>
    GlobalProtect in Tunnel and Proxy Mode
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access
    3. Prisma Access Administration
    4. Prisma Access Mobile Users
    5. Mobile Users: Explicit Proxy
    6. GlobalProtect in Tunnel and Proxy Mode
    Download PDF
    Prisma Access

    GlobalProtect in Tunnel and Proxy Mode

    Table of Contents

    GlobalProtect in Tunnel and Proxy Mode

    Configure the GlobalProtect app to send internet-bound traffic to explicit proxy and tunnel traffic to your private apps.
    Where Can I Use This?What Do I Need?
    • Prisma Access (Managed by Panorama)
    • Prisma Access (Managed by Strata Cloud Manager)
    If you'd like to use this feature in your Prisma Access environment, get in touch with your account team to learn more.
    • Prisma Access 5.2
    • GlobalProtect app version 6.2 for Windows or macOS
    • Content release version 8700-7994
    • Prisma Access Mobile User license
    In Tunnel and Proxy mode, the GlobalProtect app sends internet-bound traffic to the explicit proxy based on the rules you define in a PAC file. For the remaining traffic, it uses the split tunneling rules and logic defined in the PAC file to determine which traffic to send through the tunnel, and which traffic can bypass the tunnel. If you don't have split tunnel rules defined, the app sends all remaining traffic through the tunnel.
    When running the GlobalProtect app in Tunnel and Proxy mode, host information profile (HIP) functionality is only supported for traffic over a GlobalProtect tunnel.
    You need Strata Cloud Manager and GlobalProtect agent version 6.3.0 for GlobalProtect Proxy channel to support all the IPv4 TCP connections, including non-proxy-aware traffic. To ensure seamless functionality, the DNS configured on the endpoints must be able to resolve destination FQDN.

    GlobalProtect in Tunnel and Proxy Mode (Strata Cloud Manager)

