10.4 Explicit and Transparent Web Proxy on PAN-OS

10.4 Explicit and Transparent Web Proxy on PAN-OS

Task 2.7 of the NGFW Engineer blueprint covers configuring the web proxy on PAN-OS. Palo Alto Networks firewalls can act as a forward web proxy for HTTP and HTTPS traffic, giving the same App-ID, URL filtering, and threat prevention inspection to proxied web traffic that inline deployments provide. Understanding the difference between explicit and transparent proxy modes, and how authentication and decryption fit, is the core of this task.

---

What the Web Proxy Feature Is

The Web Proxy feature lets the firewall terminate outbound web requests on behalf of clients, apply security policy to them, and forward them to the internet. It is distinct from the firewall's normal inline (transit) mode: in proxy mode the firewall is the explicit endpoint the client talks to, not just a hop in the path.

Licensing

• Web Proxy License is required to enable the feature on the NGFW.
• For Strata Cloud Manager-managed NGFWs, the Web Proxy feature additionally requires Strata Cloud Manager Essentials or Strata Cloud Manager Pro.

This licensing requirement is a common exam trap: a firewall with an otherwise valid NGFW subscription will not proxy traffic until the Web Proxy License and (for cloud-managed firewalls) the appropriate SCM tier are present.

---

Explicit Proxy

In explicit proxy mode, clients are configured to send HTTP and HTTPS requests to the proxy. The client browser points at the proxy address and port, and the client knows a proxy is in use.

How It Works

1. The client sends GET http://example.com/ (with the full URL) to the proxy, or uses the HTTPS CONNECT method to establish a tunnel through the proxy.
2. The proxy resolves the destination, applies URL filtering and threat prevention, and forwards the request.
3. Because the client explicitly addresses the proxy, the proxy can challenge the user for authentication.

Authentication for Explicit Proxy

Explicit proxy supports several authentication methods, all of which identify the user behind the request so that policy and URL filtering can be user-aware:

• Kerberos (NTLM authentication): transparent single sign-on for domain-joined clients.
• SAML: federated authentication through an identity provider.
• Cloud Identity Engine (CIE): cloud-delivered identity for hybrid environments.

Authentication is the key advantage of explicit proxy: the firewall learns exactly which user made each request, enabling User-ID-based policy and reporting on proxied traffic.

---

Transparent Proxy

In transparent proxy mode, clients are not configured to use a proxy and are unaware one exists. Traffic is redirected to the firewall, which acts as the proxy without the client's knowledge.

The Defining Characteristic

A PCNSE/NGFW Engineer exam pattern asks which proxy mode preserves a flow where the HTTP and SSL requests still contain the destination web server IP (not the proxy IP) and the client is redirected to the proxy. That behavior is transparent proxy: the client believes it is talking directly to the web server, and the firewall transparently intercepts and proxies the connection.

When to Use Transparent vs Explicit

---

HTTPS, Decryption, and the Web Proxy

A proxy that only handled HTTP would be useless for modern traffic, which is almost entirely HTTPS. PAN-OS inspects HTTPS passing through the web proxy using SSL Forward Proxy decryption, the same mechanism covered in Chapter 7.

1. The client initiates the HTTPS connection (to the proxy in explicit mode, or to the apparent server in transparent mode).
2. SSL Forward Proxy intercepts the handshake, generates a signed certificate on the fly from a Forward Trust CA, and establishes one TLS session with the client and one with the server.
3. The firewall now sees plaintext inside the proxy and can apply App-ID, URL filtering, threat prevention, and DLP to the decrypted content.
4. Traffic that matches decryption exclusions (pinned certificates, financial/health categories) is bypassed to avoid breaking applications.

This is why web proxy configuration and decryption configuration are tested together: the proxy gives the firewall the traffic, and SSL Forward Proxy gives it visibility into the encrypted portion.

---

Operational Considerations

• Proxy vs inline mode: The web proxy is an alternative insertion model, not a replacement for inline inspection. Many deployments use inline inspection for most traffic and the web proxy only for traffic that must be user-authenticated at the application layer.
• Pinned-certificate applications: Applications that pin server certificates (banking, some SaaS) will fail through a decrypting proxy unless added to the predefined or custom decryption exclusions.
• Logging: Proxied traffic produces traffic and URL logs tagged with the identified user, which surfaces in the ACC (section 10.3) for monitoring of web usage by user.

---

Choosing a Mode

Use explicit proxy when the organization controls client configuration and wants strong, user-authenticated egress policy. Use transparent proxy when client configuration is impractical (for example, BYOD or unmanaged guests) and the goal is inspection without user cooperation. In both modes, pair the proxy with SSL Forward Proxy to inspect HTTPS and with the Web Proxy License (plus the required SCM tier for cloud-managed firewalls) so the feature is actually enabled.