>
    Strata Copilot
    Configure Network Protection
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. Prisma Access Browser Administration
    4. Manage Prisma Browser Policy Profiles
    5. Configure Prisma Browser Security Controls
    6. Configure Network Protection
    Download PDF
    Prisma Browser

    Configure Network Protection

    Table of Contents

    Configure Network Protection

    Configure Network Protection.
    Where Can I Use This?What Do I Need?
    • Strata Cloud Manager
    • Prisma Browser standalone
    • Prisma Access with Prisma Browser bundle license or Prisma Browser standalone license
    • Superuser or Prisma Browser role

    Pages with SSL Errors

    Mobile Browser - Full support
    This feature manages how the Prisma Browser will react when it encounters a page with an SSL error. In general, most browsers ask for permission to "Proceed to [FQDN] (unsafe)".
    Since SSL errors can occur during an SSL MitM attack, you can use this control to block the "Proceed..." functionality.
    1. From Strata Cloud Manager, select ConfigurationPrisma Browser PolicyControlsBrowser Security
    2. Select Pages with SSL Errors.
    3. Select one of the following options:
      • Allow - Allow users to bypass the blocking page when an SSL issue is identified.
      • Block – The Prisma Browser will block the "Proceed..." option when an SSL issue is identified.
    4. Click Set.

