Security Newb - Looking for some guidance on identity based protection for web servers.

Hello all,

Currently we're running palo altos and performing all kinds of web inspection but would like to rely less on the firewalls and add another layer out front. I have very little previous experience with WAFS and proxies but essentially it sounds like the C levels would like to see us throw some kind of reverse proxy/identity protection out in front of our web servers. Essentially allowing us to cut down on the amount of traffic inspected by the FW's by dropping all non approved traffic before it even makes it to them.

I know this is very broad but does anyone have recommendations on some kind of identity-based or reverse proxy type products we could look into implementing? We have alot of webservers accessed by different users so it would need to be something that could scale well. Any suggestions or input would be greatly appreciated.