    Configure GlobalProtect in Tunnel and Proxy Mode.
    1. Enable the Agent-based Proxy functionality for mobile users on Prisma Access.
      1. Enable explicit proxy.
        1. Select WorkflowsPrisma Access SetupExplicit Proxy.
        2. In the Infrastructure Settings area, click Setup Proxy Settings and specify an Explicit Proxy URL.
      2. Enable Agent Proxy , and optionally Enable Private IP based visibility and enforcement, and click Save.
      3. Choose the Prisma Access where you want to support mobile users.
        For the best user experience, if you're limiting the number of locations, choose locations that are closest to your end users. If a location isn't available in the country where your mobile users reside, choose a location that's closest to the mobile users.
      4. Create a Forwarding Profile to define the traffic you want to send through Explicit Proxy. While configuring the forwarding profile, bypass *.prismaaccess.com and *.gpcloudservice.com domains.
      5. Attach the Forwarding Profile to your GlobalProtect app configuration.
      6. Select WorkflowsPrisma Access Setup Explicit ProxyAdvanced Security Settings Authentication Settings and add the domains you need to bypass.
        All requests to the proxy undergo authentication. However, if you're passing IdP flows through the proxy, then you need to bypass them for the authentication to be successful.
        In this example, we are bypassing the GlobalProtect portal and Okta, but please customize these to the IdPs that you use.
    2. Configure Tunnel and Proxy mode for the GlobalProtect app on Prisma Access.
      In Tunnel and Proxy mode, the connect method you set only applies to traffic tunneled through GlobalProtect. The agent-based proxy functionality will provide always-on internet security. Even if you set an on-demand connect method, all internet-bound traffic will still be proxied for always-on internet security even when users disconnect the GlobalProtect app.
      1. Select WorkflowsPrisma Access SetupGlobalProtectInfrastructureInfrastructure Settings and specify the Portal Name.
        • Default Domain—If you select this option, your portal hostname uses the default domain name: .gpcloudservice.com. In this case, simply enter a Portal Hostname to append to the default domain name. Prisma Access for Users will automatically create the necessary certificates and publish the hostname to public DNS servers.
        • Custom Domain—You can also customize the portal address if you want the domain in the portal hostname to match your company domain name (for example, myportal.mydomain.com).
      2. Enable mobile users to authenticate to Prisma Access.
      3. Enable GlobalProtect tunnel and proxy mode for Prisma Access in the GlobalProtect app settings to send internet traffic to the agent-based proxy.
        • Select WorkflowsPrisma Access SetupGlobalProtect.
        • On the GlobalProtect App tab, click Default to customize the app settings or Add App Settings add a new configuration.
        • Click Show Advanced Options and in the App Configuration section.
        • In the Proxy section set Agent Mode for Prisma Access to Tunnel and Proxy to instruct the GlobalProtect app to send the internet traffic to the explicit proxy on Prisma Access and private app traffic to the VPN. After you configure the Tunnel and Proxy mode on Prisma Access, users can securely access the internet via Prisma Access even when users disconnect or disable the GlobalProtect app.
        • (Optional) Configure the local proxy port. The port range is 1024 to 65534 and the default port is 9999. If the default port isn't available, GlobalProtect will try 10 other ports in the range of 9999 to 10009 and use the port that is available. You can also pick your own port number within the range.
        • (Optional) Configure PAC Auto-Configuration (PAC) File URL if you want to push the new PAC URL for the proxy settings to the endpoint. The PAC URL pushes to the endpoint once the user connects. When the user disconnects the GlobalProtect app, the endpoint proxy configurations are automatically disabled and reverting to the previous settings.
        • (Optional) Enable Allow User to Rediscover Network if you want the user to check the portal for any new settings.
        • (Optional) Configure GlobalProtect App Config Refresh Interval (hours). By default, the GlobalProtect client refreshes the cached portal configuration every 24 hours. You can change the refresh interval based on your business requirements.
        • Disable Set Up Tunnel Over Proxy (Windows & Mac Only).
      4. In the Split Tunnel configuration, exclude the Explicit Proxy FQDN and the PAC file FQDN.
        • Select WorkflowsPrisma Access SetupGlobalProtect.
        • On the GlobalProtect App tab, click Default to customize the Tunnel Settings or Add Tunnel Settings add a new configuration.
        • Under Exclude Traffic, Add Domain.
          Replace the FQDN in the image with your proxy FQDN.
    3. Enable Always-On security by configuring the following settings on the WorkflowsPrisma Access SetupGlobalProtectGlobalProtect AppAdd App Settings page:
      1. Set Disable GlobalProtect to Disallow, Allow with Passcode, or Allow with Ticket.
      2. Disable Allow user to Sign Out from GlobalProtect App.
    4. Configure decryption for Explicit Proxy traffic.
      • Select ManageConfigurationNGFW and Prisma AccessSecurity ServicesDecryption.
      • If you enable decryption, make sure you set up the decryption certificate as a trusted root CA.
    5. Configure security policy rules for explicit proxy traffic.
    6. (Optional) Configure the GlobalProtect app in Proxy and Tunnel mode in a non-default route network.
      • (Optional) Host a PAC file internally and add the Prisma Access explicit proxy FQDN as a proxy in the PAC file, or host the PAC file in a Forwarding Profile and add routes in your network for PAC service IP addresses.
      • Forward authentication requests to the internet for the portal and gateway FQDNs and for IdP URLs.
      • Set up routes to the explicit proxy FQDN or IP addresses on perimeter devices to allow users to access the internet via the explicit proxy.
      • (Optional) Add DNS records to resolve the Prisma Access explicit proxy FQDN to an internal IP address if users can’t resolve public domains in the branch network and add destination NAT for the internal IP address to the explicit proxy FQDN or IP address.
      • To enable users to access private apps directly when in the office:
        • Direct Access: Enable Internal Host Detection and keep the internal gateway list empty.
    7. Click Save and Push Config to GlobalProtect and Explicit Proxy.
    8. Verify and troubleshoot the agent proxy deployment.
      1. Verify the information about your network connection on the GlobalProtect app Connections tab under Settings.
        1. Open the GlobalProtect app.
        2. Select Settings to open the GlobalProtect Settings panel, and then select Connections.
      2. View and collect the GlobalProtect logs.
        View the PanGPS log to verify the proxy mode configuration on the GlobalProtect portal.
        You can verify that Proxy mode is configured by looking for the following event in the PanGPS log:
        OnProxyAgentMode: hybrid mode
        To view GlobalProtect logs in Prisma Access, select Incidents & AlertsLog Viewer and:
        • GlobalProtect, for authentication logs
        • Traffic and Decryption for user access logs
      Disconnect and Disable Tunnel and Proxy Mode with Always-On Connect Method
      Starting from GlobalProtect version 6.3.1, when you configure Tunnel and Proxy mode for the GlobalProtect app along with Always-On mode as the connect method and you want to disconnect the tunnel and proxy mode, you must perform the following steps:
      1. Disconnect the GlobalProtect app to disconnect the tunnel (VPN) connection. When you disconnect the app, the tunnel (VPN) connection gets disconnected and the app will still be connected through the proxy mode.
      2. Disable the GlobalProtect app to disconnect both the tunnel and proxy mode. When you disable the app, both the tunnel and proxy mode will be disconnected and the app will not be connected anymore.
      To disconnect and disable the GlobalProtect app configured with Tunnel and Proxy (hybrid mode) and Always-On connect method, you must:
      1. Disconnect the GlobalProtect app using the Disconnect option from the hamburger menu. When you disconnect the app, the tunnel (VPN) connection gets disconnected.
        After you disconnect the app, the VPN connection gets disconnected but the proxy mode is enabled. The app will still be connected through the proxy mode and the app displays the status as Enabled.
        If you want to reconnect the tunnel (VPN) connection, you can use the Connect option from the hamburger menu.
      2. Disable the app GlobalProtect app using the Disable option from the hamburger menu. After you disable the app, both the tunnel and proxy connection gets disconnected.
      The app will be disabled and it displays the status as Disabled.

