Autonomous DEM
Monitor LAN Health When Local Network Access is Blocked
Table of Contents
Monitor LAN Health When Local Network Access is Blocked
ADEM monitor LAN health even when the direct access to local network is blocked in
GlobalProtect app.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
|
You can run synthetic tests on Autonomous DEM to monitor local network
health.
In many secure environments, you can configure the GlobalProtect app to
block direct access to the local network. This setting prevents the Access
Experience agent from performing critical health tests on the local network because
the app blocks the agent’s standard processes from accessing the local network.
In such scenarios, you can explicitly configure Autonomous DEM to
continue to monitor LAN health. When you enable LAN monitoring with blocked access
to local network, the agent runs separate, dedicated processes to collect LAN
metrics using TCP connections. Ensure to allowlist these processes in your
GlobalProtect app or Prisma Access Agent.
Enable LAN Monitoring When Local Access is Disabled
Prerequisites
- Allowlist the additional network processes on your EDR.
- Ensure that ports 80 and 443 are open as these ports are used for TCP pings and path traces on the local network when direct access to the local network is blocked.
- If the VPN gateway is configured on different ports other than 443, the gateway might not respond to TCP pings. In this case, Autonomous DEM can’t collect the internet metrics when direct access to the local network is blocked in GlobalProtect.
- Verify if direct access to the local network is blocked in the GlobalProtect app.
- Launch Strata Cloud Manager and click Configuration > NFW and Prisma Access > Configuration Scope > GlobalProtect.
- Under Prisma Access Infrastructure Setup, click GlobalProtect.
- Select GlobalProtect App >Tunnel Settings and verify if the Local Network Access is blocked.
- Launch Strata Cloud Manager and click .In the Application Tests tab, select the Enable LAN health when GlobalProtect has disabled Direct Access to Local Network check boxA pop-up appears to confirm that you have allow listed the processes required for monitoring LAN health on your EDR. Click Confirm to continue.
![]()
The application tests will continue to collect LAN metrics even when the direct access to the local network is blocked in the GlobalProtect app.
