Enable ADEM to Monitor Remote Sites (Strata Cloud Manager)

Table of Contents

Enable ADEM to Monitor Remote Sites (Strata Cloud Manager)

If you have purchased the Remote Networks license when purchasing ADEM, you can allocate your Remote Networks bandwidth licenses on Prisma Access for each compute location.

To enable Autonomous DEM for Remote Networks in Cloud Managed Prisma Access:

In Strata Cloud Manager, select ConfigurationNGFW and Prisma Access.
From the Configuration Scope menu, select Remote NetworksBandwidth Management
Under the Autonomous DEM column, to enable Remote Networks on a Compute Location, move its slider to the right until it turns blue.
Make sure you have security policy rules required to allow the GlobalProtect app to connect to the ADEM service and run the synthetic tests.
The following screen shows you an example of what fields you need to configure.

You must add the ADEM URLs to make the endpoints register to the ADEM portal.
1. Add a security profile for your access experience agent registration. You will need to create a security policy for it.
  Click Allow All Traffic for ADEM clients.
  
  The Allow All Traffic for ADEM Clients page opens.
2. Add the ADEM URLs.
  To do so, click the + icon under DestinationAddressesADEM URL.
3. The Address Groups page opens. Click the + icon under Address EntitiesAddress.
  
  Add the following URLs one by one by clicking the + icon:
  - agents.dem.prismaaccess.com
  - updates.dem.prismaaccess.com
  - features.dem.prismaaccess.com
  - agents-prod1-us-west2.dem.prismaaccess.com
  - agents-sg1-asia-southeast1.dem.prismaaccess.com
  - agents-au1-australia-southeast1.dem.prismaaccess.com
  - agents-jp1-asia-northeast1.dem.prismaaccess.com
  - agents-ca1-northamerica-northeast1.dem.prismaaccess.com
  - agents-eu1-europe-west4.dem.prismaaccess.com
  - agents-uk1-europe-west2.dem.prismaaccess.com
  - agents-in1-asia-south1.dem.prismaaccess.com
  - agents-de1-europe-west3.dem.prismaaccess.com
  - agents-ch1-europe-west6.dem.prismaaccess.com
  - agents-fr1-europe-west9.dem.prismaaccess.com
4. To enable the app to connect to the ADEM service and to run the application tests, you must have a policy rule to allow the remote sites to connect to applications over HTTPS.
5. To enable the app to run network monitoring tests, you must have a policy rule to allow ICMP and TCP traffic.
6. (Optional) If you plan to run synthetic tests that use HTTP, you must also have a security policy rule to allow the remote sites to access applications over HTTP.
If you use a third-party EDR, you must allow certain processes on the EDR for ADEM to function properly. Examples of EDRs that require this include:
CrowdStrike
Trellix
SentinelOne
After you have configured application test, use the Netsec Health and Application Experience dashboards to monitor the digital experience of users, remote sites, and applications across your SASE environment and use the information to troubleshoot issues as they arise. To access data on Remote Site experience, select View User Experienceunder the User Experience table on the Application Experience page.