Proxy filtering or paloalto filtering

[NetworkGeek]

Hi All,

i have proxy in my network which is responsible for all filtering and categorizaing , also i bought a licnese for url filtering on paloalto so, is there any benefit to allow filtering and categoriziang on both ?

or no need for filtering on paloalto since i have proxy

[bradk14]

the question may be do you have need for the proxy? what is it doing that the palo can't do? I don't believe it makes sense to have both performing policy based on URL categorization because unless they're both using bright cloud as  a source, there's a good chance they won't always agree and that may cause confusion.

[BPry]

From my experiance nothing that I've used a proxy for in the past couldn't be accomplished with the Palo Alto besides...the ability to limit users to 'x' amount of time on a category or specific website. Keeping an existing proxy and utilizing the PA URL filtering and categorization would simply add complexity in troubleshooting any issues. 

[bradk14]

also what I should have noted before, is if you do have a proxy in front of the palo alto, unless you enable X-Forward-For support on the proxy, the Palo will see the Proxy's IP as the source for all traffic which can lead to additional confusion/headaches, especially when it comes to content-id. If you enable XFF, the PA will use the original client's IP in the logs. Just be sure to enable stripping the XFF in the content ID setup otherwise it can/will leak corporate IPs to the internet, which may or may not be a concern.

[Raido_Rattameister]

Unless you need caching or URL rewriting you can usually remove proxy.