PREVIEW — This integration is in preview. Configuration steps are accurate, but some capabilities are subject to change.
Overview
This integration enables organizations to redirect all public GenAI traffic to F5 SurePath AI through Prisma Access Explicit Proxy's upstream proxy chaining capability. Using this method, Prisma Access acts as the downstream proxy for user traffic. It forwards GenAI requests that match a configured URL category upstream to the SurePath AI proxy. This happens before the traffic reaches its final destination. This approach provides complete visibility in both Prisma Access and SurePath AI logging systems. Admins can use either platform for troubleshooting or analysis.
All users whose traffic matches the configured upstream proxy policy have their public GenAI access redirected to SurePath AI. The X-Authenticated-User (XAU) header can be configured in the upstream proxy profile, as described in this document. When it is, users have a fully transparent experience without any authentication prompts. Without XAU, users must authenticate using SSO. This happens before they can access any GenAI service governed by SurePath AI.
Prisma Access supports two management interfaces for this configuration: Strata Cloud Manager and Panorama. Both paths achieve the same result. Admins should follow the steps that correspond to their organization's management approach. The configuration steps for each are covered in separate sections below.
For POC or pilot deployments, admins can configure specific source users or groups in the upstream proxy policy rule. This limits redirection to a subset of users before expanding to the full organization.
Prerequisites
Before configuring Prisma Access, admins should complete three tasks:
Verify the environment requirements.
Ensure the SurePath AI Root CA is distributed to endpoints.
Gather the necessary configuration information from the SurePath AI platform.
Verify Prisma Access environment requirements
This integration requires Prisma Access with Explicit Proxy deployed and operational. The upstream proxy chaining feature requires Prisma Access version 5.2.2 or later. It also requires a PAN-OS dataplane version of 11.2.6 or later. Proxy chaining is not available on earlier versions.
Confirm that Explicit Proxy is already configured and active in the Prisma Access environment before proceeding
Verify the Prisma Access version meets the minimum requirements listed above
Consult the Prisma Access documentation for guidance on setting up Explicit Proxy if it is not yet configured
Distribute SurePath AI Root CA to endpoints
SurePath AI recommends distributing the SurePath AI Root CA to all endpoints as a trusted certificate authority. Do this before beginning the Prisma Access configuration. When Prisma Access forwards traffic to SurePath AI, SurePath AI performs TLS inspection. It then presents its certificate to end users. Distributing the SurePath AI Root CA to endpoints prevents certificate trust errors or warnings for users. This holds regardless of whether Prisma Access or SurePath AI decrypts a given service.
To download and distribute the certificate:
In the Admin UI, click Organization in the CONFIGURE section and select the Integration tab
Select the certificate format appropriate for the endpoint operating systems
Click the DOWNLOAD CERTIFICATE button
Distribute the SurePath AI Root CA using existing certificate deployment mechanisms, such as Group Policy, Mobile Device Management (MDM) platforms, or endpoint management tools
Gather configuration information
Admins must collect several items from the SurePath AI platform for the Prisma Access configuration steps. These include the proxy address that Prisma Access will forward traffic to. They also include the curated list of GenAI sites that defines which domains should be redirected.
SurePath AI proxy address
The SurePath AI proxy address is the hostname that Prisma Access will use as the destination for forwarded GenAI traffic.
In the Admin UI, click Organization in the CONFIGURE section and select the Integration tab
Copy the proxy URL value and save it for use during the upstream proxy profile configuration step
SurePath AI public services catalog
SurePath AI maintains and curates a list of GenAI sites across the public internet. The list includes vendor names and associated risk levels. It is downloaded in Palo Alto URL EDL format, then imported into Prisma Access as a custom URL category.
In the Admin UI, click Public Services in the GOVERN section
Click the DOWNLOAD CATALOG button
Select Palo Alto URL EDL from the download format dropdown
Click DOWNLOAD to save the file
The downloaded file will be named similar to surepath-ai-public-services-palo-alto-url-edl-YYYY-MM-DD.txt. Admins should not add additional URLs to this file. If the catalog needs new sites, the admin should contact their SurePath AI technical representative for guidance.
