Prisma Access: Explicit Proxy

Configure HTTP Header Insertion to insert the user email address in the X- Authenticated-User Header field before forwarding the traffic to Witness AI proxy.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → HTTP Header Insertion. Select the Prisma Access configuration scope.

Click Add Profile to set the following settings:

Name → X-Auth-User

Click Add Rule to set the following settings:

Name → X-Auth-User Header

Type → Dynamic Fields

Domain → *

Add Headers → X-Authenticated-User

Value → ($user)@($domain)

Tick the Log box and Save

5. URL Access Management

This will ensure URL filtering logs are created for any traffic matching WitnessForwardURLList EDL domains.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → URL Access Management. Select the Prisma Access configuration scope.

Click Add Rule to set the following settings:

Name → WitnessAI_allow

Under External Dynamic Lists, select WitnessForwardURLList and change Site Access to alert.

6. Profile Groups

Attach HTTP Header Insertion Profile and URL Access Management Profile to the Profile Group.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → Profile Groups. Select the Prisma Access configuration scope.

Click Add Rule to set the following settings:

Name → WitnessAI PG

Under URL Access Management Profile, select WitnessAI_allow

Under HTTP Header Insertion Profile, select X-Auth-User and Save

7. Security Policy

i. Create Security Policy to block Quic

Quic is a Google developed protocol which uses UDP for web connections and limits the firewall visibility and ability to analyze and apply security actions.

If the Quic protocol is not already blocked, please perform below steps.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → Security Policy. Select the Prisma Access configuration scope.

Click Add Rule → Security Rule (Pre Rule) to set the following settings:

Pre-rules are global rules that take precedence over deployment-specific rules and are applied to traffic first.

Name → Quic Block

Source Zone → trust

Destination Zone → untrust

Application → quic

Action → Deny and Save

ii. Create Security Policy for allowing traffic to WitnessAI Proxy.

Attach the WitnessAI PG profile group with this policy. This rule will insert the HTTP header and generate the URL filtering logs for the traffic towards WitnessForwardURLList.

Select Manage → Configuration → NGFW and Prisma Access → Security Services → Security Policy. Select the Prisma Access configuration scope.

Click Add Rule → Security Rule (Pre Rule) to set the following settings:

Name → WitnessAI_Allow

Source Zone → trust

Destination Zone → untrust

URL Category → WitnessForwardURLList

Profile Group → WitnessAI PG

Action → Allow and Save

8. Create Decryption Profile & Policy

Select Manage → Configuration → NGFW and Prisma Access → Security Services → Decryption. Select the Prisma Access configuration scope.

Click Add Profile to set the following settings:

Decryption Profiles → Name → Witness-Decrypt Profile

SSL/TLS Decryption → Advanced → Enable Strip ALPN

The Palo Alto Firewall supports header insertion for HTTP/1.x traffic only; it does not support header insertion for HTTP/2 traffic.

SSL/TLS Decryption → Select Protocol Min Version as TLSv1.0 and Protocol Max Version as Max, and Save

Create a new Decryption Policy to decrypt WitnessForwardURLList URL category. Make sure this is placed above the ‘O365-Best-Practice’ rule or any other SSL Decryption Bypass rules.

Click Add Rule to set the following settings:

Name → WitnessAI_Decrypt

Source Zone → trust

Destination Zone → untrust

URL Category Entities → WitnessForwardURLList

Action → Decrypt

Type → SSL Forward Proxy

Decryption Profile → WitnessAI_Decrypt Profile

Explicit Proxy Configuration

1. Create a Forwarding Profile

Explicit Proxy Forwarding Profiles enable to employ PAC files to define which traffic to forward to Prisma Access.

Select Workflows → Prisma Access Setup → Explicit Proxy Setup → Forwarding Rules → Forwarding Profiles Setup → Add Forwarding Profile → GlobalProtect Proxy

Name → Explicit Proxy

PAC File Upload → Enable

Select Upload New PAC File to upload an existing PAC file. After Save we should see the Prisma hosted PAC URL.

Note: The Accounts team will provide the WitnessAI PAC. Customers using an existing PAC file must incorporate LLM domain logic from the WitnessAI PAC to ensure traffic is routed through the WitnessAI Proxy.

2. Attach Forwarding Profiles to GlobalProtect App Configuration

Select Workflows → Prisma Access Setup → GlobalProtect → GlobalProtect App App Settings → Show Advanced Options

Agent Mode for Prisma Access → Tunnel and Proxy

Forwarding Option → Forwarding Profiles

Forwarding Profiles → Select Explicit Proxy profile which we created earlier and Save

Note: Customer have an option to host custom PAC URL in any publicly accessible server (eg. Amazon S3)

10. Push Config

The last step is to push the changes to the Prisma Gateways. Click Push to enable the configuration changes made.

Copied from:

Admin Guide- Prisma Access Integration using Explicit Proxy

Prisma Access: Explicit Proxy Traffic Flow General Configuration 1. Install WitnessAI Root Certificate 2. Setup EDL Certificate Profile 3. Create External Dynamic Lists 4. HTTP Header Insertion 5. URL Access Management 6. Profile Groups 7. Security Policy i. Create Security Policy to block Quic ii. Create Security Policy for allowing traffic to WitnessAI Proxy.8. Create Decryption Profile & Policy Explicit Proxy Configuration 1. Create a Forwarding Profile 2. Attach Forwarding Profiles to GlobalProtect App Configuration 10. Push Config