- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
11-14-2024 02:05 AM
Hello Team,
We have configured the Palo Alto firewall as an Explicit Proxy using Kerberos authentication in alignment with the Admin Guide. However, we’re noticing that the designated traffic is not routing through the Proxy as expected and is failing to initiate from the Proxy-Zone to the Internet-Zone.
When attempting to access a webpage from a user’s device, we’re encountering the following error: "upstream connect error or disconnect/reset before headers, reset reason: connection failure."
Could someone provide guidance on troubleshooting this issue? Insights on potential configuration aspects or logs to review would be greatly appreciated.
Thanks
11-14-2024 08:14 AM
I'm literally setting this up for a client now, first time!
I have the same issues as you've seen. I expect the interfaces for the proxy all need to be in a dedicated VR with the default route routing via the 'external' proxy network (therefore forcing it out of that interface/zone).
11-16-2024 08:32 PM
Hello,
As per the documentation, the interfaces should be within the same virtual routers and the same virtual systems.
Do update, if you were able to make it work.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!