like your attachment went missing. Can you get it back for me, please ?

[sjamaluddin · Accepted solution]

Your CP authentication should take place first

Policy Based forwarding takes precedence over whatever is in your routing

If you'd like to foward all your https/ http traffic over to a proxy outside of the PAN FW, then you should be able to enable UserID (via CP) and then route to the Proxy Server via the PBF

https://live.paloaltonetworks.com/docs/DOC-1628

Hope this helps.

[dieter_b]

Thank you, exactly the answer and document I was looking for.