    DNS Resolution

    Prisma Browser DesktopPrisma Browser ExtensionPrisma Browser for Mobile
    Full supportNo supportNo support
    The DNS Resolution control configures how Prisma Browser resolves DNS queries. It supports encrypted resolution via DNS-over-HTTPS (DoH), real-time threat protection, and domain exclusions.
    When Palo Alto Networks Advanced DNS Security Resolver is selected, Prisma Browser routes all browser-initiated DNS queries through the Palo Alto Networks Advanced DNS Resolver service using DoH. This provides encrypted resolution and real-time threat protection at the DNS layer — blocking malicious domains before the browser establishes any connection to the destination.
    DNS Security operates independently of the device's local DNS configuration. On unmanaged devices (BYOD, contractor laptops), this provides enterprise-grade DNS protection without requiring endpoint agents or VPN connectivity.
    Changes to DNS resolution settings may affect browsing behavior and network connectivity. Modify only if you understand the impact on your organization's DNS infrastructure.
    1. From Strata Cloud Manager, select ConfigurationPrisma BrowserRules
    2. Select the rule to configure.
    3. Navigate to Browser SecurityBrowser Security ControlsNetwork ProtectionDNS Resolution
    4. Select one of the following options:
      • OS Default — Use the operating system's DNS resolver. No browser-level DNS policy is enforced and DNS queries are sent to the system-configured resolver.
      • DNS-over-HTTPS — Enable encrypted DNS resolution. Select a DoH provider:
        • Palo Alto Networks Advanced DNS Security Resolver — Route all browser-initiated DNS queries through the Palo Alto Networks Advanced DNS Resolver service. Provides encrypted resolution and real-time threat protection. Malicious domains are blocked at the DNS level before Prisma Browser connects to the destination.
        • Custom Resolver — Specify a third-party DNS-over-HTTPS resolver URL. Enter the full HTTPS URL of the DoH resolver endpoint. This option provides encrypted DNS resolution without Palo Alto Networks threat protection.
    5. If you selected DNS-over-HTTPS, configure the failure behavior from the Upon DNS-over-HTTPS resolve failure dropdown:
      • Fail-open: resolve using plain DNS — Prisma Browser reverts to the operating system's default DNS resolver to attempt resolution. Browsing continues without encrypted DNS or threat protection.
      • Fail-close — Prisma Browser blocks DNS resolution entirely. No domains are resolved until the DoH connection is restored.
      When fail-close is selected and the DNS service is unavailable, all browsing stops. To ensure critical domains remain accessible during outages, add them as Internal Domains in the ADNSR configuration or as Private Applications in Prisma Browser configuration. Domains added to these exclusion lists are not scanned by DNS Security and will not receive threat protection.
    6. (Optional) If you selected Palo Alto Networks Advanced DNS Security Resolver, enable Hosts file protection.
      • Disabled (default) — The operating system's default lookup order is used. The local hosts file is queried before the DNS resolver.
      • Enabled — Prisma Browser detects and blocks all requests that resolve via the local hosts file, protecting against hosts file hijacking and redirection attacks (e.g., DNSChanger malware). Local device (localhost) addresses are allowlisted and unaffected.
      This control applies only to Prisma Browser traffic. Other applications on the device are not affected. If the organization relies on hosts file entries for internal routing, do not enable this control or scope it appropriately.
    7. Click Set.
      Why Use Palo Alto Networks Advanced DNS Security?
      DNS is the first step in every web connection — every page load, API call, and resource fetch begins with a DNS query. Palo Alto Networks Advanced DNS Security adds threat protection at this earliest point in the network kill chain, blocking threats before a connection is ever established.
      Key benefits:
      • Earliest-in-chain protection — Malicious domains are blocked at the DNS layer, before any TCP connection, TLS handshake, or content is loaded. This reduces attack surface and saves bandwidth by stopping threats at the first possible checkpoint.
      • Threat categories blocked — Domain Generation Algorithms (DGA), DNS tunneling, command-and-control (C2) domains, newly registered domains (NRDs), and known phishing/malware domains.
      • Device-independent security — Protection is enforced by the browser itself, regardless of the device's local DNS settings, endpoint agents, or network configuration. This is particularly valuable on unmanaged and BYOD devices where no other security stack is present.
      • Complements existing protections — DNS Security operates alongside URL Filtering and Live Page Scanning, adding a distinct detection layer that inspects both DNS requests and responses. Some threat categories (DGA, DNS tunneling) are detected exclusively at the DNS layer.
      • Powered by Palo Alto Networks threat intelligence — The Advanced DNS Resolver leverages machine learning models and threat telemetry from Palo Alto Networks' global customer base, providing continuously updated verdicts without requiring manual policy updates.
      Chromium Built-in DNS Resolver
      The Disable Chromium built-in DNS resolver checkbox controls whether the browser's built-in DNS client is active. When checked, the browser's built-in DNS client is disabled and the OS default DNS resolver is used instead.
      The Chromium built-in DNS resolver is required when DNS-over-HTTPS is enabled. It replaces the OS default DNS client (not the resolution service) to handle DoH queries. This setting is automatically enforced and cannot be disabled while a DoH provider is selected.
      When the OS Default mode is selected, this checkbox is available for manual control by the administrator.
      Private Application DNS Exclusion
      Private applications are excluded from Palo Alto Networks DNS resolution by default. DNS queries for private applications are resolved using the endpoint's system DNS resolver.
      Internal domains can be configured in either of the following locations:
      • Private Applications in Prisma Browser configuration.
      • Internal Domains in the ADNSR configuration in Strata Cloud Manager.
      Prisma Browser checks both lists before resolution. If a domain is found in either list, the browser bypasses DoH and resolves the request using the system DNS.
      Multi-Profile Limitation
      The DNS Resolution configuration is global and shared between all browser profiles. When multiple profiles are active:
      • User attribution of DNS queries may not work as expected — all profiles appear as the same user in ADNS logs.
      • Multiple tenants or mixed ADNS configurations on the same device may cause unexpected DNS resolution errors.
      Interaction with Explicit Proxy
      When Explicit Proxy (EP) is configured for Prisma Browser, the proxy handles all DNS resolution. Palo Alto Networks Advanced DNS Security Resolver is not queried for proxy-routed traffic.
      DNS is the first step in every web connection — every page load, API call, and resource fetch begins with a DNS query. Palo Alto Networks Advanced DNS Security adds threat protection at this earliest point in the network kill chain, blocking threats before a connection is ever established.
      Palo Alto Networks DNS Security applies only to traffic not routed through the proxy:
      • DIRECT traffic — Domains not routed through the proxy.
      • Proxy hostname resolution — The DNS lookup for the proxy server address itself.
      Interaction with Prisma Access Agent
      When the Prisma Access Agent (PAA) is installed on the same device, all endpoint traffic is routed through the Prisma Access tunnel by default unless specifically configured otherwise in the PAA forwarding profile.
      This includes Prisma Browser's DoH traffic to the Advanced DNS Resolver. DNS Security protection remains active — the resolver destination is still ADNSR, only the network path traverses Prisma Access. Prisma Browser does not perform any special routing to bypass PAA.
      If Explicit Proxy is enabled on the Prisma Access Agent, EP takes precedence and handles DNS resolution directly. In this case, ADNSR is not queried by Prisma Browser.
      DNS Security Events
      When Palo Alto Networks Advanced DNS Security Resolver is selected, the following events are generated:
      Event TypeLocationDetails
      Web access events (DNS block)Prisma Browser admin console, Events tabWeb Scan Engine column displays "Advanced DNS Resolver"
      Web access events (Hosts file block)Prisma Browser admin console, Events tabWeb Scan Engine column displays "Hosts file protection"
      Block eventsPrisma Browser admin console, Events tabIndicates the domain was blocked by DNS Security with threat verdict
      DNS query logsStrata Cloud Manager Log Viewer > Network > DNS SecurityAll ADNSR logs (PB and traditional) appear here. Filter by rule labeled "Prisma Browser" to view PB-specific entries
      Strata Logging Service (SLS) is required for all Prisma Browser deployments. For standalone Prisma Browser, SLS is provisioned automatically with the license. ADNSR includes SLS with 1-year log retention for resolver logs.
      User Quota
      Each licensed user has a daily DNS request allocation included with their Prisma Browser Pro license. If your organization expects to exceed this allocation, contact your Palo Alto Networks account team to discuss options.
      Regional Availability
      The Palo Alto Networks Advanced DNS Resolver is available in 19 regions worldwide:
      RegionCode
      Americasamericas
      Europe (EU)eu
      United Kingdomuk
      Australiaau
      Singaporesg
      Canadaca
      Japanjp
      Germanyde
      Indiain
      Francefr
      Polandpl
      Chinacn
      Israelil
      Indonesiaid
      Taiwantw
      Qatarqa
      South Koreakr
      Saudi Arabiasa
      South Africaza
      The resolver automatically selects the nearest optimal point of presence. No manual region configuration is required. Prisma Browser users in regions without a dedicated ADNSR PoP (e.g., Italy, Spain, Switzerland) are automatically routed to the nearest available region.

