To enable Autonomous Digital Experience Management (ADEM) for your Prisma Access mobile users, you must
enable ADEM in the GlobalProtect app settings. After you enable
ADEM for a user, the GlobalProtect portal will automatically
push the ADEM capabilities and the required authentication
certificate to the selected users the next time they connect.
Enable ADEM for your Prisma Access mobile users using the
appropriate workflow for your Prisma Access deployment:
Learn how to enable Autonomous DEM for your Cloud Managed Prisma Access
users.
Autonomous
DEM is supported on GlobalProtect app version 5.2.11 with Content
Release version 8393-6628 or later running on Windows or macOS endpoints
only. Because you may not have licensed Autonomous DEM for all of
your mobile users, you might want to create a new app settings configuration
and restrict it to the supported operating systems and the specific
users for which you want to enable ADEM.
After the GlobalProtect
app receives the ADEM configuration, it uses the corresponding certificate
to authenticate to the ADEM service and register with the service.
After the agent registers, you will be able to assign app tests
to the user.
To enable Autonomous DEM for your GlobalProtect
users:
From the Strata Cloud Manager user interface, create a new GlobalProtect App
Settings configuration and enable Autonomous DEM.
Add App Settings to create a GlobalProtect app
configuration for your Autonomous DEM users and give it a
Name.
To set the Match Criteria for OS, click
Add OS and select
Mac and/or Windows
systems only.
If you only want to deploy the ADEM configuration to a subset of your
Mac and/or Windows users, under User Entities
click Add User and select the users to whom
you want to push this configuration.
To enable Autonomous DEM for the selected users, under App
Configuration, expand Show Advanced OptionsUser Behavior and select an option to enable Digital
Experience Management (DEM) for Prisma Access (Windows
and Mac only).
You can select whether to let users enable and disable ADEM by
selecting Install and User can Enable or Disable
DEM or Install and User cannot Enable or
Disable DEM. When you enable ADEM, this also
triggers creation of the certificate needed to authenticate to the
ADEM service and enables log collection for troubleshooting.
Starting in GlobalProtect version 5.2.8, you have the option
to suppress receiving all Autonomous DEM update notifications
(pertaining to installing, uninstalling and upgrading an agent) on
the endpoints. To suppress the notifications, deselect the
Display ADEM Update Notification Message
check box. By default, this check box is selected.
Customize any other App Settings as needed.
Save the App Settings.
Make sure you have security policy rules required to
allow the GlobalProtect app to connect to the ADEM service and run
the synthetic tests.
To do so, you must add the ADEM URLs to make the endpoints
register to the ADEM portal.
Create a security policy rule and add the newly created address
group object to it.
To do so, click the + icon
under DestinationAddresses and
add the address group you created as shown in the image below.
To enable the app to connect to the ADEM service and to run
the application tests, you must have a policy rule to allow the
GlobalProtect users to connect to applications over HTTPS.
To enable the app to run network monitoring tests, you must
have a policy rule to allow ICMP and TCP traffic.
(Optional) If you plan to run synthetic tests that
use HTTP, you must also have a security policy rule to allow the
GlobalProtect users to access applications over HTTP.
If you use a third-party EDR, you must allow certain processes on the EDR for ADEM to function properly. Examples of EDRs that require this
include:
CrowdStrike
Trellix
SentinelOne
Save and Push the configuration
to Prisma Access.
Panorama
Learn how to enable Autonomous DEM for your Panorama Managed Prisma Access
users.
Autonomous
DEM is supported on GlobalProtect app version 5.2.11 with Content
Release version 8393-6628 or later running on Windows or macOS endpoints
only. Because you may not have licensed Autonomous DEM for all of
your mobile users, you might want to create a new app settings configuration
and restrict it to the supported operating systems and the specific
users for which you want to enable ADEM.
After the GlobalProtect
app receives the ADEM configuration, it uses the corresponding certificate
to authenticate to the ADEM service and register with the service.
After the agent registers, you will be able to assign app tests
to the user.
To enable Autonomous DEM for your GlobalProtect
users:
Generate the certificate the agent will use to authenticate to the Autonomous DEM service.
From Panorama, select PanoramaCloud ServicesConfigurationService Setup.
In the GlobalProtect App Log Collection section under Service
Operators, click Generate Certificate for GlobalProtect
App Collection and Autonomous DEM.
A confirmation message indicates that the certificate was
successfully generated in the Mobile_User_Template Shared
location.
