Enable ADEM in Panorama Managed Prisma Access for Mobile Users
Table of Contents
Expand all | Collapse all
- Autonomous DEM
- Products That Use Autonomous DEM
- Set up an Autonomous DEM Application Test
- ADEM Data Collection and Agent Processes
Enable ADEM in Panorama Managed Prisma Access for Mobile Users
Learn how to enable Autonomous DEM for your Panorama
Managed Prisma Access users.
Autonomous
DEM is supported on GlobalProtect app version 5.2.11 with Content
Release version 8393-6628 or later running on Windows or macOS endpoints
only. Because you may not have licensed Autonomous DEM for all of
your mobile users, you might want to create a new app settings configuration
and restrict it to the supported operating systems and the specific
users for which you want to enable ADEM.
After the GlobalProtect
app receives the ADEM configuration, it uses the corresponding certificate
to authenticate to the ADEM service and register with the service.
After the agent registers, you will be able to assign app tests
to the user.
To enable Autonomous DEM for your GlobalProtect
users:
- Generate the certificate the agent will use to authenticate to the Autonomous DEM service.
- From Panorama, select.PanoramaCloud ServicesConfigurationService Setup
- In the GlobalProtect App Log Collection section under Service Operators, clickGenerate Certificate for GlobalProtect App Collection and Autonomous DEM.A confirmation message indicates that the certificate was successfully generated in the Mobile_User_Template Shared location.
- Configure the portal to push the DEM settings to the GlobalProtect agent.
- Select.NetworkGlobalProtectPortalsGlobalProtect Portal
- To create an agent configuration to push to your DEM users only, in theMobile_User_Template, select the GlobalProtect Portal Configuration.
- On theAgenttab, select the DEFAULT agent configuration andCloneit and give it a newName.
- To enable the portal to push the DEM authentication certificate you just generated to the end user systems, on theAuthenticationtab setClient CertificatetoLocaland then select theglobalprotect_app_log_cert.
- To ensure that this agent configuration is only pushed to agents running on supported operating systems, on thetab, clickConfig Selection CriteriaUser/User GroupAddin theOScolumn and selectMacand/orWindowsonly).
- If you only want to deploy the DEM configuration to a subset of your Mac and/or Windows users, in the User/User Group columnAddthe specific users or user groups to push this configuration to.
- To enable Autonomous DEM functionality for the selected users, on theApptab, enableAutonomous DEM endpoint agent for Prisma Access (Windows & Mac Only).Install and user can enable/disable agent from GlobalProtectADEM is enabled by default, however you can allow users to disable ADEM by selectingInstall and user can enable/disable agent from GlobalProtect. End users can use this GlobalProtect configuration to pause/resume monitoring. If users disable the ADEM agent, they will continue to be online, but the agent will pause the monitoring and no synthetic tests will be conducted.Install and user cannot enable/disable agent from GlobalProtectADEM is enabled by default. SelectingInstall and user cannot enable/disable agent from GlobalProtectwill keep ADEM enabled. Users will not be able to disable ADEM.
- Also on theApptab, setEnable Autonomous DEM and GlobalProtect App Log Collection for TroubleshootingtoYesto enable the GlobalProtect app to use the certificate you just created to authenticate to the DEM service.
- Starting in GlobalProtect version 5.2.8, you have the option to suppress receiving all Autonomous DEM update notifications (pertaining to installing, uninstalling and upgrading an agent) on the endpoints. To suppress the notifications, set theDisplay Autonomous DEM Update NotificationstoNo. By default, theDisplay Autonomous DEM Update Notificationsis set toYes.
- ClickOKto save the new app configuration settings and clickOKagain to save the portal configuration.
- Make sure you have security policy rules required to allow the GlobalProtect app to connect to the ADEM service and run the synthetic tests.
- In Panorama, go to. Click onObjectsaddressesAddand add the following ADEM Service Destination FQDNs.Do not decrypt the following servers. Also, make sure the profile allows untrusted issuers.
- agents.dem.prismaaccess.com
- agents.jp1.ap-northeast-1.dem.prismaaccess.com
- agents.sg1.ap-southeast-1.dem.prismaaccess.com
- agents.au1.ap-southeast-2.dem.prismaaccess.com
- agents.ca1.ca-central-1.dem.prismaaccess.com
- agents.eu1.eu-central-1.dem.prismaaccess.com
- agents.uk1.eu-west-2.dem.prismaaccess.com
- agents.us1.us-east-2.dem.prismaaccess.com
- updates.dem.prismaaccess.com
- agents.in1.ap-south-1.dem.prismaaccess.com
- Create an address group to contain the addresses above by going to, clickingObjectsAddress GroupsAddand providing a name for the address group.
- Add the address group you just created into the security policy. Go to. ClickPoliciesSecurityPreRulesAddand add the address group to the policy.
- To enable the GlobalProtect users to connect to and register with the ADEM service and to run the synthetic application tests, make sure there is a security policy rule that allows traffic to HTTPS-based applications.
- To enable the app to run network monitoring tests, you must have a security policy rule to allow ICMP and TCP traffic.
- (Optional) If you plan to run synthetic tests that use HTTP, you must also have a security policy rule to allow the GlobalProtect users to access applications over HTTP.
- Commit all your changes to Panorama and push the configuration changes to Prisma Access.
- Click.CommitCommit to Panorama
- Clickand clickCommitPush to DevicesEdit Selections.
- On the Prisma Access tab, make surePrisma Access for usersis selected and then clickOK.
- ClickPush.