    Trusted Certificate Authorities

    Mobile Browser - Partial support
    This feature manages how the Prisma Browser manages certificates.
    1. From Strata Cloud Manager, select ConfigurationPrisma Browser PolicyControlsBrowser Security
    2. Select Trusted Certificate Authorities.
    3. Select the certificate authorities that are to be trusted by the Prisma Browser (this limits the trust to certificates that are already trusted):
      • Device trust store - Trust the certificate authorities installed in the device's certificate store.
      • Prisma Access Browser trust store - Trust only certificate authorities that are trusted by Palo Alto Networks, and ignores certificates installed in the Device trust store.
      • None - Do not trust certificates in any trust store.
        Prisma Browser for Mobile rules using this control must use one of the Trust Stores. The None option is ignored.
    4. Additional trusted certificate authorities- Add customer-provided certificates not already trusted by the Prisma Browser.
      1. Enter a name for the certificate.
      2. Drag or Browse a certificate in .pem, .der, .crt, or .cer formats.
    5. Click Set.

    Basic Authentication over HTTP

    Mobile Browser - Full support
    This feature controls whether the Prisma Browser can use Basic Authentication over HTTP websites.
    Since Basic Authentication sends authentication tokens in clear text, sending them over HTTP can be visible to attackers as part of a MitM attack.
    1. From Strata Cloud Manager, select ConfigurationPrisma Browser PolicyControlsBrowser Security
    2. Select Basic Authentication over HTTP.
    3. Select one of the following options:
      • Allow - allow Prisma Browser to use Basic Authentication over HTTP websites.
      • Block – block Prisma Browser from using Basic Authentication over HTTP websites.
    4. Click Set.

