Setting up explicit proxy policies for outbound inspection is straightforward if your architecture is clear. Many teams mess this up by not separating proxy rules from firewall policies, leading to hairpin NAT and performance hits.
Key steps:
1. Define your proxy access networks (e.g., internal LAN subnets).
2. Create the explicit proxy policy, specifying source, destination, and service (HTTP/HTTPS).
3. Configure the proxy action: "Deny and inspect" for SSL decryption, or "Allow and inspect". Set your decryption profile.
4. **Crucially**, add a matching firewall rule **above** your general outbound permit rule. This rule must:
* Have the same source/destination/service.
* Use the action "Accept".
* Set "Transparent" as the proxy option.
Example firewall rule configuration snippet:
```bash
Source: Internal-LAN
Destination: Any
Service: HTTPS
Action: Accept
Proxy: Transparent
```
Without the matching firewall rule set to "Transparent", traffic won't be handed off to the proxy engine. This is the most common misconfiguration. Test with a known blocked URL or by checking the proxy access logs first, not the firewall logs.