Proxy Authentication

[ASCIT]

I've configured my 3020 for external access via a proxy server. The connection fails when checking for software updates with a generic communication error.

The proxy server shows the connected account as 'anonymous' even though a username is configured (verified with 'show deviceconfig system').

Does the PA support NTLM proxy authentication?

[Dz3015]

you used the "secure-proxy-" commands?

[Satish]

Hi Ascit,

if you are using data panel  for Update than you should configure service route for that. source and destination address.(under device tab  )

Regards

Satish

[pulukas]

For windows authentication try the user names in these formats:

domain\username

username@domain.local  --- Check the AD properties of the user for which unc name is used on the service account

[ASCIT]

Yes the following commands have been configured.

  secure-proxy-server

  secure-proxy-port

  secure-proxy-user

  secure-proxy-password

[ASCIT]

I'm just using the management interface which is the default service route for all services. I've also manually configured this interface for the proxy service.

[ASCIT]

I've tried a combination of domain\user, domain/user, user@domain and mixed up the cases but the user is still appearing on the proxy as 'anonymous'.

FYI I am running PAN-OS 6.1.0

[ASCIT · Accepted solution]

Just following up after PA Support got back to me, PAN-OS only supports Basic Proxy Authentication for its service updates via a Proxy.

[pulukas]

Thanks for the follow up.  This is bad news as the basic authentication encryption has been long since compromised.  Make sure the account you use here is a service account with the minimum AD permissions.