    GlobalProtect in Tunnel and Proxy Mode (Panorama)

    Configure GlobalProtect in Tunnel and Proxy Mode.
    If you convert a single-tenant Prisma Access (Managed by Panorama) deployment to multitenancy, only the first tenant (the tenant you migrated) supports this feature. Also, in this first tenant, you must set up your policy rules in the predefined Explicit_Proxy_Device_Group rather than in a custom device group. Any subsequent tenants you create for the multitenant deployment after the first do not support this feature.
    1. Enable the Agent-based Proxy functionality for mobile users.
      1. Enable explicit proxy.
        1. Select PanoramaCloud ServicesConfigurationMobile Users—Explicit Proxy.
        2. Configure the explicit proxy setup to specify an Explicit Proxy URL.
      2. Select Use GlobalProtect app to Authenticate to enable the agent-based proxy functionality, and optionally Enable Source IP based Visibility and Enforcement from Sites.
      3. Enter the PAC (Proxy Auto-Configuration) File URL. Ensure that you enter a port of 8080 in the PAC file.
        • The Proxy statement in the PAC file must use the Prisma Access FQDN you configured above.
        • The PAC file must be configured to exclude the GlobalProtect gateways (*.gp.gpcoudservice.com).
      4. Select the Connection Name for the explicit proxy setup that you configured.
      5. Select the Locations and the regions where you want to deploy your explicit proxy for mobile users.
        Prisma Access adds a proxy node into each location that you select. Explicit proxy supports a subset of all Prisma Access. For the best user experience, if you are limiting the number of locations, choose locations that are closest to your end users. If a location is not available in the country where your mobile users reside, choose a location that is closest to the mobile users.
    2. Bypass identity providers (IDPs).
      All requests to the proxy are authenticated. However, if you're passing IDP flows through the proxy, then you need to bypass them for the authentication to be successful.
      In this example, we're bypassing the GlobalProtect portal and Okta, but please customize these to the IDPs that you use.
      1. With the Explicit_Proxy_Device_Group selected, select ObjectCustom Objects URL Category and create a custom URL category.
      2. In the custom URL category, add all the FQDN domains that need to be bypassed from EP authentication.
      3. Select Cloud ServicesConfiguration Mobile UsersExplicit ProxySettingsAuthentication Settings and attach the custom URL category.
      4. Commit and push to the Explicit_Proxy_Device_Group.
    3. Configure the GlobalProtect portal.
      In Tunnel and Proxy mode, the connect method you set only applies to traffic tunneled through GlobalProtect. The agent-based proxy functionality will provide always-on internet security. Even if you set an on-demand connect method, all internet-bound traffic will still be proxied for always-on internet security even when users disconnect the GlobalProtect app.
      1. In the Onboarding section, click Configure.
      2. On the General tab, specify the Portal Name Type:
        Use Default Domain— If you select this option, your portal hostname uses the default domain name: .gpcloudservice.com. In this case, simply enter a Portal hostname to append to the default domain name. Prisma Access will automatically create the necessary certificates and publish the hostname to public DNS servers.
        Use Company Domain— Select this option if you want the domain in the portal hostname to match your company domain name (for example, myportal.mydomain.com).
      3. Select an Authentication Profile that specifies how Prisma Access should authenticate mobile users or create a new one.
      4. (Optional) Select an Authentication Override Certificate to encrypt the secure cookies that mobile users use to authenticate to the portal and gateway.
      1. Enable Tunnel and Proxy mode on GlobalProtect.
        1. Select NetworkGlobalProtect Portals.
        2. Select the portal configuration to which you are adding the agent configuration, and then select the Agent tab.
        3. On the Agenttab, select App.
        4. In the App Configurations area, set the Agent Mode for Prisma Access to Tunnel and Proxy to send internet traffic to the Prisma Access explicit proxy and private app traffic to the VPN.
      2. Perform optional configurations.
        1. (Optional) Configure the local proxy port. The port range is 1024 to 65534 and the default port is 9999. If the default port isn't available, GlobalProtect will try 10 other ports in the range of 9999 to 10009 and use the port that is available. You can also pick your own port number within the range.
        2. (Optional) Configure PAC Auto-Configuration (PAC) File URL if you want to push a custom PAC URL for the proxy settings to the endpoint. The PAC URL pushes to the endpoint once the user connects. When the user disconnects the GlobalProtect app, the endpoint proxy configurations are automatically disabled and reverting to the previous settings.
