Enable ADEM in Panorama Managed Prisma Access for Mobile
Learn how to enable Autonomous DEM for your Panorama Managed Prisma Access users.
Autonomous DEM is supported on GlobalProtect app version 5.2.11 with Content Release version 8393-6628 or later running on Windows or macOS endpoints only. Because you may not have licensed Autonomous DEM for all of your mobile users, you might want to create a new app settings configuration and restrict it to the supported operating systems and the specific users for which you want to enable ADEM.
After the GlobalProtect app receives the ADEM configuration, it uses the corresponding certificate to authenticate to the ADEM service and register with the service. After the agent registers, you will be able to assign app tests to the user.
To enable Autonomous DEM for your GlobalProtect users:
- Generate the certificate the agent will use to authenticate to the Autonomous DEM service.
- From Panorama, select.PanoramaCloud ServicesConfigurationService Setup
- In the GlobalProtect App Log Collection section under Service Operators, clickGenerate Certificate for GlobalProtect App Collection and Autonomous DEM.A confirmation message indicates that the certificate was successfully generated in the Mobile_User_Template Shared location.
- Configure the portal to push the DEM settings to the GlobalProtect agent.
- Select.NetworkGlobalProtectPortalsGlobalProtect Portal
- To create an agent configuration to push to your DEM users only, in theMobile_User_Template, select the GlobalProtect Portal Configuration.
- On theAgenttab, select the DEFAULT agent configuration andCloneit and give it a newName.
- To enable the portal to push the DEM authentication certificate you just generated to the end user systems, on theAuthenticationtab setClient CertificatetoLocaland then select theglobalprotect_app_log_cert.
- To ensure that this agent configuration is only pushed to agents running on supported operating systems, on thetab, clickConfig Selection CriteriaUser/User GroupAddin theOScolumn and selectMacand/orWindowsonly).
- If you only want to deploy the DEM configuration to a subset of your Mac and/or Windows users, in the User/User Group columnAddthe specific users or user groups to push this configuration to.
- To enable Autonomous DEM functionality for the selected users, on theApptab, enableAutonomous DEM endpoint agent for Prisma Access (Windows & Mac Only).You can select whether to let users enable and disable ADEM by selectingInstall and user can enable/disable agent from GlobalProtectorInstall and user cannot enable/disable agent from GlobalProtect.
- Also on theApptab, setEnable Autonomous DEM and GlobalProtect App Log Collection for TroubleshootingtoYesto enable the GlobalProtect app to use the certificate you just created to authenticate to the DEM service.
- Starting in GlobalProtect version 5.2.8, you have the option to suppress receiving all Autonomous DEM update notifications (pertaining to installing, uninstalling and upgrading an agent) on the endpoints. To suppress the notifications, set theDisplay Autonomous DEM Update NotificationstoNo. By default, theDisplay Autonomous DEM Update Notificationsis set toYes.
- ClickOKto save the new app configuration settings and clickOKagain to save the portal configuration.
- Make sure you have security policy rules required to allow the GlobalProtect app to connect to the ADEM service and run the synthetic tests.
- In Panorama, go to. Click onObjectsaddressesAddand add the following ADEM Service Destination FQDNs.
- Create an address group to contain the addresses above by going to, clickingObjectsAddress GroupsAddand providing a name for the address group.
- Add the address group you just created into the security policy. Go to. ClickPoliciesSecurityPreRulesAddand add the address group to the policy.
- To enable the GlobalProtect users to connect to and register with the ADEM service and to run the synthetic application tests, make sure there is a security policy rule that allows traffic to HTTPS-based applications.
- To enable the app to run network monitoring tests, you must have a security policy rule to allow ICMP and TCP traffic.
- (Optional) If you plan to run synthetic tests that use HTTP, you must also have a security policy rule to allow the GlobalProtect users to access applications over HTTP.
- Commit all your changes to Panorama and push the configuration changes to Prisma Access.
- Click.CommitCommit to Panorama
- Clickand clickCommitPush to DevicesEdit Selections.
- On the Prisma Access tab, make surePrisma Access for usersis selected and then clickOK.
Recommended For You
Recommended videos not found.