Understanding X-Authenticated-User (XAU) header
The X-Authenticated-User header is a critical component of this integration. It enables transparent user identification without requiring SSO authentication prompts. When properly configured, the XAU header removes the need for users to authenticate when accessing public GenAI services.
How XAU works with SurePath AI
When Prisma Access forwards traffic to the SurePath AI proxy, it inserts the X-Authenticated-User header into each request. This header contains the authenticated username of the end user whose traffic is being proxied (encoded in base64 format). SurePath AI validates that the traffic is coming from a trusted Prisma Access connector. This connector is configured as a Network Ingress Connector in the SurePath AI admin. SurePath AI then associates the user's identity with their GenAI activity, with no extra authentication step. Users can access GenAI services without any interruption or authentication prompts.
XAU requirements by deployment type
Organizations using SurePath AI Discovery mode must configure the XAU header. It is the only method for SurePath AI to identify which users are accessing GenAI services. Without the XAU header, Discovery mode cannot attribute activity to individual users.
For non-Discovery organizations, the XAU header is optional but strongly recommended. Without XAU, users will be redirected to an SSO authentication page. This happens the first time they access any GenAI service governed by SurePath AI. This authentication is typically cached for a period of time. Enabling XAU eliminates the requirement entirely and gives the best user experience.
The XAU header configuration is completed during the upstream proxy profile creation step outlined in this document. Palo Alto recommends selecting the Connect layer for XAU header insertion. It also recommends enabling the SSL channel option for secure communication between Prisma Access and SurePath AI.
Prisma Access configuration steps
The Prisma Access configuration process involves three main steps:
Create a custom URL category containing all GenAI domains from the SurePath AI catalog.
Create an upstream proxy profile that points to the SurePath AI proxy address and configures the XAU header.
Create an upstream proxy policy rule that matches GenAI traffic against the URL category and forwards it to SurePath AI.
Separate instructions are provided below for organizations managing Prisma Access through Strata Cloud Manager and through Panorama.
Configuration via Strata Cloud Manager
Access the Strata Cloud Manager console
Navigate to the Palo Alto Networks Hub and open the Prisma Access app
Create the custom URL category
The custom URL category contains all the individual hostnames and domains from the SurePath AI public services catalog. This category defines what counts as GenAI traffic for the upstream proxy policy rule.
Navigate to Configuration > NGFW and Prisma Access > Security Services > URL Access Management
Click Add Category
Enter a descriptive name—these instructions use SurePathAI as the example name throughout
Set the Type field to URL List
Click Import and select the SurePath AI public services catalog file downloaded earlier (one hostname per line)
Click Save
The custom URL category should now appear in the list of configured URL categories. The number of services in the SurePath AI catalog will not match the file's line count. The line count is higher because some GenAI services require multiple hostnames.
Create the upstream proxy profile
The upstream proxy profile defines SurePath AI as the forwarding destination for GenAI traffic. It specifies the proxy hostname and port. It also configures the XAU header, which enables transparent user identification.
Navigate to Configuration > NGFW and Prisma Access > Network Policies > Upstream Proxy Policy
Set the Configuration Scope to Explicit Proxy
Under Upstream Proxy Policy, click Profiles and then Add Profile
Enter a descriptive name—these instructions use SurePathAI throughout
Set the Primary Proxy field to the SurePath AI proxy URL value copied from the Admin UI in the prerequisites section
Confirm the port is 8080, unless SurePath AI gave different instructions
Leave the Secondary Proxy field empty (multiple SurePath AI proxies respond from the hostname, for high availability)
Configure X-Authenticated-User header (Recommended)
Enabling the XAU header eliminates the need for users to authenticate via SSO when accessing public GenAI services. See the "Understanding X-Authenticated-User (XAU) header" section above for details.
Under the optional headers section, enable the XAU header
Set the Layer to Connect
Enable Connect Upstream Proxy over SSL Channel to ensure secure communication between Prisma Access and SurePath AI
Click Save
Palo Alto recommends enabling decryption on PAN-OS to protect the header content in transit. This applies when the Connect layer is selected without the SSL channel option, or when the HTTP layer is selected.