    Pages with Insecure Content

    Mobile Browser - No support
    This feature controls whether users can load insecure content (data located on HTTP servers) to secure websites (located on HTTPS servers).
    You can choose to exclude specific domains from this feature when there are specific applications that need an exception to the rule.
    1. From Strata Cloud Manager, select ConfigurationPrisma Browser PolicyControlsBrowser Security
    2. Select Pages with Insecure Content.
    3. Select one of the following options:
      • Allow- Prisma Browser will allow insecure content.
        1. Exclude specific domains - list domains that will receive an exception to the rule.
      • Block – Prisma Browser will not allow insecure content.
        1. Exclude specific domains - list domains that will receive an exception to the rule.
    4. Click Set.

    Force HTTPS

    Mobile Browser - Partial support
    You can force the use of the HTTPS protocol, minimizing the risk of MitM attacks.
    You will be able to force HTTPS for all domains, force HTTPS but exclude certain domains, or disable forced HTTPS and work without any restrictions.
    1. From Strata Cloud Manager, select ConfigurationPrisma Browser PolicyControlsBrowser Security
    2. Select Force HTTPS.
    3. Select one of the following options:
      • Enable- Prisma Browser will require use of the HTTPS protocol.
        You can enter specific domains that will be excluded from this requirement in the Exclude specific Domains field.
        Exclude specific domains is not available for the for Prisma Browser for Mobile.
      • Disable – Prisma Browser will not require use of the HTTPS protocol.
    4. Click Set.

    Post-Quantum Key Support

    Mobile Browser - No support
    This feature manages the ability to enable or disable the use of post-quantum key agreement protocols within TLS (Transport Layer Security). Post-quantum cryptography refers to algorithms designed to be secure against quantum computer attacks, which could potentially break traditional cryptographic methods. While enabling this feature enhances security by preparing for future quantum threats, it may cause compatibility issues with existing network security products that do not yet support or recognize post-quantum algorithms. Disabling it may help avoid these conflicts, but it reduces future-proofing against emerging quantum-based vulnerabilities.
    1. From Strata Cloud Manager, select ConfigurationPrisma Browser PolicyControlsBrowser Security
    2. Select Post-Quantum Key Security.
    3. Select one of the following options:
      1. Enable - Permits the use of Post Quantum Key Security.
      2. Disable - Disables the use of Post Quantum Key Security.
      3. Not set - The feature is not enabled. This is the default setting.
    4. Click Set.

    Kerberos Delegation Allowlist

    Mobile Browser - No support
    List the hosts that may forward a user’s Kerberos ticket to downstream services. When this is enabled, the Kerberos ticket is used in place of your SSO so that back-end services are easier yo use.
    1. From Strata Cloud Manager, select ConfigurationPrisma Browser PolicyControlsBrowser Security
    2. Select Kerberos Delegation Allowlist .
    3. Select one of the following options:
      1. Enable - Activates real-time host scanning of the selected hosts. For information on specifying hosts in the correct pattern, refer to this page. of t.
      2. Disable - Disables the use of the real-time host scanning.
    4. Click Set.

    Remote Host Firewall Traversal.

    Mobile Browser - No support
    This policy controls whether the Remote Desktop can bypass firewalls. When enabled, users can connect remotely from any network. When disabled, access is limited to the same local network or VPN, enhancing security by restricting remote access.
    1. From Strata Cloud Manager, select ConfigurationPrisma Browser PolicyControlsBrowser Security
    2. Select Remote Host Firewall Traversal .
    3. Select one of the following options:
      1. Allow - Allow users to connect remotely from any network.
      2. Block - Remote connection is only permitted from the same local network or VPN.
    4. Click Set.

    Authentication Server Allowlist

    Mobile Browser - No support
    Authentication Server Allowlist allows you to create a comprehensive inventory of servers that are explicitly configured and permitted to utilize Integrated Authentication (IA) protocols, such as Kerberos, for secure access to protected resources.
    For more information, refer to AuthServerAllowlist on the Chrome Enterprise site
    1. From Strata Cloud Manager, select ConfigurationPrisma Browser PolicyProfilesBrowser Security
    2. Select Authentication Server Allowlist .
    3. Select one of the following options:
      • Set server allowlist:
        • Enter the list of specific domains and hosts. Click here for more information on the domain syntax.
      • Unset - Remove the list of domains.
    4. Click Set.

    © 2026 Palo Alto Networks, Inc. All rights reserved.