Prisma Access
Cloud Management
Table of Contents
Expand All
|
Collapse All
Prisma Access Docs
-
- Prisma Access China
- 4.0 & Later
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
-
-
-
- 5.0 Preferred and Innovation
- 4.2 Preferred
- 4.1 Preferred
- 4.0 Preferred
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
Cloud Management
Cloud Management
Configure GlobalProtect in Tunnel and Proxy Mode.
- Enable the agent-based proxy functionality for mobile users on Prisma Access.
- Enable explicit proxy.
- Selectand clickSettingsPrisma AccessSetupMobile UsersExplicit Proxy Setup.If you're using Strata Cloud Manager, go to.WorkflowsPrisma AccessSetupExplicit Proxy
- In the Infrastructure Settings area, clickSetup Proxy Settingsand specify anExplicit Proxy URL.
- Enable Agent Proxyand clickSave.
- Choose thePrisma Accesswhere you want to support mobile users.For the best user experience, if you're limiting the number of locations, choose locations that are closest to your end users. If a location isn't available in the country where your mobile users reside, choose a location that's closest to the mobile users.
- Configure a proxy auto-configuration (PAC) file for explicit proxy that meets the following requirements.
- For your PAC file to work with the GlobalProtect app-based proxy, it can't exceed 1 MB.
- The Proxy statement in the PAC file must use thePrisma AccessFQDN you configured above.
- Configure the PAC file to exclude the GlobalProtect gateways (*.gw.gpcloudservice.com).
- Selectand add the domains you need to bypass.SettingsPrisma AccessSetupExplicit ProxyAdvanced Security Settings - Explicit ProxyAuthentication SettingsIf you're using Strata Cloud Manager, go to.WorkflowsPrisma AccessSetupExplicit ProxyAdvanced Security SettingsAuthentication SettingsAll requests to the proxy are authenticated. However, if you're passing IDP flows through the proxy, then you need to bypass them for the authentication to be successful.In this example, we're bypassing the GlobalProtect portal and Okta, but please customize these to the IDPs that you use.
- Configure Tunnel and Proxy mode for the GlobalProtect app on Prisma Access.In Tunnel and Proxy mode, the connect method you set only applies to traffic tunneled through GlobalProtect. The agent-based proxy functionality will provide always-on internet security. Even if you set an on-demand connect method, all internet-bound traffic will still be proxied for always-on internet security even when users disconnect the GlobalProtect app.
- Enable GlobalProtect for mobile users and set up the GlobalProtect portal.
- Enable GlobalProtect tunnel and proxy mode forPrisma Accessin the GlobalProtect app settings to send internet traffic to the agent-based proxy.
- Select.SettingsPrisma AccessSetupGlobalProtectIf you're using Strata Cloud Manager, go to.WorkflowsPrisma AccessSetupGlobalProtect
- On theGlobalProtect Apptab, clickDefaultto customize the app settings orAdd App Settingsadd a new configuration.
- ClickShow Advanced Optionsand in theApp Configurationsection.
- In theProxysection setAgent Mode fortoPrisma AccessTunnel and Proxyto instruct the GlobalProtect app to send the internet traffic to the explicit proxy onPrisma Accessand private app traffic to the VPN. After you configure theTunnel and Proxymode on Prisma Access, users can securely access the internet viaPrisma Accesseven when users disconnect or disable the GlobalProtect app.
- (Optional) Configure the local proxy port. The port range is 1024 to 65534 and the default port is 9999. If the default port isn't available, GlobalProtect will try 10 other ports in the range of 9999 to 10009 and use the port that is available. You can also pick your own port number within the range.
- (Optional) Configure PAC Auto-Configuration (PAC) File URL if you want to push the new PAC URL for the proxy settings to the endpoint. The PAC URL pushes to the endpoint once the user connects. When the user disconnects the GlobalProtect app, the endpoint proxy configurations are automatically disabled and reverting to the previous settings.
- (Optional) Enable Allow User to Rediscover Network if you want the user to check the portal for any new settings.
- (Optional) Configure GlobalProtect App Config Refresh Interval (hours). By default, the GlobalProtect client refreshes the cached portal configuration every 24 hours. You can change the refresh interval based on your business requirements.
- DisableSet Up Tunnel Over Proxy (Windows & Mac Only).
- In theSplit Tunnelconfiguration, exclude the proxy FQDN.
- Select.SettingsPrisma AccessSetupGlobalProtectIf you're using Strata Cloud Manager, go to.WorkflowsPrisma AccessSetupGlobalProtect
- On theGlobalProtect Apptab, clickDefaultto customize the Tunnel Settings orAdd Tunnel Settingsadd a new configuration.
- UnderExclude Traffic,Add Domain.Replace the FQDN in the image with your proxy FQDN.
- Enable Always-On security by configuring the following settings on thepage:SettingsPrisma AccessSetupGlobalProtectGlobalProtect AppAdd App SettingsIf you're using Strata Cloud Manager, go to.WorkflowsPrisma AccessSetupGlobalProtectGlobalProtect AppAdd App Settings
- Configure decryption policy for explicit proxy traffic.
- Select.ManageSecurity ServicesDecryptionIf you're using Strata Cloud Manager, go to.ManageConfigurationNGFW andPrisma AccessSecurity ServicesDecryption
- If you enable decryption, make sure the decryption certificate is also set up as a trusted root CA.
- Configure security policy rules for explicit proxy traffic.
- Select.ManageSecurity ServicesSecurity PolicyIf you're using Strata Cloud Manager, go to.ManageConfigurationNGFW andPrisma AccessSecurity ServicesSecurity Policy
- Follow the Internet Gateway Security Policy Best Practices.
- (Optional) Configure the GlobalProtect app in Proxy and Tunnel mode in a non-default route network.
- (Optional) Host a PAC file internally and add thePrisma Accessexplicit proxy FQDN as a proxy in the PAC file.
- Forward authentication requests to the internet for the portal and gateway FQDNs and for IdP URLs.
- Set up routes to the explicit proxy FQDN or IP addresses on perimeter devices to allow users to access the internet via the explicit proxy.
- (Optional) Add DNS records to resolve thePrisma Accessexplicit proxy FQDN to an internal IP address if users can’t resolve public domains in the branch network and add destination NAT for the internal IP address to the explicit proxy FQDN or IP address.
- To enable users to access private apps directly when in the office:
- Direct Access:Enable Internal Host Detection and keep the internal gateway list empty.
- ClickSaveandPush ConfigtoGlobalProtectandExplicit Proxy.
- Verify and troubleshoot the agent proxy deployment.
- Verify the information about your network connection on the GlobalProtect appConnectionstab underSettings.
- Open the GlobalProtect app.
- SelectSettingsto open the GlobalProtect Settings panel, and then selectConnections.
- View and collect the GlobalProtect logs.View the PanGPS log to verify the proxy mode configuration on the GlobalProtect portal.You can verify that Proxy mode is configured by looking for the following event in the PanGPS log:OnProxyAgentMode: hybrid modeTo view GlobalProtect logs inPrisma Access, selectand:ActivityLogsLog ViewerIf you're using Strata Cloud Manager, go to.Incidents & AlertsLog Viewer
- GlobalProtect, for authentication logs
- TrafficandDecryptionfor user access logs