Create the upstream proxy policy rule
The upstream proxy policy rule instructs Prisma Access to redirect matching traffic to the SurePath AI proxy profile. This is the policy that enables the integration and begins redirecting GenAI traffic.
Under Upstream Proxy Policy, click Rules and then Add Upstream Proxy Policy Rules
Enter a descriptive name—these instructions use SurePathAI throughout
Under Match Criteria > Source:
For pilot or POC deployments, specify individual Users or Address Groups to limit the policy to test users or groups
For production deployments, leave the value set to Any to apply the policy to all users
Under Match Criteria > Destination, set URL Category to the custom URL category created earlier (named SurePathAI in these examples)
Under Action, set Upstream Proxy to the profile created in the previous step (named SurePathAI in these examples)
Set the Fallback Action to the appropriate behavior for the organization:
Failopen allows traffic to egress directly through Prisma Access if SurePath AI is unreachable
Failclose resets or drops the connection if SurePath AI is unreachable
Enable the rule (rules must be enabled for the configuration to be saved)
Click Save
In Prisma Access, rules are evaluated from top to bottom. The SurePath AI upstream proxy rule should be positioned appropriately within the organization's overall policy structure. This ensures GenAI traffic is forwarded before other rules can take effect.
Click Push Config to deploy the configuration
Configuration via Panorama
Access the Panorama console
Log in to the Panorama management console using the organization-specific URL
Create the custom URL category
The custom URL category contains all the individual hostnames and domains from the SurePath AI public services catalog. In Panorama, custom URL categories are managed as objects within the device group associated with the Explicit Proxy deployment.
Navigate to Objects > Custom URL Categories within the Explicit_Proxy_Device_Group
Click Add
Enter a descriptive name—these instructions use SurePathAI as the example name throughout
Set the Type field to URL List
Click Import and select the SurePath AI public services catalog text file downloaded during the prerequisites step (one hostname per line)
Click OK
Create the upstream proxy profile
Navigate to Panorama > Cloud Services > Configuration > Explicit Proxy > Upstream Proxy Configuration
Under Profiles, click Add
Enter a descriptive name—these instructions use SurePathAI throughout
Set the Primary Proxy field to the SurePath AI proxy URL value copied from the Admin UI in the prerequisites section
Confirm the port is 8080, unless SurePath AI gave different instructions
Leave the Secondary Proxy field empty
Configure X-Authenticated-User header (Recommended)
Under the optional headers section, enable the XAU header
Set the Layer to Connect
Enable Connect Upstream Proxy over SSL Channel to ensure secure communication between Prisma Access and SurePath AI
Click OK to save the profile
Create the upstream proxy policy rule
Under Upstream Proxy Configuration, click Rules and then Add
Enter a descriptive name—these instructions use SurePathAI throughout
Under Match Criteria > Source:
For pilot or POC deployments, specify individual Users or Address Groups to limit the policy to test users or groups
For production deployments, leave the value set to Any to apply the policy to all users
Under Match Criteria > Destination, set URL Category to the custom URL category created earlier (named SurePathAI in these examples)
Under Action, set Upstream Proxy to the profile created in the previous step (named SurePathAI in these examples)
Set the Fallback Action to the appropriate behavior for the organization:
Failopen allows traffic to egress directly through Prisma Access if SurePath AI is unreachable
Failclose resets or drops the connection if SurePath AI is unreachable
Enable the rule and click OK
In Prisma Access, rules are evaluated from top to bottom. The SurePath AI upstream proxy rule should be positioned appropriately. This ensures GenAI traffic is forwarded before other rules can take effect.
Click Commit and Push and push the configuration to the Explicit_Proxy_Device_Group
Verification and troubleshooting
After the configuration is pushed and deployed to test users or groups, admins can verify the integration using the SurePath AI Ready tool. Redirected users should see successful validation results for both certificate trust and network configuration. If either test fails, admins should verify that the custom URL category, upstream proxy profile, and upstream proxy policy rule are all configured correctly. They should also confirm the rule is enabled and applied to the intended user population.