Forwarding Profiles Considerations
Learn about forwarding profile behaviors for browser traffic, DNS, and UDP that
require adjustments to ensure proper traffic routing and policy enforcement.
| Where Can I Use This? | What Do I Need? |
|---|
- Prisma Access (Managed by Strata Cloud Manager)
- Prisma Access (Managed by Panorama)
- NGFW (Managed by Panorama)
|
- Check the prerequisites for the deployment you're using
- Windows 10 version 2024 and later desktop devices
- Contact your Palo Alto Networks account representative to activate the Prisma Agent feature
|
When configuring forwarding profiles for the Prisma Agent, there are
specific behaviors to consider that may require adjustments to your traffic forwarding
rules to ensure proper traffic routing and policy enforcement.
Browser DNS-over-HTTPS (DoH) and QUIC Traffic
Browsers with DoH enabled send DNS queries directly to external
providers—such as Google (8.8.8.8) or Cloudflare (1.1.1.1)—rather than
through your corporate DNS resolver, which can bypass forwarding profile DNS
rules. Browsers with QUIC enabled send HTTP/3 traffic over UDP, which may
not match forwarding profile rules configured for TCP traffic.
Disable DoH and QUIC in managed browsers using your endpoint management tool
to ensure traffic is handled according to your forwarding profile
configuration.
Windows Considerations
Forwarding profiles for Windows Prisma Agents have specific behaviors
for DNS source application rules and UDP destination rules that require alternative
approaches.
DNS Traffic with Source Application Rules
For DNS traffic on Windows endpoints, forwarding rules that use the source
application (for example, Chrome) as a condition won’t work correctly.
Instead of following your rule, the DNS traffic will be handled according
to the Default rule (last rule) action.
For combined rules that include both data and DNS traffic with source
application criteria, the data portion will match correctly while the DNS
portion will not.
To avoid this issue, configure DNS traffic rules using destination-based
criteria rather than source application matching for Windows
deployments.
The agent automatically includes implicit rules that direct outgoing DNS
traffic to the Endpoint Manager (EPM) and gateways from all processes
to use the physical network adapter rather than routing through the
tunnel.
UDP Traffic with Destination-Based Rules
Outgoing UDP traffic rules configured with destination-based criteria won’t
match connections on Windows endpoints. These connections will be handled
by the Default rule instead of your intended
forwarding profile rule.
To avoid this issue, use source application-based rules when configuring
forwarding profiles for UDP traffic on Windows endpoints.
This behavior only affects traffic tunneling and redirection.
Enforcement rules based on destination criteria will still function
correctly for UDP traffic. TCP and DNS traffic are not affected by
this behavior.
