Overview
This guide covers the network flows that route generative AI traffic to F5 Workforce AI Security. There are two flows: secure access service edge (SASE) Forward-to-Proxy and proxy auto-configuration (PAC) URL. Each flow works with or without upstream Transport Layer Security (TLS) interception. The configuration here is general. Links to vendor-specific setup are in the reference section.
Terminology
Workforce AI Security Proxy: The TLS proxy that inspects and governs traffic to public GenAI services. It then forwards the traffic to its destination.
Forward-to-Proxy: A SASE policy action that chains GenAI traffic from the SASE proxy to the Workforce AI Security Proxy.
Proxy PAC URL: The URL of a proxy auto-configuration file. The file sends only GenAI domains to the Workforce AI Security Proxy. All other traffic continues by its typical route.
Root CA (SurePath AI Root CA): The Workforce AI Security certificate authority (CA) that endpoints (or upstream devices) must trust. When endpoints trust it, they show no TLS warnings when Workforce AI Security decrypts and inspects traffic.
Public Services Catalog: The downloadable, curated list of GenAI domains. SASE policies and the PAC file use it to steer traffic.
Endpoints, hostnames, and ports
Component | Hostname or range | Ports | Notes |
PAC file host |
|
| PAC file retrieval over HTTPS |
Workforce AI Security HTTP/S Proxy (PAC deployments) |
|
| Port selection by the PAC file |
Workforce AI Security HTTP/S Proxy (SASE deployments) |
|
| SASE Forward-to-Proxy target |
Workforce AI Security Edge IPs |
| per above | Allow-listing and validation |
Integration methods
Both methods steer only GenAI domains to Workforce AI Security for governance. SASE deployments chain traffic from the SASE vendor to the Workforce AI Security Proxy with a Forward-to-Proxy action. Proxy PAC URL deployments set up endpoints to use a PAC file. The PAC file sends matching traffic directly to the Workforce AI Security TLS proxy.
SASE integrations use a Forward-to-Proxy configuration inside the SASE platform. It chains traffic to Workforce AI Security.
Proxy PAC URL integrations rely on a TLS proxy that Workforce AI Security operates. The proxy decrypts and governs GenAI sessions.
The SurePath AI Root CA is required for Proxy PAC URL and recommended for SASE. If decryption exceptions at the SASE layer stop upstream decryption before traffic reaches Workforce AI Security, the certificate matters most.
Use cases
Choose SASE Forward-to-Proxy when your organization already routes web traffic through a SASE platform. SASE Forward-to-Proxy is the right choice if you also need centralized policy, posture controls, and consolidated logging across the security stack.
If you want a rapid deployment without SASE, or your main target is browsers or ChromeOS, choose Proxy PAC URL. It also works well for a pilot or a rollout to specific user groups. Use mobile device management (MDM) or browser admin controls for this.
Traffic flows
Workforce AI Security supports two main types of integrations: SASE and Proxy PAC URL. SASE is the preferred method.
If you have no SASE solution, or your solution isn't compatible, Workforce AI Security uses MDM instead. MDM pushes a customer-specific proxy PAC URL to endpoints. Both methods forward only specific AI domains to Workforce AI Security for analysis. Non-AI traffic goes by its typical or direct route.
Proxy auto-configuration
Endpoints retrieve the PAC file and send only GenAI traffic to the Workforce AI Security TLS proxy. Other traffic continues by its typical route. Requests to public GenAI services are tunneled to Workforce AI Security Edge. Workforce AI Security inspects them under the SurePath AI Root CA that the endpoint trusts.
Configuration steps
Create the
Proxyconnector. To do this, in CONFIGURE, go to Connectors.Distribute the Proxy PAC URL through MDM or browser admin controls.
Deploy the SurePath AI Root CA to endpoints.
Proxy auto-configuration with Transport Layer Security inspection
A customer-managed firewall does TLS inspection for outbound HTTP/S traffic. The endpoint trusts the CA of the firewall. The PAC file still sends GenAI traffic to the Workforce AI Security HTTP/S proxy. Install the SurePath AI Root CA on the firewall. Then Workforce AI Security can inspect tunneled GenAI sessions end-to-end.
Configuration steps
Make sure that endpoints trust the root certificate of the firewall CA.
