PREVIEW — This integration is in preview. Configuration steps are accurate, but some capabilities are subject to change.
Overview
This integration enables organizations to redirect all public GenAI traffic to SurePath AI through Prisma Access Explicit Proxy's upstream proxy chaining capability. Using this method, Prisma Access acts as the downstream proxy for user traffic and forwards GenAI requests matching a configured URL category upstream to the SurePath AI proxy before the traffic reaches its final destination. This approach provides complete visibility in both Prisma Access and SurePath AI logging systems, allowing admins to use either platform for troubleshooting or analysis.
Organizations implementing this integration should understand that all users whose traffic matches the configured upstream proxy policy will have their public GenAI access redirected to SurePath AI. When the X-Authenticated-User (XAU) header is configured in the upstream proxy profile as described in this document, users will have a fully transparent experience without any authentication prompts. Without the XAU header configuration, users would be required to authenticate using SSO before gaining access to any GenAI services governed by SurePath AI.
Prisma Access supports two management interfaces for this configuration: Strata Cloud Manager and Panorama. Both paths achieve the same result; admins should follow the steps that correspond to their organization's management approach. The configuration steps for each are covered in separate sections below.
For POC or pilot deployments, admins can configure specific source users or groups in the upstream proxy policy rule to limit redirection to a subset of users before expanding to the full organization.
Prerequisites
Before configuring Prisma Access, admins should verify the environment requirements, ensure the SurePath AI Root CA is distributed to endpoints, and gather the necessary configuration information from the SurePath AI platform.
Verify Prisma Access environment requirements
This integration requires Prisma Access with Explicit Proxy deployed and operational. The upstream proxy chaining feature requires Prisma Access version 5.2.2 or later and a PAN-OS dataplane version of 11.2.6 or later. Proxy chaining is not available on earlier versions.
Confirm that Explicit Proxy is already configured and active in the Prisma Access environment before proceeding
Verify the Prisma Access version meets the minimum requirements listed above
Consult the Prisma Access documentation for guidance on setting up Explicit Proxy if it is not yet configured
Distribute SurePath AI Root CA to endpoints
SurePath AI recommends that organizations distribute the SurePath AI Root CA to all endpoints as a trusted certificate authority before beginning the Prisma Access configuration. When Prisma Access forwards traffic to SurePath AI, SurePath AI performs TLS inspection and presents its certificate to end users. Distributing the SurePath AI Root CA to endpoints ensures users do not encounter certificate trust errors or warnings regardless of which services Prisma Access decrypts versus which are decrypted by SurePath AI.
To download and distribute the certificate:
In the Admin UI, click Organization in the CONFIGURE section and select the Integration tab
Select the certificate format appropriate for the endpoint operating systems
Click the DOWNLOAD CERTIFICATE button
Distribute the SurePath AI Root CA using existing certificate deployment mechanisms, such as Group Policy, Mobile Device Management (MDM) platforms, or endpoint management tools
Gather configuration information
Admins must collect several items from the SurePath AI platform that will be used during the Prisma Access configuration steps. These include the proxy address that Prisma Access will forward traffic to and the curated list of GenAI sites that defines which domains should be redirected.
SurePath AI proxy address
The SurePath AI proxy address is the hostname that Prisma Access will use as the destination for forwarded GenAI traffic.
In the Admin UI, click Organization in the CONFIGURE section and select the Integration tab
Copy the proxy URL value and save it for use during the upstream proxy profile configuration step
SurePath AI public services catalog
SurePath AI maintains and curates a list of GenAI sites across the public internet, including vendor names and associated risk levels. This list is downloaded in Palo Alto URL EDL format and imported into Prisma Access as a custom URL category.
In the Admin UI, click Public Services in the GOVERN section
Click the DOWNLOAD CATALOG button
Select Palo Alto URL EDL from the download format dropdown
Click DOWNLOAD to save the file
The downloaded file will be named similar to surepath-ai-public-services-palo-alto-url-edl-YYYY-MM-DD.txt. Admins should not add additional URLs to this file. If there are sites that need to be added to the catalog, the admin should contact their SurePath AI technical representative for guidance on the appropriate approach.
