Skip to main content

Set up proxy chaining with Palo Alto Prisma Access (preview)

Describes Palo Alto Prisma Access proxy chaining using the upstream forwarding capability of Explicit Proxy. Covers root CA distribution, the X-Authenticated-User (XAU) header, configuration in Strata Cloud Manager or Panorama, and verification.

Note: This integration is in preview. Configuration steps are accurate, but some capabilities are subject to change.

Overview

This integration redirects all public GenAI traffic to F5 Workforce AI Security. It uses the upstream proxy chaining of Prisma Access Explicit Proxy. Prisma Access acts as the downstream proxy for user traffic. It forwards GenAI requests that match a configured URL category to the Workforce AI Security proxy. This happens before the traffic reaches its final destination.

Both Prisma Access and Workforce AI Security log the traffic. You can use either platform to troubleshoot or analyze it.

The upstream proxy policy redirects public GenAI traffic to Workforce AI Security for each matching user. You must configure the X-Authenticated-User (XAU) header in the upstream proxy profile. Users then see no authentication prompts. Without XAU, users must first authenticate with single sign-on (SSO). Only then can they use any GenAI service that Workforce AI Security governs.

You can configure Prisma Access in Strata Cloud Manager or in Panorama. Both paths achieve the same result. Follow the steps for your organization's management approach. Separate sections below cover each one.

For proof-of-concept or pilot deployments, set specific source users or groups in the upstream proxy policy. Prisma Access redirects only those users. You can expand to the full organization later.

Prerequisites

Before you configure Prisma Access, complete three tasks:

  • Verify the environment requirements.

  • Distribute the SurePath AI Root CA to endpoints.

  • Gather the information that you need from the Workforce AI Security platform.

Verify the Prisma Access environment requirements

This integration requires Prisma Access with Explicit Proxy deployed and running. Upstream proxy chaining requires Prisma Access version 5.2.2 or later. It also requires a PAN-OS dataplane version of 11.2.6 or later. Proxy chaining isn't available on earlier versions.

  • Confirm that Explicit Proxy is active in the Prisma Access environment before you proceed.

  • Verify that the Prisma Access version meets the minimum requirements above.

  • If Explicit Proxy is not yet configured, see the Prisma Access documentation for setup guidance.

Distribute the root certificate to endpoints

Workforce AI Security recommends that you distribute the SurePath AI Root CA to all endpoints as a trusted certificate authority. Do this before you configure Prisma Access. When Prisma Access forwards traffic to Workforce AI Security, Workforce AI Security does TLS inspection. It then presents its certificate to end users. The SurePath AI Root CA on endpoints prevents certificate trust errors and warnings for users. This holds whether Prisma Access or Workforce AI Security decrypts a given service.

To download and distribute the certificate:

  1. In CONFIGURE, go to Organization > Integration.

  2. Select the certificate format for your endpoint operating systems.

  3. Select DOWNLOAD CERTIFICATE.

  4. Distribute the SurePath AI Root CA with your existing certificate deployment tools. Examples are Group Policy, mobile device management (MDM) platforms, and endpoint management tools.

Gather configuration information

Collect two items from the Workforce AI Security platform for the Prisma Access steps. The first is the proxy address that Prisma Access forwards traffic to. The second is the curated list of GenAI sites. The list defines which domains to redirect.

Workforce AI Security proxy address

The Workforce AI Security proxy address is the hostname that Prisma Access uses as the destination for forwarded GenAI traffic.

To copy the proxy address:

  1. In CONFIGURE, go to Organization > Integration.

  2. Copy the proxy URL value and save it for the upstream proxy profile step.

Workforce AI Security Public Services catalog

Workforce AI Security maintains a curated list of GenAI sites on the public internet. The list includes vendor names and associated risk levels. You download it in the Palo Alto URL EDL format, an external dynamic list (EDL) of URLs. Then you import it into Prisma Access as a custom URL category.

To download the catalog:

  1. In GOVERN, go to Public Services.

  2. Select DOWNLOAD CATALOG.

  3. In the download format list, select Palo Alto URL EDL.

  4. Select DOWNLOAD to save the file.

The downloaded file has a name similar to workforce-ai-security-public-services-palo-alto-url-edl-YYYY-MM-DD.txt. Don't add URLs to this file. If the catalog needs new sites, contact your Workforce AI Security technical representative for guidance.

