Web Proxy behind PAN firewall and application recognition

[dustintodd]

I know this question has been asked in other posts but I figured I would give it another try. I would like the PAN to sit between my users and my web proxy *and* for the applications to be recognized instead of just reported as proxy traffic. Is there any setting to force the PANOS to do this?

[mikand]

1) I was talking about that when the packet leaves your Proxy (towards internet) the srcip will be the clientip (instead of the ip of the physical interface).

Like so, before proxy:

srcip: <clientip>

dstip: <proxyip_insideinterface>

after proxy:

srcip: <clientip>

dstip: <webserverip>

I will check if squid can do the "keepsource=yes" feature and get back, otherwise there are other proxies which can do this.

2) Yes, you can specify which interface to use in Device -> Setup -> Services and then Service route configuration to define which mgmt-services should use the mgmt-interface and which should use one of the dataplane-interfaces.

Edit:

I found some info on how to do this with squid:

http://wiki.squid-cache.org/Features/Tproxy4

http://wiki.squid-cache.org/ConfigExamples/Intercept/CentOsTproxy4

http://wiki.squid-cache.org/ConfigExamples/FullyTransparentWithTPROXY

http://www.squid-cache.org/mail-archive/squid-users/200705/0443.html

http://www.squid-cache.org/mail-archive/squid-users/200705/0447.html

Some newer info regarding Squid3:

http://www.deckle.co.uk/squid-users-guide/transparent-caching-proxy.html

http://www.lesismore.co.za/squid3.html

The device where I first saw this keepsource=yes feature was in the Farist Firewall http://www.tutus.se/products/farist-firewall.html

[tomimma]

Thanks, I am not sure if these solutions are feasible for my real situation though...

It looks like it is acting more likely as "transparent", that is all to me.