replace proxy ISA server with PA500?

[Tician]

Can I replace MS ISA server with PA500 like proxy, is that recommended and what is the benefit of kind implementation?

[migration · Accepted solution]

I replaced an ISA server with a 2020 box and it works good.

A key benefit is you have a lot more control and visability with the Palo than the ISA server.

I have even moved my exchange ssl cert to the Palo box from ISA.

The Palo will provide application aware protection for your network.

D

[Tician]

Hi Dallen,

I have more questions to clarify request of my customer.

They want to replace ISA server with PA in order to keep user settings of browsers, that's means that they want to keep authentication process and port 8080 in IE proxy settings and regularly connect through PA that now act proxy.

Is this scenario posibble or they need to give clients computers PA like gateway? 

[migration]

I too was using the ISA as a proxy utilizing port 8080 through IE settings.

I put my Palo inline and made a default route to the interface I created. Then I just set the IE settings to none. There is an LDAP utility to handle the authentication process for the Palo.

I am sure you could keep your port 8080 settings but I cannot confirm for sure as I have not set it up that way.

Hope that helps...

[reaper]

The PaloAlto does not offer traditional proxy connectivity, so your IE settings would need to change.

The advantage of having a PaloAlto is having more visibility, control and safety on your user's internet connectivity since we offer URL categorisation, threat prevention (av, malware, vulnerabilities), user identification (transparant by polling AD login events and corelating these to IP addresses or via captive portal), application based rulebases and much more.