Skip to main content
Configure an upstream proxy profile and policy to forward selected traffic from Prisma Access Explicit Proxy to Forge. Use this guide for Prisma Access managed by Strata Cloud Manager or Panorama. For standalone firewalls with GlobalProtect, see Palo Alto Networks.

​
Before you start

Confirm these requirements with your Prisma administrator:
  • Prisma Access mobile-user licensing and Explicit Proxy configuration.
  • A supported release. Palo Alto’s proxy-chaining guide lists Prisma Access 5.2.2 and PAN-OS dataplane 11.2.6 as requirements.
  • Devices or virtual desktop sessions using Explicit Proxy. Being protected by Prisma through another access path is not sufficient.
  • The users or groups, source criteria, and URL category to include in forwarding.
  • Your assigned Forge proxy hostname, port, and public CA certificate.
GlobalProtect proxy or tunnel-and-proxy mode and Prisma Browser are among the supported connection methods. Confirm the clients’ access method before configuring the rule. For pooled virtual desktops, combine user and source criteria to select the intended protected population.

​
Open upstream proxy configuration

Choose the path for your management platform:

​
Create the Forge profile

  1. Open Profiles and add an upstream proxy profile named Forge.
  2. Set the primary proxy to the assigned Forge FQDN and port. The hostname must resolve to a reachable IPv4 address.
  3. Enable X-Authenticated-User (XAU) at the Connect layer. Enable XFF too if source-address evidence is required.
  4. Enable Connect Upstream Proxy over SSL Channel.
  5. Configure certificate trust for the supplied Forge endpoint CA using the procedure supported by your management version. Confirm endpoint validation with your Prisma administrator; do not disable certificate verification.
  6. Save the profile.
Prisma authenticates the user and sends a base64-encoded username in XAU. This is different from Netskope’s unencoded XAU setting. The header is provider identity evidence, not standalone authentication for a Forge user. The supplied endpoint CA secures the Prisma-to-Forge connection. It is distinct from the certificate trust needed for content inspection. Upload only the public certificate material required to trust the endpoint. Do not upload your organization’s CA private key.

​
Create the upstream proxy rule

  1. Create a dedicated custom URL category containing the AI destinations to forward through Forge. Use the URL syntax supported by your Prisma/PAN-OS version.
  2. Open Rules in upstream proxy configuration and add Forge.
  3. Set the source user and source-address criteria to the users or groups and source networks to protect.
  4. Set the destination URL category to the dedicated AI destination category.
  5. Set Action → Upstream Proxy to the Forge profile.
  6. Choose the fallback behavior with your network administrator.
    • Failopen lets matching traffic continue through Prisma when the upstream proxy is unreachable. Such traffic bypasses Forge.
    • Failclose resets or drops matching traffic when the upstream proxy is unreachable.
  7. Review rule order and the complete source and destination scope.
Palo Alto requires the rule to be enabled to save it in this workflow. Saving and pushing are separate steps. Prepare the rule with the administrator, then coordinate the configuration push; do not assume it can be staged as a disabled rule. Rules are evaluated in order, so check for earlier rules that shadow the forwarding rule.

​
Apply the configuration

Activating the rule redirects matching traffic and can interrupt that traffic if the endpoint or its trust configuration is wrong.
  1. In Strata Cloud Manager, save and Push Config. In Panorama, commit and push to Explicit_Proxy_Device_Group.
  2. Verify that the configuration push completes for the Explicit Proxy scope.

​
Validate forwarding

  1. From a device in the protected population, request a destination in the category.
  2. Confirm the matching upstream proxy rule in Prisma logs.
  3. Confirm the corresponding connection reaches the assigned Forge endpoint.
  4. Verify that XAU is included on CONNECT and carries the expected base64-encoded username.
  5. Request an unlisted destination and verify that it retains its existing path.
  6. Verify that excluded users or devices do not match the rule.
  7. Validate the configured fallback behavior during a scheduled maintenance window.
Maintain the upstream proxy profile, source scope, and destination category in your Prisma management platform. Apply configuration changes through the same push workflow.

​
Roll back

Disable the dedicated upstream proxy rule and push the configuration. Verify that affected devices return to their expected network path. Remove the profile and category only after no active rule references them. Stopping Forge alone can interrupt matching requests when the rule uses Failclose.

​
Palo Alto references