This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About mlop
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About mlop
08-18-2015
10Posts
0Likes
0Solutions
Aug 18, 2015Last Visited
User
Activity
User
Profile
Latest posts by mlop
| Subject | Views | Posted |
|---|---|---|
| 1928 | 09-18-2012 03:37 AM | |
| 1928 | 09-18-2012 02:54 AM | |
| 5164 | 09-18-2012 12:56 AM | |
| 5164 | 09-17-2012 02:23 AM | |
| 5164 | 09-17-2012 02:06 AM | |
| 5389 | 09-17-2012 01:47 AM | |
| 5389 | 09-17-2012 01:20 AM | |
| 5389 | 09-17-2012 01:13 AM | |
| 6670 | 09-14-2012 07:01 AM | |
| 3592 | 07-20-2012 03:01 AM |
User Badges
Community Statistics
| Member Since | 06-21-2011 03:08 AM |
| Date Last Visited | 08-18-2015 09:07 AM |
| Posts | 10 |
09-18-2012
03:37 AM
Hope I correclty understand your reply but I'm not agree with: "Another solution is to configure your transparent proxy to listen to TCP80 (and TCP443 and other ports you might expect http traffic on) which when using DNAT you will leave "translated port" empty and things will work..." Because you could not DNAT destination IP if you don't know the IP address of the orginal packet. And, of course, you could not set "Any" on original paquet dest. IP and the proxy IP on translated destination IP ( Mismatch of destination address translation range between original address and translated address).
... View more
09-18-2012
02:54 AM
Nope. If you leave blank the destination adresse you could not click on OK. But what I need is to NAT the destination address (any) to the proxy adresse which is not possible... I think there is no way to forward http communication to a proxy server... (not possible with PBF or NAT).
... View more
09-18-2012
12:56 AM
Hi So I suppose your answer mean:"it's not possible because you could not create a port translation if in the orginal packet the destination IP is Internet (any)"
... View more
09-17-2012
02:23 AM
thanks miklond but I don't know how to DNAT my dest port from 80 to 8080 because PA need an IP adresse (orginal dest & translated dest.) and I could not know the dest. IP (internet).
... View more
09-17-2012
02:06 AM
sorry again but I find the begining of the solution: 1/ my proxy is listening to the 8080 port in transparent mode 2/ the PA have a forward proxy rule from zone wifi_mobile to http service port => forward to proxy IP 3/ NAT configuration : from zone Wifi_mobile to zone "proxy" ; destination adresse 173.194.35.144 ; service http; nat source "none" ; nat dest. IP: proxy_IP ; nat port dest. 8080 This configuration is working when the mobile phone access to http://173.194.35.144 Hope you see the problem: I could not NAT all internet IP address to my unique proxy IP address. A solution? Thanks again
... View more
09-17-2012
01:47 AM
i just try to configured a simple forwarding policy rule (source IP: wifi_mobile ; dest. service http ; forward to proxy IP) and set the listen port of my proxy to tcp/80 (transparent mode) but this configurtion is not working. Is there a way to correctly foward http connexion to a web proxy?
... View more
09-17-2012
01:20 AM
oups, made a mistake in my previous message, the proxy is configured in transparent mode.
... View more
09-17-2012
01:13 AM
Hi mbutt and thanks for your quick answer. That exacly the configuration I made. I want to forward to the 8080 tcp port because my proxy is listening to the 8080 tcp port and is not working in transparent mode, that why I would like to know if I can forward the http mobile phone connexions to the proxy thanks to Palo Alto Firewall (mobile phones does not have proxy configured and I could not change the configuration). The goal of this configuration is to apply the company internet policy (proxy filtering settings) to the unmanage mobile phones. In checkpoint FW, the feature is called http_mapped service. Thanks again for your help Matthieu
... View more
09-14-2012
07:01 AM
Hi, I try to forward my WiFi mobile users http communications to my proxy. WiFi mobile users and proxy are in two different VLAN plug on Palo Alto (default gateway of mobile users and proxy is Palo Alto Firewall). Is it possible with Palo Alto? The problem is that I need to forward all HTTP (80) from mobile users to the proxy on a different port (8080) and you could not define a specific forward port on the next hop on the Policy Based forwarding menu. I tried with nat but my squid proxy deny the request. I've made lots of test in lab with the Policy Based Forwarding and NAT features but it's not working. Can you please help me ? Thanks Matthieu
... View more
Labels:
- Labels:
-
Configuration
-
Set Up
07-20-2012
03:01 AM
Hello, My Palo Alto is configured in two modes: Layer 3 and TAP. I turn WildFire on. The feature is working in Layer 3 mode (two net interfaces - one IN, the other OUT) but not in TAP mode (one dedicated net interface). I use the same File blocking profile for the two policies. Can you confirm WildFire is working the same way in Layer 3 and TAP mode? Thanks for your answer.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
08-18-2015
09:07 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks