Panorama

Enable the agent-based proxy functionality for mobile users.
Enable explicit proxy.
Select
Panorama
Cloud Services
Configuration
Mobile Users—Explicit Proxy
.
Configure
the explicit proxy setup to specify an
Explicit Proxy URL
.
Select
Use GlobalProtect app to Authenticate
to enable the agent-based proxy functionality.

Enter the
PAC (Proxy Auto-Configuration) File
URL. Ensure that you enter a port of 8080 in the PAC file.
For your PAC file to work with the GlobalProtect app-based proxy, it cannot exceed 1 MB.
The Proxy statement in the PAC file must use the
Prisma Access
FQDN you configured above.
The PAC file must be configured to exclude the GlobalProtect gateways (*.gp.gpcoudservice.com).
Select the
Connection Name
for the explicit proxy setup that you configured.
Select the
Locations
and the regions where you want to deploy your explicit proxy for mobile users.
Prisma Access
adds a proxy node into each location that you select. Explicit proxy supports a subset of all
Prisma Access
. For the best user experience, if you are limiting the number of locations, choose locations that are closest to your end users. If a location is not available in the country where your mobile users reside, choose a location that is closest to the mobile users.
Bypass identity providers (IDPs).
All requests to the proxy are authenticated. However, if you're passing IDP flows through the proxy, then you need to bypass them for the authentication to be successful.
In this example, we're bypassing the GlobalProtect portal and Okta, but please customize these to the IDPs that you use.
With the
Explicit_Proxy_Device_Group
selected, select
Object
Custom Objects
URL Category
and create a custom URL category.
In the custom URL category, add all the FQDN domains that need to be bypassed from EP authentication.

Select
Cloud Services
Configuration
Mobile Users
Explicit Proxy
Settings
Authentication Settings
and attach the custom URL category.

Commit and push to the
Explicit_Proxy_Device_Group
.
Configure the GlobalProtect portal.
In Tunnel and Proxy mode, the connect method you set only applies to traffic tunneled through GlobalProtect. The agent-based proxy functionality will provide always-on internet security. Even if you set an on-demand connect method, all internet-bound traffic will still be proxied for always-on internet security even when users disconnect the GlobalProtect app.
In the Onboarding section, click
Configure
.
On the
General
tab, specify the
Portal Name Type
:
Use Default Domain—
If you select this option, your portal hostname uses the default domain name: .gpcloudservice.com. In this case, simply enter a Portal hostname to append to the default domain name.
Prisma Access
will automatically create the necessary certificates and publish the hostname to public DNS servers.
Use Company Domain—
Select this option if you want the domain in the portal hostname to match your company domain name (for example, myportal.mydomain.com).
Select an
Authentication Profile
that specifies how
Prisma Access
should authenticate mobile users or create a new one.
(
Optional
) Select an
Authentication Override Certificate
to encrypt the secure cookies that mobile users use to authenticate to the portal and gateway.
Enable Tunnel and Proxy mode on GlobalProtect.
Select
Network
GlobalProtect Portals
.
Select the portal configuration to which you are adding the agent configuration, and then select the
Agent
tab.
On the
Agent
tab, select
App
.
In the App Configurations area, set the
Agent Mode for Prisma Access
to
Tunnel and Proxy
to send internet traffic to the Prisma Access explicit proxy and private app traffic to the VPN.

Perform optional configurations.
(
Optional
) Configure the local proxy port. The port range is 1024 to 65534 and the default port is 9999. If the default port isn't available, GlobalProtect will try 10 other ports in the range of 9999 to 10009 and use the port that is available. You can also pick your own port number within the range.
(
Optional
) Configure PAC Auto-Configuration (PAC) File URL if you want to push a custom PAC URL for the proxy settings to the endpoint. The PAC URL pushes to the endpoint once the user connects. When the user disconnects the GlobalProtect app, the endpoint proxy configurations are automatically disabled and reverting to the previous settings.
(
Optional
) Enable Allow User to Rediscover Network if you want the user to check the portal for any new settings.
(
Optional
) Configure GlobalProtect App Config Refresh Interval (hours). By default, the GlobalProtect client refreshes the cached portal configuration every 24 hours. You can change the refresh interval based on your business requirements.
In the split tunnel configuration, exclude the proxy FQDN.
Enable Always-On internet security by configuring the following settings:
Set Allow User to Disable GlobalProtect to
Disallow
,
Allow with Passcode
, or
Allow with Ticket
.
Set Allow user to Sign Out from GlobalProtect App to
No
.
(
Optional
) Configure decryption policy for explicit proxy traffic.
If you enable decryption, make sure the decryption certificate is also set up as a trusted root CA.
Select
Device
Certificate Management
Certificates
and create a certificate that is a Trusted Root CA and a Forward Trust Certificate.

Create a Decryption rule under
Explicit_Proxy_Device Group
with SSL forward proxy.
Configure security policy rules for explicit proxy traffic.
Select
Manage
Security Services
Security Policy
.
.
Follow the Internet Gateway Security Policy Best Practices.
Configure split tunnel on Panorama.
Select

Network

Mobile User Template

Gateways

GlobalProtect_ExternalGateway

Agent

Client Settings

Split

.

Configure the tunnel based on routes and domains.




(
Optional
) Configure the GlobalProtect app in Tunnel and Proxy mode in a non-default route network.
(
Optional
) Host a PAC file internally and add the
Prisma Access
explicit proxy FQDN as a proxy in the PAC file.
Verify that GlobalProtect portal URL and IDP URLs are being forwarded to the
Prisma Access
Explicit Proxy.
Set up routes to the explicit proxy FQDN or IP addresses on perimeter devices to allow users to access the internet via the explicit proxy.
(
Optional
) Add DNS records to resolve the
Prisma Access
explicit proxy FQDN to an internal IP address if users can’t resolve public domains in the branch network and add destination NAT for the internal IP address to the explicit proxy FQDN or IP address.
To enable users to access private apps directly when in the office:
Direct Access
—Enable Internal Host Detection and keep the internal gateway list empty.
Commit
and your changes to Panorama and
Commit and Push
the configuration changes to Prisma Access
Mobile Users
and
Explicit Proxy
.
Verify and troubleshoot the agent proxy deployment.
Verify the information about your network connection on the GlobalProtect app
Connections
tab under
Settings
.
Open the GlobalProtect app.
Select
Settings
to open the GlobalProtect Settings panel, and then select
Connections
.

View and collect the GlobalProtect logs
View the PanGPS log to verify the proxy mode configuration on the GlobalProtect portal.
You can verify fthat Proxy mode is configured by looking for the following event in the PanGPS log:
OnProxyAgentMode: hybrid mode
To view GlobalProtect logs in Panorama, select
Monitor
Logs
and:
GlobalProtect
, for authentication logs
Traffic
and
Decryption
for user access logs