Understand the X-Authenticated-User header

The X-Authenticated-User header is a key part of this integration. It identifies users transparently, so they don't see SSO prompts. When you configure it, users don't need to authenticate to use public GenAI services.

How the X-Authenticated-User header works

When Prisma Access forwards traffic to the Workforce AI Security proxy, it inserts the X-Authenticated-User header into each request. The header contains the authenticated username of the end user whose traffic is proxied, encoded in base64. Workforce AI Security validates that the traffic comes from a trusted Prisma Access connector.

To create the connector, in CONFIGURE, go to Connectors. Then add a Network Ingress connector for Prisma Access.

Workforce AI Security then associates the user's identity with their GenAI activity. Users need no extra authentication step.

Header requirements

This integration requires the XAU header. Without XAU, the system sends users to an SSO authentication page the first time they use any GenAI service that Workforce AI Security governs. The system caches this authentication for a period of time. If you turn on XAU, users skip this step.

You configure the XAU header when you create the upstream proxy profile. Palo Alto recommends that you select the Connect layer for XAU header insertion. It also recommends the SSL channel option. This option secures communication between Prisma Access and Workforce AI Security.

Prisma Access configuration steps

You complete three main steps in Prisma Access:

  • Create a custom URL category that contains all GenAI domains from the Workforce AI Security catalog.

  • Create an upstream proxy profile. It points to the Workforce AI Security proxy address and configures the XAU header.

  • Create a rule in the upstream proxy policy. The rule matches GenAI traffic against the URL category and forwards it to Workforce AI Security.

Separate instructions follow for Strata Cloud Manager and for Panorama.

Configure with Strata Cloud Manager

Open the Strata Cloud Manager console

Go to the Palo Alto Networks Hub and open the Prisma Access app.

Create the custom category for uniform resource locators

The custom URL category holds every hostname and domain from the Workforce AI Security Public Services catalog. It defines GenAI traffic for the rule in the upstream proxy policy.

To create the custom URL category:

  1. Go to Configuration > NGFW and Prisma Access > Security Services > URL Access Management.

  2. Select Add Category.

  3. Enter a descriptive name. These instructions use WorkforceAISecurity as the example name throughout.

  4. Set Type to URL List.

  5. Select Import.

  6. Select the Workforce AI Security Public Services catalog file that you downloaded earlier (one hostname per line).

  7. Select Save.

The category now appears in the list of URL categories. The file has more lines than the catalog has services. Some GenAI services require multiple hostnames.

Create the upstream proxy profile

The upstream proxy profile defines Workforce AI Security as the forwarding destination for GenAI traffic. It specifies the proxy hostname and port. It also configures the XAU header. This header identifies users without a prompt.

To create the profile:

  1. Go to Configuration > NGFW and Prisma Access > Network Policies > Upstream Proxy Policy.

  2. Set Configuration Scope to Explicit Proxy.

  3. Under Upstream Proxy Policy, select Profiles.

  4. Select Add Profile.

  5. Enter a descriptive name, such as WorkforceAISecurity.

  6. In the Primary Proxy box, enter the proxy URL value that you copied earlier from the Admin UI.

  7. Unless Workforce AI Security gave different instructions, confirm that the port is 8080.

  8. Leave the Secondary Proxy box empty. Multiple Workforce AI Security proxies respond from the hostname for high availability.

Configure the X-Authenticated-User header

With the XAU header, users don't authenticate with SSO to reach public GenAI services. For details, see "Understand the X-Authenticated-User header" above.

To configure the header:

  1. Under the optional headers section, turn on the XAU header.

  2. Set Layer to Connect.

  3. Turn on Connect Upstream Proxy over SSL Channel. This secures communication between Prisma Access and Workforce AI Security.

  4. Select Save.

Palo Alto recommends that you turn on decryption on PAN-OS to protect the header content in transit. This applies when you select the Connect layer without the SSL channel option. It also applies when you select the HTTP layer.

Create the rule for the upstream proxy policy

The rule in the upstream proxy policy tells Prisma Access to redirect matching traffic to the Workforce AI Security proxy profile. This rule turns on the integration.

