Using AWS Bundle 2 as an Ironport replacement

[ACD-II]

I have a Bundle 2 in trail at the moment as a POC. At first glance, the interface is overwhelming, so navigating it is cumbersome at first.  What I am trying to accomplish is a viable replacement for Ironport WSA.  I have a Bluecoat POC in place and it can replace the Ironport, as well as TMG for Citrix, two of our criteria.  My goal is to proof out if the PA-VM can also do this.   Another requirement is DLP with Symantec.

So what I need to know in order for this to be viable is

User authentication via AD

User group authorization,  ability to categorize users for specific access to URL lists, ex: a list for specific sites and nothing else, along with full internet access for other users, all coming from the same IP.  This is the Citrix portion of the POC. With Ironport it is all or nothing based on first on. If a first on user has only access to one list, all users afterwards have the same access. I need for each user on the same box to have their AD access, one user in limited group, and another user with full access.

[ACD-II]

Looks like there is a limit, and it wiped out the rest.

DLP support as mentioned above

I also need authentication exemptions, there is one IP that has strict access to only certian sites, but no users in AD to authenticate.

WCCP?  Can I forward traffic to it using WCCP from another firewall or router?

Any documentation in regards to setting this up provided it is supported would be appreciated.

[santonic]

First keep in mind that PA is a FW, not a proxy. And unlike some other FWs you can't set it up to work as a proxy.

However it can replace all the security features of a proxy (URL filtering, AV), it offers more features (IPS), it can be connected to AD (and many other LDAP and/or authentication servers..), it can work in Layer 3 and inline modes....