Create the
Proxyconnector.Distribute the Proxy PAC URL through MDM or browser admin controls.
Install the SurePath AI Root CA on the firewall that intercepts TLS.
Secure access service edge with Transport Layer Security inspection using Forward-to-Proxy (proxy chaining)
The SASE platform intercepts TLS. It then forwards GenAI traffic to the Workforce AI Security Proxy with a Forward-to-Proxy action based on the Public Services list. Install the SurePath AI Root CA on the SASE platform. Then Workforce AI Security can inspect the downstream traffic.
Configuration steps
Create the SASE connector (Netskope, Zscaler, Cloudflare). To do this, in CONFIGURE, go to Connectors.
Import or reference the Public Services Catalog in the SASE platform as a URL Category/Filter.
Add a Forward-to-Proxy configuration in the SASE platform.
Install and trust the SurePath AI Root CA on the SASE platform.
Turn on
X-Authenticated-Userheader insertion.
Secure access service edge using Forward-to-Proxy without Transport Layer Security intercept at the secure access service edge
The SASE platform forwards GenAI traffic to the Workforce AI Security Proxy. It doesn't intercept TLS upstream. Endpoints must trust the SurePath AI Root CA. Without the certificate, browser warnings can appear during TLS inspection by Workforce AI Security.
Configuration steps
Create the SASE connector.
Import or reference the Public Services Catalog in the SASE platform.
Add a Forward-to-Proxy configuration in the SASE platform.
Deploy the SurePath AI Root CA to endpoints.
Turn on
X-Authenticated-Userheader insertion.
Reference configuration documents
Secure access service edge
Proxy auto-configuration distribution
Operational notes
The Public Services Catalog and the PAC file update GenAI destinations automatically. SASE deployments need periodic category list refreshes, as the vendor advises. For pilot deployments, use targeted user or device groups. Monitor logs in both the SASE platform and Workforce AI Security.
Authentication
To associate AI traffic with specific users, Workforce AI Security must prompt the user for credentials. It does this before it allows access to an AI service. Alternatively, it can receive an identifier that associates the traffic with a user. In that case, it doesn't prompt for authentication.
Secure access service edge
Most SASE vendors' Forward-to-Proxy policies can add the X-Authenticated-User (XAU) header. The policies add it to requests that they forward to third-party proxy services like Workforce AI Security.
Workforce AI Security trusts the XAU header. It authenticates the request automatically and doesn't prompt the user. It does this when three conditions are true. The SASE platform sends the header to Workforce AI Security. The tenant has the required SASE connector set up. The request comes from a known IP address of that SASE vendor.
Cloudflare sends the XAU header from an HTTP policy in Secure Web Gateway, not from a Forward-to-Proxy policy. This policy uses an identity variable. The variable resolves to the email address of the user who is logged in. For the configuration steps, see Integrate with Cloudflare Secure Web Gateway.
Proxy auto-configuration
Proxy PAC URLs from Workforce AI Security provide a main TLS-based proxy address. They also provide a fallback proxy address for HTTP. Systems or applications that don't support TLS proxies use this fallback. The TLS-based proxy also uses user-specific hostnames. These hostnames show Workforce AI Security which tenant the traffic belongs to. The Proxy connector has three authentication settings:
User
Workforce AI Security always prompts users for authentication.
Native traffic and desktop apps won't function, because their traffic can't be redirected to authenticate.
Workforce AI Security always assigns User Activity events to specific users.
Connector
Workforce AI Security never prompts users for authentication.
Native traffic and desktop apps are fully functional.
User Activity events show the connector as the user. The actual username isn't captured, because the user isn't prompted for authentication.
User with Connector (Recommended)
When users use an AI service in a web browser, Workforce AI Security prompts them for authentication.
Native traffic and desktop apps are fully functional.
User Activity events show a mix of usernames and the proxy connector.
These settings assume that the Workforce AI Security TLS proxy is in use. When the TLS proxy isn't supported, authentication always falls back to User authentication.
Connector authentication works through the TLS proxy. A TLS connection carries a Server Name Indication (SNI) field. This field contains the DNS name of the host that the client tries to reach. When the field is available, Workforce AI Security uses it to associate traffic with a specific tenant.
HTTP proxy traffic has no SNI. As a result, Workforce AI Security can't identify the org. It must prompt users for authentication for all AI services.