If your network uses a proxy device, learn how to configure
a web proxy as either an explicit proxy or a transparent proxy to
route authentication traffic.
| Where Can I Use This? | What Do I Need? |
|---|
- NGFW (Cloud Managed)
- NGFW (PAN-OS or Panorama Managed)
|
|
If your network uses a proxy device for security, you can now leverage the same level
of protection using the on-premises web proxy capability with PAN-OS 11.0. The web
proxy features enables additional options for migrating from an existing web proxy
architecture to a simple unified management console. Using the web proxy feature
with
Prisma Access provides a seamless method
for migrating, deploying, and maintaining secure web gateway (SWG) configurations
from an easy to use and simplified interface. Web proxy helps during the transition
from on-premises to the cloud with no loss to security or efficiency.
The web proxy supports two methods for routing traffic:
- For the explicit proxy method, the request contains the destination IP address
of the configured proxy and the client browser sends requests to the proxy
directly. You can use one of following methods to authenticate users with the
explicit proxy:
- Kerberos, which requires a web proxy license.
- SAML 2.0, which requires Panorama, a Prisma Access license, the Cloud
Services 3.2.1 plugin (and later versions), and the add-on web proxy
license.
- Cloud Identity Engine, which requires Panorama, a Prisma Access license,
the Cloud Services 3.2.1 plugin (and later versions), and the add-on web
proxy license.
- For the transparent proxy method, the request contains the destination IP
address of the web server and the proxy transparently intercepts the client
request (either by being in-line or by traffic steering). There is no client
configuration and Panorama is optional. Transparent proxy requires a loopback
interface, User-ID configuration in the proxy zone, and specific Destination NAT
(DNAT) rules. Transparent proxy does not support X-Authenticated Users (XAU) or
Web Cache Communications Protocol (WCCP).
The following products support web proxy:
- PA-1400 Series Firewalls
- PA-3400 Series Firewalls
- PA-5400 Series Firewalls
From PAN-OS 12.1 version and later
versions, PA-5450 series firewall is supported. However, for PAN-OS versions
earlier than 12.1, PA-5450 series firewall is not supported for web
proxy.
- VM-Series Firewalls (with a minimum of four vCPUs)
- Panorama management systems running PAN-OS 11.1
To learn how to configure a web proxy, select the type of proxy or proxy capability
that you want to configure:
