Preferred Gateway Selection
Focus
Focus
Prisma Agent

Preferred Gateway Selection

Table of Contents

Preferred Gateway Selection

Learn how Prisma Agent lets users pin a preferred gateway location that persists across reconnections, reboots, and network changes.
Where Can I Use This?What Do I Need?
  • Prisma Access (Managed by Strata Cloud Manager)
  • Prisma Access (Managed by Panorama)
  • NGFW (Managed by Panorama)
  • Check the prerequisites for the deployment you're using
  • Windows or macOS endpoints
By default, Prisma Agent automatically selects the gateway that provides the best performance based on current latency and availability — a mechanism known as Best Location. This works well for most users, but users who work from a consistent physical location may find that a specific gateway always serves them best. Without a persistent preference, the agent may select a different gateway after each reconnection.
Preferred gateway selection lets users pin a specific location by selecting it from the Location drop-down. A star icon appears next to the pinned location to indicate it is set as the preferred gateway. Once pinned, the agent reconnects to that location after network changes, sleep/wake cycles, reboots, and other external factors such as WebSocket connection issues and token expiry, and the preference persists until the user explicitly clears it. To return to automatic selection, users choose Best Location, which clears the preferred gateway setting.
This feature is available on Windows and macOS endpoints. To verify which gateway a user's agent connected to — and to review the history of connection attempts — administrators can run the pacli connection history command on the endpoint or in a remote shell. To see only the most recent connection, run pacli connection without a subcommand.

Gateway Selection Behavior

The following conditions affect how the preferred gateway setting behaves:
  • Internal Host Detection — When an endpoint is detected as on the internal network (on-premises), the agent connects to the internal gateway regardless of the preferred gateway setting. The preferred gateway applies when the endpoint is on an external network.
  • Grace period for internal users — If a user is on the internal network and manually selects an external gateway, the agent stays connected to that external gateway for up to 30 minutes. If a reconnection event occurs within that window, the agent returns to the external gateway rather than switching to the internal gateway. After the grace period expires, reconnection events on the internal network revert to the internal gateway.
  • Always On and On Demand modes — The preferred gateway is honored in both modes. The agent reconnects to the preferred gateway after any interruption, including network changes, sleep/wake cycles, and reboots. If the preferred gateway is unavailable, the agent switches to the best available gateway automatically.
  • Pre-logon (machine tunnel) — The preferred gateway is honored for both the machine tunnel during pre-logon and the user tunnel after login.