About tomimma

Hi All, I think this topic has been discussed in the past, but I want to be clear about this deployment since web proxy server design is still typical in many customer's live network. So please allow me to bring this again. 2 basic deployments are mentioned in the past. These deployments are: (1) Place PAN between users and a proxy server. It would be like, for example:      [Clients] -- [PAN] -- [Proxy] -- [Internet]      (One of the recommended designs is placing a proxy server in a separate interface of PAN as a typical DMZ design.)      But, let's assume the above simple design. PA could be either L3 or vwire mode. (2) Place PAN between a proxy server and internet. It would be like, for example:      [Client] -- [Proxy] -- [PAN] -- [Internet] Now, my questions are: << In case of (1) scenario >> With this design, source web traffic comes from actual client and goes through PAN, so PAN can identify source user-id. What about destination IP and app-id? Clients' web browser are actually pointing to the proxy server and the session to an external web server in Internet is initiated from this web proxy server. Does that mean all destination IPs will be the IP address of this proxy server? What about app-id to be identified? Will it be "web-proxy" for all traffic from clients? << In case of (2) scenario >> From the past posts, the nature of this design can cause a problem, because all web access are coming from the web proxy server. That means PAN can't identify original source IP addresses of clients. The solution is enable "X-Forwarded-For" option in both web proxy server and PAN. With "X-Forwarded-For" solution, PAN can identify original source IP address from clients since the original source IP is included in HTTP header. My question is what about user-id? Can PAN map user-id based on this "X-Forwarded-For" feature, so that you can identify both original source IP and user-id? Any comment is appreciated. Thanks in advance, Tomimma ... View more