Understanding X-Authenticated-User (XAU) header
The X-Authenticated-User header is a critical component of this integration that enables transparent user identification without requiring SSO authentication prompts. When properly configured, the XAU header dramatically improves the user experience by eliminating the need for users to authenticate when accessing public GenAI services.
How XAU works with SurePath AI
When Prisma Access forwards traffic to the SurePath AI proxy, it inserts the X-Authenticated-User header into each request. This header contains the authenticated username of the end user whose traffic is being proxied (encoded in base64 format). SurePath AI validates that the traffic is coming from a trusted Prisma Access connector (configured as a Network Ingress Connector in the SurePath AI admin) and then automatically associates the user's identity with their GenAI activity without requiring an additional authentication step. This creates a fully transparent experience where users can access GenAI services without any interruption or authentication prompts.
XAU requirements by deployment type
Organizations using SurePath AI Discovery mode must configure the XAU header, as it is the only method for SurePath AI to identify which users are accessing GenAI services. Without the XAU header, Discovery mode cannot attribute activity to individual users.
For non-Discovery organizations, the XAU header is optional but strongly recommended. Without XAU, users will be redirected to an SSO authentication page the first time they access any GenAI service governed by SurePath AI. While this authentication is typically cached for a period of time, enabling XAU eliminates this authentication requirement entirely and provides the best user experience.
The XAU header configuration is completed during the upstream proxy profile creation step outlined in this document. Palo Alto recommends selecting the Connect layer for XAU header insertion and enabling the SSL channel option for secure communication between Prisma Access and SurePath AI.
Prisma Access configuration steps
The Prisma Access configuration process involves three main steps: creating a custom URL category containing all GenAI domains from the SurePath AI catalog, creating an upstream proxy profile that points to the SurePath AI proxy address and configures the XAU header, and creating an upstream proxy policy rule that matches GenAI traffic against the URL category and forwards it to SurePath AI.
Separate instructions are provided below for organizations managing Prisma Access through Strata Cloud Manager and through Panorama.
Configuration via Strata Cloud Manager
Access the Strata Cloud Manager console
Navigate to the Palo Alto Networks Hub and open the Prisma Access app
Create the custom URL category
The custom URL category contains all the individual hostnames and domains from the SurePath AI public services catalog. This category defines what traffic should be considered GenAI traffic for the purpose of the upstream proxy policy rule.
Navigate to Configuration > NGFW and Prisma Access > Security Services > URL Access Management
Click Add Category
Enter a descriptive name—these instructions use SurePathAI as the example name throughout
Set the Type field to URL List
Click Import and select the SurePath AI public services catalog text file downloaded during the prerequisites step (one hostname per line)
Click Save
The custom URL category should now appear in the list of configured URL categories. The number of services listed in the SurePath AI catalog will not match the number of lines in the file. The line count will be higher because some GenAI services require multiple hostnames to capture all relevant traffic.
Create the upstream proxy profile
The upstream proxy profile defines SurePath AI as the forwarding destination for GenAI traffic. It specifies the proxy hostname and port and configures the XAU header that enables transparent user identification.
Navigate to Configuration > NGFW and Prisma Access > Network Policies > Upstream Proxy Policy
Set the Configuration Scope to Explicit Proxy
Under Upstream Proxy Policy, click Profiles and then Add Profile
Enter a descriptive name—these instructions use SurePathAI throughout
Set the Primary Proxy field to the SurePath AI proxy URL value copied from the Admin UI in the prerequisites section
Confirm the port is set to 8080 unless the organization has received specific instructions from SurePath AI to use a different port number
Leave the Secondary Proxy field empty (multiple SurePath AI proxies respond from the hostname provided for high availability)
Configure X-Authenticated-User header (Recommended)
As described in the "Understanding X-Authenticated-User (XAU) header" section above, enabling the XAU header eliminates the need for users to authenticate via SSO when accessing public GenAI services.
Under the optional headers section, enable the XAU header
Set the Layer to Connect
Enable Connect Upstream Proxy over SSL Channel to ensure secure communication between Prisma Access and SurePath AI
Click Save
When the Connect layer is selected without the SSL channel option, or when the HTTP layer is selected, Palo Alto recommends that decryption is enabled on PAN-OS to protect the header content in transit.