Configure the portal to push the DEM settings to the
GlobalProtect agent.
To create an agent configuration to push to your DEM users
only, in the Mobile_User_Template, select
the GlobalProtect Portal Configuration.
On the Agent tab, select the DEFAULT
agent configuration and Clone it and give
it a new Name.
To enable the portal to push the DEM authentication certificate
you just generated to the end user systems, on the Authentication tab
set Client Certificate to Local and
then select the globalprotect_app_log_cert.
After you push globalprotect_app_log_cert to the client
machine, one root CA, two intermediate CAs, and one client
certificate, issued by Palo Alto Networks, are installed in the
user's Personal store.
Palo Alto Networks automatically generates
the Strata Logging Service certificate, so the root CA
certificate and intermediate CA certificate must be owned by Palo
Alto Networks. Palo Alto Networks can add the root certificate to
portal configuration so that the GlobalProtect client can install it
as a trusted root CA to the machine if they want to do so.
To ensure that this agent configuration is only pushed to
agents running on supported operating systems, on the Config Selection CriteriaUser/User
Group tab, click Add in
the OS column and select Mac and/or Windows only).
If you only want to deploy the DEM configuration to a subset
of your Mac and/or Windows users, in the User/User Group column Add the
specific users or user groups to push this configuration to.
To enable Autonomous DEM functionality for users on
GlobalProtect version 6.2 and below, on the
App tab, enable Autonomous DEM endpoint agent for Prisma Access
for GP version 6.2 and below (Windows & Mac
Only).
ADEM is enabled by default; however, you can allow users to disable
ADEM by selecting Install and user can enable/disable
agent from GlobalProtect. End users can use this
GlobalProtect configuration to pause/resume monitoring. If users
disable the ADEM agent, they will continue to be online, but the
agent will pause the monitoring and no synthetic tests will be
conducted.
ADEM is enabled by default. Select Install and user cannot
enable/disable agent from GlobalProtect to keep ADEM
enabled. Users will not be able to disable ADEM.
To enable Autonomous DEM functionality for users on
GlobalProtect version 6.3 and above, on the
App tab, enable Access
Experience (ADEM, App Acceleration, end user coaching) for GP
6.3 and above (Windows & Mac Only).
ADEM is enabled by default. If you want to keep it enabled, select
the No Action (The agent state remains the
same) option. To install or uninstall the agent,
select Install the Agent or
Uninstall the Agent.
Also on the App tab, set Enable Autonomous DEM and
GlobalProtect App Log Collection for Troubleshooting
to Yes to enable the GlobalProtect app to use
the certificate you just created to authenticate to the DEM service.
Starting in GlobalProtect version 5.2.8, you have the option to suppress receiving all Autonomous DEM update notifications (pertaining to installing,
uninstalling and upgrading an agent) on the endpoints. To suppress
the notifications, set the Display Autonomous DEM Update Notifications to
No. By default, the Display
Autonomous DEM Update Notifications is
set to Yes.
Click OK to save the new app configuration settings, and click
OK again to save the portal
configuration.
Make sure you have security policy rules required to
allow the GlobalProtect app to connect to the ADEM service and run
the synthetic tests.
In Panorama, go to Objectsaddresses. Click on Add and add
the following ADEM Service Destination FQDNs.
Do not
decrypt the following servers. Also, make sure the profile allows
untrusted issuers.
Create an address group to contain the addresses above by
going to ObjectsAddress Groups,
clicking Add and providing a name for the
address group.
Add the address group you just created into the security
policy. Go to PoliciesSecurityPreRules. Click Add and
add the address group to the policy.
To enable the GlobalProtect users to connect to and register
with the ADEM service and to run the synthetic application tests,
make sure there is a security policy rule that allows traffic to
HTTPS-based applications.
To enable the app to run network monitoring tests, you must
have a security policy rule to allow ICMP and TCP traffic.
(Optional) If you plan to run synthetic tests that
use HTTP, you must also have a security policy rule to allow the
GlobalProtect users to access applications over HTTP.
Commit all your changes to Panorama and push the configuration changes to Prisma Access.
Click CommitCommit to Panorama.
Click CommitPush to Devices and click Edit Selections.
On the Prisma Access tab, make sure Prisma Access for users is selected and then
click OK.
Click Push.
If you use a third-party EDR, you must allow certain processes on the EDR for ADEM to function properly. Examples of EDRs that require this
include:
