GlobalProtect in Tunnel and Proxy Mode
Focus
Focus
Prisma Access

GlobalProtect in Tunnel and Proxy Mode

Table of Contents

GlobalProtect in Tunnel and Proxy Mode

Configure the GlobalProtect app to send internet-bound traffic to explicit proxy and tunnel traffic to your private apps.
Where Can I Use This?
What Do I Need?
  • Prisma Access (Panorama Managed)
  • Prisma Access (Cloud Management)
If you'd like to use this feature in your
Prisma Access
environment, get in touch with your account team to learn more.
  • Prisma Access
    4.0
  • GlobalProtect app version 6.2 for Windows or macOS
  • Content release version 8700-7994
  • Prisma Access
    Mobile User license
In
Tunnel and Proxy
mode, the GlobalProtect app sends internet-bound traffic to the explicit proxy based on the rules you define in a PAC file. For the remaining traffic, it uses the split tunneling rules and logic defined in the PAC file to determine which traffic to send through the tunnel, and which traffic can bypass the tunnel. If you don't have split tunnel rules defined, the app sends all remaining traffic through the tunnel.
When running the GlobalProtect app in Tunnel and Proxy mode, Autonomous DEM (ADEM) functionality is not supported. Host information profile (HIP) functionality is only supported for traffic over a GlobalProtect tunnel.

Cloud Management

Configure GlobalProtect in Tunnel and Proxy Mode.
  1. Enable the agent-based proxy functionality for mobile users on Prisma Access.
    1. Enable explicit proxy.
      1. Select
        Settings
        Prisma Access
        Setup
        Mobile Users
        and click
        Explicit Proxy Setup
        .
        If you're using Strata Cloud Manager, go to
        Workflows
        Prisma Access
        Setup
        Explicit Proxy
        .
      2. In the Infrastructure Settings area, click
        Setup Proxy Settings
        and specify an
        Explicit Proxy URL
        .
    2. Enable Agent Proxy
      and click
      Save
      .
    3. Choose the
      Prisma Access
      where you want to support mobile users.
      For the best user experience, if you are limiting the number of locations, choose locations that are closest to your end users. If a location is not available in the country where your mobile users reside, choose a location that is closest to the mobile users.
    4. Configure a proxy auto-configuration (PAC) file for explicit proxy that meets the following requirements.
      • For your PAC file to work with the GlobalProtect app-based proxy, it cannot exceed 1 MB.
      • The Proxy statement in the PAC file must use the
        Prisma Access
        FQDN you configured above.
      • The PAC file must be configured to exclude the GlobalProtect gateways (
        *.gw.gpcloudservice.com
        ).
      Sample PAC file:
      function FindProxyForURL (url, host) { /* Bypass localhost and Private IPs * / var resolved_ ip = dnsResolve (host) ; if (isplainHostName (host) || shExpMatch (host,"* ‚local") || isInNet (resolved_ip,"10.0.0.0", "255.0.0.0") || isInNet (resolved ip,"172.16.0.0","255.240.0.0") || isInNet (resolved_ip,"192.168.0.0","255.255.0.0") || isInNet (resolved ip, "127.0.0.0", "255.255.255.0" )) return "DIRECT"; /* Bypass Non-HTTP * / if (url.substring (0,4) == "ftp: ") return "DIRECT”; /* Bypass GlobalProtect Gateway */ if (shExpMatch (host, "*.gw.gpcloudservice.com”)) return "DIRECT"; /* Bypass Private Apps */ if (shExpMatch (host,"internalapps.acme.com" ) ) return "DIRECT"; /* Forward to
      Prisma Access
      */ return "PROXY acme-demo.proxy.prismaaccess.com: 8080"
    5. Select
      Settings
      Prisma Access
      Setup
      Explicit Proxy
      Advanced Security Settings - Explicit Proxy
      Authentication Settings
      and add the domains you need to bypass.
      If you're using Strata Cloud Manager, go to
      Workflows
      Prisma Access
      Setup
      Explicit Proxy
      Advanced Security Settings
      Authentication Settings
      .
      All requests to the proxy are authenticated. However, if you're passing IDP flows through the proxy, then you need to bypass them for the authentication to be successful.
      In this example, we're bypassing the GlobalProtect portal and Okta, but please customize these to the IDPs that you use.
  2. Configure Tunnel and Proxy mode for the GlobalProtect app on Prisma Access.
    In Tunnel and Proxy mode, the connect method you set only applies to traffic tunneled through GlobalProtect. The agent-based proxy functionality will provide always-on internet security. Even if you set an on-demand connect method, all internet-bound traffic will still be proxied for always-on internet security even when users disconnect the GlobalProtect app.
    1. Enable GlobalProtect for mobile users and set up the GlobalProtect portal.
    2. Enable GlobalProtect tunnel and proxy mode for
      Prisma Access
      in the GlobalProtect app settings to send internet traffic to the agent-based proxy.
      • Select
        Settings
        Prisma Access
        Setup
        GlobalProtect
        .
        If you're using Strata Cloud Manager, go to
        Workflows
        Prisma Access
        Setup
        GlobalProtect
        .
      • On the
        GlobalProtect App
        tab, click
        Default
        to customize the app settings or
        Add App Settings
        add a new configuration.
      • Click
        Show Advanced Options
        and in the
        App Configuration
        section.
      • In the
        Proxy
        section set
        Agent Mode for
        Prisma Access
        to
        Tunnel and Proxy
        to instruct the GlobalProtect app to send the internet traffic to the explicit proxy on
        Prisma Access
        and private app traffic to the VPN. After you configure the
        Tunnel and Proxy
        mode on Prisma Access, users can securely access the internet via
        Prisma Access
        even when users disconnect or disable the GlobalProtect app.
      • (
        Optional
        ) Configure the local proxy port. The port range is 1024 to 65534 and the default port is 9999. If the default port isn't available, GlobalProtect will try 10 other ports in the range of 9999 to 10009 and use the port that is available. You can also pick your own port number within the range.
      • (
        Optional
        ) Configure PAC Auto-Configuration (PAC) File URL if you want to push the new PAC URL for the proxy settings to the endpoint. The PAC URL pushes to the endpoint once the user connects. When the user disconnects the GlobalProtect app, the endpoint proxy configurations are automatically disabled and reverting to the previous settings.
      • (
        Optional
        ) Enable Allow User to Rediscover Network if you want the user to check the portal for any new settings.
      • (
        Optional
        ) Configure GlobalProtect App Config Refresh Interval (hours). By default, the GlobalProtect client refreshes the cached portal configuration every 24 hours. You can change the refresh interval based on your business requirements.
      • Disable
        Set Up Tunnel Over Proxy (Windows & Mac Only)
        .
    3. In the
      Split Tunnel
      configuration, exclude the proxy FQDN.
      • Select
        Settings
        Prisma Access
        Setup
        GlobalProtect
        .
        If you're using Strata Cloud Manager, go to
        Workflows
        Prisma Access
        Setup
        GlobalProtect
        .
      • On the
        GlobalProtect App
        tab, click
        Default
        to customize the Tunnel Settings or
        Add Tunnel Settings
        add a new configuration.
      • Under
        Exclude Traffic
        ,
        Add Domain
        .
        Replace the FQDN in the image with your proxy FQDN.
  3. Enable Always-On security by configuring the following settings on the
    Settings
    Prisma Access
    Setup
    GlobalProtect
    GlobalProtect App
    Add App Settings
    page:
    If you're using Strata Cloud Manager, go to
    Workflows
    Prisma Access
    Setup
    GlobalProtect
    GlobalProtect App
    Add App Settings
    .
    1. Set Disable GlobalProtect to
      Disallow
      ,
      Allow with Passcode
      , or
      Allow with Ticket
      .
  4. Configure decryption policy for explicit proxy traffic.
    • Select
      Manage
      Security Services
      Decryption
      .
      If you're using Strata Cloud Manager, go to
      Manage
      Configuration
      NGFW and
      Prisma Access
      Security Services
      Decryption
      .
    • If you enable decryption, make sure the decryption certificate is also set up as a trusted root CA.
  5. Configure security policy rules for explicit proxy traffic.
  6. (
    Optional
    ) Configure the GlobalProtect app in Proxy and Tunnel mode in a non-default route network.
    • (
      Optional
      ) Host a PAC file internally and add the
      Prisma Access
      explicit proxy FQDN as a proxy in the PAC file.
    • Forward authentication requests to the internet for the portal and gateway FQDNs and for IdP URLs.
    • Set up routes to the explicit proxy FQDN or IP addresses on perimeter devices to allow users to access the internet via the explicit proxy.
    • (
      Optional
      ) Add DNS records to resolve the
      Prisma Access
      explicit proxy FQDN to an internal IP address if users can’t resolve public domains in the branch network and add destination NAT for the internal IP address to the explicit proxy FQDN or IP address.
    • To enable users to access private apps directly when in the office:
      • Direct Access:
        Enable Internal Host Detection and keep the internal gateway list empty.
  7. Click
    Save
    and
    Push Config
    to
    GlobalProtect
    and
    Explicit Proxy
    .
  8. Verify and troubleshoot the agent proxy deployment.
    1. Verify the information about your network connection on the GlobalProtect app
      Connections
      tab under
      Settings
      .
      1. Open the GlobalProtect app.
      2. Select
        Settings
        to open the GlobalProtect Settings panel, and then select
        Connections
        .
    2. View and collect the GlobalProtect logs.
      View the PanGPS log to verify the proxy mode configuration on the GlobalProtect portal.
      You can verify that Proxy mode is configured by looking for the following event in the PanGPS log:
      OnProxyAgentMode: hybrid mode
      To view GlobalProtect logs in
      Prisma Access
      , select
      Activity
      Logs
      Log Viewer
      and:
      If you're using Strata Cloud Manager, go to
      Incidents & Alerts
      Log Viewer
      .
      • GlobalProtect
        , for authentication logs
      • Traffic
        and
        Decryption
        for user access logs

Panorama

Configure GlobalProtect in Tunnel and Proxy Mode.
If you convert a single-tenant
Prisma Access (Panorama Managed)
deployment to multitenancy, only the first tenant (the tenant you migrated) supports this feature. Also, in this first tenant, you must set up your policy rules in the predefined Explicit_Proxy_Device_Group rather than in a custom device group. Any subsequent tenants you create for the multitenant deployment after the first do not support this feature.
  1. Enable the agent-based proxy functionality for mobile users.
    1. Enable explicit proxy.
      1. Select
        Panorama
        Cloud Services
        Configuration
        Mobile Users—Explicit Proxy
        .
      2. Configure
        the explicit proxy setup to specify an
        Explicit Proxy URL
        .
    2. Select
      Use GlobalProtect app to Authenticate
      to enable the agent-based proxy functionality.
    3. Enter the
      PAC (Proxy Auto-Configuration) File
      URL. Ensure that you enter a port of 8080 in the PAC file.
      • Ensure that you enter a port of 8080 in the PAC file.
      • For your PAC file to work with the GlobalProtect app-based proxy, it cannot exceed 1 MB.
      • The Proxy statement in the PAC file must use the
        Prisma Access
        FQDN you configured above.
      • The PAC file must be configured to exclude the GlobalProtect gateways (*.gp.gpcoudservice.com).
      Sample PAC file:
      function FindProxyForURL (url, host) { /* Bypass localhost and Private IPs * / var resolved_ ip = dnsResolve (host) ; if (isplainHostName (host) || shExpMatch (host,"* ‚local") || isInNet (resolved_ip,"10.0.0.0", "255.0.0.0") || isInNet (resolved ip,"172.16.0.0","255.240.0.0") || isInNet (resolved_ip,"192.168.0.0","255.255.0.0") || isInNet (resolved ip, "127.0.0.0", "255.255.255.0" )) return "DIRECT"; /* Bypass Non-HTTP * / if (url.substring (0,4) == "ftp: ") return "DIRECT”; /* Bypass GlobalProtect Gateway */ if (shExpMatch (host, "*.gw.gpcloudservice.com”)) return "DIRECT"; /* Bypass Private Apps */ if (shExpMatch (host,"internalapps.acme.com" ) ) return "DIRECT"; /* Forward to
      Prisma Access
      */ return "PROXY acme-demo.proxy.prismaaccess.com: 8080";}
    4. Select the
      Connection Name
      for the explicit proxy setup that you configured.
    5. Select the
      Locations
      and the regions where you want to deploy your explicit proxy for mobile users.
      Prisma Access
      adds a proxy node into each location that you select. Explicit proxy supports a subset of all
      Prisma Access
      . For the best user experience, if you are limiting the number of locations, choose locations that are closest to your end users. If a location is not available in the country where your mobile users reside, choose a location that is closest to the mobile users.
  2. Bypass identity providers (IDPs).
    All requests to the proxy are authenticated. However, if you're passing IDP flows through the proxy, then you need to bypass them for the authentication to be successful.
    In this example, we're bypassing the GlobalProtect portal and Okta, but please customize these to the IDPs that you use.
    1. With the
      Explicit_Proxy_Device_Group
      selected, select
      Object
      Custom Objects
      URL Category
      and create a custom URL category.
    2. In the custom URL category, add all the FQDN domains that need to be bypassed from EP authentication.
    3. Select
      Cloud Services
      Configuration
      Mobile Users
      Explicit Proxy
      Settings
      Authentication Settings
      and attach the custom URL category.
    4. Commit and push to the
      Explicit_Proxy_Device_Group
      .
  3. Configure the GlobalProtect portal.
    In Tunnel and Proxy mode, the connect method you set only applies to traffic tunneled through GlobalProtect. The agent-based proxy functionality will provide always-on internet security. Even if you set an on-demand connect method, all internet-bound traffic will still be proxied for always-on internet security even when users disconnect the GlobalProtect app.
    1. In the Onboarding section, click
      Configure
      .
    2. On the
      General
      tab, specify the
      Portal Name Type
      :
      Use Default Domain—
      If you select this option, your portal hostname uses the default domain name: .gpcloudservice.com. In this case, simply enter a Portal hostname to append to the default domain name.
      Prisma Access
      will automatically create the necessary certificates and publish the hostname to public DNS servers.
      Use Company Domain—
      Select this option if you want the domain in the portal hostname to match your company domain name (for example, myportal.mydomain.com).
    3. Select an
      Authentication Profile
      that specifies how
      Prisma Access
      should authenticate mobile users or create a new one.
    4. (
      Optional
      ) Select an
      Authentication Override Certificate
      to encrypt the secure cookies that mobile users use to authenticate to the portal and gateway.
    1. Enable Tunnel and Proxy mode on GlobalProtect.
      1. Select
        Network
        GlobalProtect Portals
        .
      2. Select the portal configuration to which you are adding the agent configuration, and then select the
        Agent
        tab.
      3. On the
        Agent
        tab, select
        App
        .
      4. In the App Configurations area, set the
        Agent Mode for Prisma Access
        to
        Tunnel and Proxy
        to send internet traffic to the Prisma Access explicit proxy and private app traffic to the VPN.
    2. Perform optional configurations.
      1. (
        Optional
        ) Configure the local proxy port. The port range is 1024 to 65534 and the default port is 9999. If the default port isn't available, GlobalProtect will try 10 other ports in the range of 9999 to 10009 and use the port that is available. You can also pick your own port number within the range.
      2. (
        Optional
        ) Configure PAC Auto-Configuration (PAC) File URL if you want to push a custom PAC URL for the proxy settings to the endpoint. The PAC URL pushes to the endpoint once the user connects. When the user disconnects the GlobalProtect app, the endpoint proxy configurations are automatically disabled and reverting to the previous settings.
      3. (
        Optional
        ) Enable Allow User to Rediscover Network if you want the user to check the portal for any new settings.
      4. (
        Optional
        ) Configure GlobalProtect App Config Refresh Interval (hours). By default, the GlobalProtect client refreshes the cached portal configuration every 24 hours. You can change the refresh interval based on your business requirements.
    3. In the split tunnel configuration, exclude the proxy FQDN.
  4. Enable Always-On internet security by configuring the following settings:
    1. Set Allow User to Disable GlobalProtect to
      Disallow
      ,
      Allow with Passcode
      , or
      Allow with Ticket
      .
  5. (
    Optional
    ) Configure decryption policy for explicit proxy traffic.
    If you enable decryption, make sure the decryption certificate is also set up as a trusted root CA.
    1. Select
      Device
      Certificate Management
      Certificates
      and create a certificate that is a Trusted Root CA and a Forward Trust Certificate.
    2. Create a Decryption rule under
      Explicit_Proxy_Device Group
      with SSL forward proxy.
  6. Configure security policy rules for explicit proxy traffic.
  7. Configure split tunnel on Panorama.
    1. Select
      Network
      Mobile User Template
      Gateways
      GlobalProtect_ExternalGateway
      Agent
      Client Settings
      Split
      .
    2. Configure the tunnel based on routes and domains.
  8. (
    Optional
    ) Configure the GlobalProtect app in Tunnel and Proxy mode in a non-default route network.
    • (
      Optional
      ) Host a PAC file internally and add the
      Prisma Access
      explicit proxy FQDN as a proxy in the PAC file.
    • Verify that GlobalProtect portal URL and IDP URLs are being forwarded to the
      Prisma Access
      Explicit Proxy.
    • Set up routes to the explicit proxy FQDN or IP addresses on perimeter devices to allow users to access the internet via the explicit proxy.
    • (
      Optional
      ) Add DNS records to resolve the
      Prisma Access
      explicit proxy FQDN to an internal IP address if users can’t resolve public domains in the branch network and add destination NAT for the internal IP address to the explicit proxy FQDN or IP address.
    • To enable users to access private apps directly when in the office:
      • Direct Access
        —Enable Internal Host Detection and keep the internal gateway list empty.
  9. Commit
    and your changes to Panorama and
    Commit and Push
    the configuration changes to Prisma Access
    Mobile Users
    and
    Explicit Proxy
    .
  10. Verify and troubleshoot the agent proxy deployment.
    1. Verify the information about your network connection on the GlobalProtect app
      Connections
      tab under
      Settings
      .
      1. Open the GlobalProtect app.
      2. Select
        Settings
        to open the GlobalProtect Settings panel, and then select
        Connections
        .
    2. View and collect the GlobalProtect logs
      View the PanGPS log to verify the proxy mode configuration on the GlobalProtect portal.
      You can verify fthat Proxy mode is configured by looking for the following event in the PanGPS log:
      OnProxyAgentMode: hybrid mode
      To view GlobalProtect logs in Panorama, select
      Monitor
      Logs
      and:
      • GlobalProtect
        , for authentication logs
      • Traffic
        and
        Decryption
        for user access logs

Recommended For You