09-23-2023 06:09 PM
Hi @ptingalls ,
Yes, the proxy has to be on the same subnet as the interface. The NGFW will not change the IP header of the original packet. So, it cannot be routed over the network. It must be forwarded to the proxy MAC address.
One way to get around that limitation is with a GRE tunnel if the web proxy supports it. Here is a doc for PBF with GRE for Netskope. https://docs.netskope.com/en/netskope-help/integrations-439794/ipsec-and-gre/netskope-gre-with-palo-...
If the web proxy does not support GRE, then you will need to extend the VLAN to the NGFW. I could be wrong, but I think those are your only 2 options.
Thanks,
Tom