        3. (Optional) Enable Allow User to Rediscover Network if you want the user to check the portal for any new settings.
        4. (Optional) Configure GlobalProtect App Config Refresh Interval (hours). By default, the GlobalProtect client refreshes the cached portal configuration every 24 hours. You can change the refresh interval based on your business requirements.
      3. In the split tunnel configuration, exclude the Explicit Proxy FQDN and the PAC file FQDN.
    4. Enable Always-On internet security by configuring the following settings:
      1. Set Allow User to Disable GlobalProtect to Disallow, Allow with Passcode, or Allow with Ticket.
      2. Set Allow user to Sign Out from GlobalProtect App to No.
    5. (Optional) Configure decryption policy for explicit proxy traffic.
      If you enable decryption, make sure the decryption certificate is also set up as a trusted root CA.
      1. Select DeviceCertificate ManagementCertificates and create a certificate that is a Trusted Root CA and a Forward Trust Certificate.
      2. Create a Decryption rule under Explicit_Proxy_Device Group with SSL forward proxy.
    6. Configure security policy rules for explicit proxy traffic.
    7. Configure split tunnel on Panorama.
      1. Select NetworkMobile User TemplateGatewaysGlobalProtect_ExternalGatewayAgentClient SettingsSplit .
      2. Configure the tunnel based on routes and domains.
    8. (Optional) Configure the GlobalProtect app in Tunnel and Proxy mode in a non-default route network.
      • (Optional) Host a PAC file internally and add the Prisma Access explicit proxy FQDN as a proxy in the PAC file, or host the PAC file in a Forwarding Profile and add routes in your network for PAC service IP addresses.
      • Verify that GlobalProtect portal URL and IDP URLs are being forwarded to the Prisma Access Explicit Proxy.
      • Set up routes to the explicit proxy FQDN or IP addresses on perimeter devices to allow users to access the internet via the explicit proxy.
      • (Optional) Add DNS records to resolve the Prisma Access explicit proxy FQDN to an internal IP address if users can’t resolve public domains in the branch network and add destination NAT for the internal IP address to the explicit proxy FQDN or IP address.
      • To enable users to access private apps directly when in the office:
        • Direct Access—Enable Internal Host Detection and keep the internal gateway list empty.
    9. Commit and your changes to Panorama and Commit and Push the configuration changes to Prisma Access Mobile Users and Explicit Proxy.
    10. Verify and troubleshoot the agent proxy deployment.
      1. Verify the information about your network connection on the GlobalProtect app Connections tab under Settings.
        1. Open the GlobalProtect app.
        2. Select Settings to open the GlobalProtect Settings panel, and then select Connections.
      2. View and collect the GlobalProtect logs
        View the PanGPS log to verify the proxy mode configuration on the GlobalProtect portal.
        You can verify fthat Proxy mode is configured by looking for the following event in the PanGPS log:
        OnProxyAgentMode: hybrid mode
        To view GlobalProtect logs in Panorama, select Monitor Logs and:
        • GlobalProtect, for authentication logs
        • Traffic and Decryption for user access logs
      Disconnect and Disable Tunnel and Proxy Mode with Always-On Connect Method
      Starting from GlobalProtect version 6.3.1, when you configure Tunnel and Proxy mode for the GlobalProtect app along with Always-On mode as the connect method and you want to disconnect the tunnel and proxy mode, you must perform the following steps:
      1. Disconnect the GlobalProtect app to disconnect the tunnel (VPN) connection. When you disconnect the app, the tunnel (VPN) connection gets disconnected and the app will still be connected through the proxy mode.
      2. Disable the GlobalProtect app to disconnect both the tunnel and proxy mode. When you disable the app, both the tunnel and proxy mode will be disconnected and the app will not be connected anymore.
      To disconnect and disable the GlobalProtect app configured with Tunnel and Proxy (hybrid mode) and Always-On connect method, you must:
      1. Disconnect the GlobalProtect app using the Disconnect option from the hamburger menu. When you disconnect the app, the tunnel (VPN) connection gets disconnected.
        After you disconnect the app, the VPN connection gets disconnected but the proxy mode is enabled. The app will still be connected through the proxy mode and the app displays the status as Enabled.
        If you want to reconnect the tunnel (VPN) connection, you can use the Connect option from the hamburger menu.
      2. Disable the app GlobalProtect app using the Disable option from the hamburger menu. After you disable the app, both the tunnel and proxy connection gets disconnected.
      The app will be disabled and it displays the status as Disabled.

    © 2025 Palo Alto Networks, Inc. All rights reserved.