To create the rule:

  1. Under Upstream Proxy Policy, select Rules.

  2. Select Add Upstream Proxy Policy Rules.

  3. Enter a descriptive name, such as WorkforceAISecurity.

  4. Under Match Criteria > Source, choose the scope:

    • For pilot or proof-of-concept deployments, specify individual Users or Address Groups. This limits the policy to test users or groups.

    • For production deployments, leave the value set to Any to apply the policy to all users.

  5. Under Match Criteria > Destination, set URL Category to the custom URL category that you created earlier.

  6. Under Action, set Upstream Proxy to the profile that you created in the previous step.

  7. Set Fallback Action to the behavior that fits your organization:

    • If Workforce AI Security is unreachable, Failopen sends traffic directly to its destination through Prisma Access.

    • If Workforce AI Security is unreachable, Failclose resets or drops the connection.

  8. Turn on the rule. You must turn on a rule to save it.

  9. Select Save.

Prisma Access evaluates rules from top to bottom. Place the upstream proxy rule for Workforce AI Security high enough in your overall policy structure. Then Prisma Access forwards GenAI traffic before other rules take effect.

To deploy the changes, select Push Config.

Configure with Panorama

Open the Panorama console

Log in to the Panorama management console with the URL of your organization.

Create the custom category for uniform resource locators

The custom URL category holds every hostname and domain from the Workforce AI Security Public Services catalog. In Panorama, custom URL categories are objects in the device group of the Explicit Proxy deployment.

To create the custom URL category:

  1. Within the Explicit_Proxy_Device_Group, go to Objects > Custom URL Categories.

  2. Select Add.

  3. Enter a descriptive name. These instructions use WorkforceAISecurity as the example name throughout.

  4. Set Type to URL List.

  5. Select Import.

  6. Select the Workforce AI Security Public Services catalog text file that you downloaded in the prerequisites (one hostname per line).

  7. Select OK.

Create the upstream proxy profile

To create the profile:

  1. Go to Panorama > Cloud Services > Configuration > Explicit Proxy > Upstream Proxy Configuration.

  2. Under Profiles, select Add.

  3. Enter a descriptive name, such as WorkforceAISecurity.

  4. In the Primary Proxy box, enter the proxy URL value that you copied earlier from the Admin UI.

  5. Unless Workforce AI Security gave different instructions, confirm that the port is 8080.

  6. Leave the Secondary Proxy box empty.

Configure the X-Authenticated-User header

To configure the header:

  1. Under the optional headers section, turn on the XAU header.

  2. Set Layer to Connect.

  3. Turn on Connect Upstream Proxy over SSL Channel. This secures communication between Prisma Access and Workforce AI Security.

  4. Select OK to save the profile.

Create the rule for the upstream proxy policy

To create the rule:

  1. Under Upstream Proxy Configuration, select Rules.

  2. Select Add.

  3. Enter a descriptive name, such as WorkforceAISecurity.

  4. Under Match Criteria > Source, choose the scope:

    • For pilot or proof-of-concept deployments, specify individual Users or Address Groups. This limits the policy to test users or groups.

    • For production deployments, leave the value set to Any to apply the policy to all users.

  5. Under Match Criteria > Destination, set URL Category to the custom URL category that you created earlier.

  6. Under Action, set Upstream Proxy to the profile that you created in the previous step.

  7. Set Fallback Action to the behavior that fits your organization:

    • If Workforce AI Security is unreachable, Failopen sends traffic directly to its destination through Prisma Access.

    • If Workforce AI Security is unreachable, Failclose resets or drops the connection.

  8. Turn on the rule.

  9. Select OK.

Prisma Access evaluates rules from top to bottom. Place the upstream proxy rule for Workforce AI Security high enough in your overall policy structure. Then Prisma Access forwards GenAI traffic before other rules take effect.

To deploy the changes, select Commit and Push, and push the configuration to the Explicit_Proxy_Device_Group.

Verification and troubleshooting

After you push and deploy the configuration to test users or groups, verify the integration with the Ready tool. Redirected users see successful results for certificate trust and for network configuration. If either test fails, check the custom URL category and the upstream proxy profile. Also check that the rule in the upstream proxy policy is correct, turned on, and applied to the intended users.

Related Articles
Did this answer your question?