Create the upstream proxy policy rule
The upstream proxy policy rule instructs Prisma Access to redirect traffic matching the custom URL category to the SurePath AI proxy profile. This is the policy that actually enables the integration and begins redirecting GenAI traffic.
Under Upstream Proxy Policy, click Rules and then Add Upstream Proxy Policy Rules
Enter a descriptive name—these instructions use SurePathAI throughout
Under Match Criteria > Source:
For pilot or POC deployments, specify individual Users or Address Groups to limit the policy to test users or groups
For production deployments, leave the value set to Any to apply the policy to all users
Under Match Criteria > Destination, set URL Category to the custom URL category created earlier (named SurePathAI in these examples)
Under Action, set Upstream Proxy to the profile created in the previous step (named SurePathAI in these examples)
Set the Fallback Action to the appropriate behavior for the organization:
Failopen allows traffic to egress directly through Prisma Access if SurePath AI is unreachable
Failclose resets or drops the connection if SurePath AI is unreachable
Enable the rule (rules must be enabled for the configuration to be saved)
Click Save
In Prisma Access, rules are evaluated from top to bottom. The SurePath AI upstream proxy rule should be positioned appropriately within the organization's overall policy structure to ensure GenAI traffic is forwarded before other rules can take effect.
Click Push Config to deploy the configuration
Configuration via Panorama
Access the Panorama console
Log in to the Panorama management console using the organization-specific URL
Create the custom URL category
The custom URL category contains all the individual hostnames and domains from the SurePath AI public services catalog. In Panorama, custom URL categories are managed as objects within the device group associated with the Explicit Proxy deployment.
Navigate to Objects > Custom URL Categories within the Explicit_Proxy_Device_Group
Click Add
Enter a descriptive name—these instructions use SurePathAI as the example name throughout
Set the Type field to URL List
Click Import and select the SurePath AI public services catalog text file downloaded during the prerequisites step (one hostname per line)
Click OK
Create the upstream proxy profile
Navigate to Panorama > Cloud Services > Configuration > Explicit Proxy > Upstream Proxy Configuration
Under Profiles, click Add
Enter a descriptive name—these instructions use SurePathAI throughout
Set the Primary Proxy field to the SurePath AI proxy URL value copied from the Admin UI in the prerequisites section
Confirm the port is set to 8080 unless the organization has received specific instructions from SurePath AI to use a different port number
Leave the Secondary Proxy field empty
Configure X-Authenticated-User header (Recommended)
Under the optional headers section, enable the XAU header
Set the Layer to Connect
Enable Connect Upstream Proxy over SSL Channel to ensure secure communication between Prisma Access and SurePath AI
Click OK to save the profile
Create the upstream proxy policy rule
Under Upstream Proxy Configuration, click Rules and then Add
Enter a descriptive name—these instructions use SurePathAI throughout
Under Match Criteria > Source:
For pilot or POC deployments, specify individual Users or Address Groups to limit the policy to test users or groups
For production deployments, leave the value set to Any to apply the policy to all users
Under Match Criteria > Destination, set URL Category to the custom URL category created earlier (named SurePathAI in these examples)
Under Action, set Upstream Proxy to the profile created in the previous step (named SurePathAI in these examples)
Set the Fallback Action to the appropriate behavior for the organization:
Failopen allows traffic to egress directly through Prisma Access if SurePath AI is unreachable
Failclose resets or drops the connection if SurePath AI is unreachable
Enable the rule and click OK
In Prisma Access, rules are evaluated from top to bottom. The SurePath AI upstream proxy rule should be positioned appropriately to ensure GenAI traffic is forwarded before other rules can take effect.
Click Commit and Push and push the configuration to the Explicit_Proxy_Device_Group
Verification and troubleshooting
After the configuration is pushed and deployed to test users or groups, admins can verify the integration using the SurePath AI Ready tool. Users whose traffic is being redirected should see successful validation results for both certificate trust and network configuration. If either test fails, admins should verify that the custom URL category, upstream proxy profile, and upstream proxy policy rule are all configured correctly and that the rule is enabled and applied to the intended user population.