>
    Strata Copilot
    NGFW Traffic Identification for Prisma Browser
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. NGFW Traffic Identification for Prisma Browser
    Download PDF
    Prisma Browser

    NGFW Traffic Identification for Prisma Browser

    Table of Contents

    NGFW Traffic Identification for Prisma Browser

    NGFW Traffic Identification for Prisma Browser
    Where Can I Use This?What Do I Need?
    • Panorama (NGFW policy management)
    • Strata Cloud Manager
    • Prisma Browser
    • PAN-OS 12.2.5 or later.
    NGFW Traffic Identification enables a Palo Alto Networks Next-Generation Firewall (NGFW) running PAN-OS 12.2.5 or later to automatically recognize network traffic originating specifically from Prisma Browser. By identifying enterprise browser traffic at the network layer, administrators can distinguish managed browser sessions from unmanaged browsers (such as standard Chrome, Edge, or Safari) and enforce granular security policies based on client identity.
    This identification is exposed as a dedicated match criterion across management interfaces:
    1. Strata Cloud Manager (SCM): Available under Source Match Criteria > Access Method.
    2. Panorama / PAN-OS Web Interface: Available under Source Device session properties (as prisma-browser).
    Identification operates transparently to end users and requires no endpoint-side configuration.
    This enables two primary policy use cases:
    1. Differentiated access control - Restrict specific applications (for example, GenAI apps) so they're only reachable when traffic is identified as coming from Prisma Browser; block or redirect traffic from all other browsers.
    2. Differentiated decryption - Skip NGFW-side decryption for traffic already identified as Prisma Browser (since Prisma Browser performs its own inline inspection/DLP), while continuing to decrypt traffic from all other browsers for NGFW-side visibility.
    Identification operates transparently to end users and requires no endpoint-side configuration.

    Primary Deployment Use Cases

    Integrating Prisma Browser identification with NGFW security policies addresses two main operational requirements:
    1. Differentiated Access Control: Restrict sensitive web applications (such as Generative AI platforms or internal administrative portals) so they are reachable exclusively when traffic originates from Prisma Browser. Traffic from standard or unmanaged browsers can be automatically blocked or redirected.
    2. Differentiated Decryption & Inspection Efficiency: Optimize firewall processing by bypassing SSL/TLS decryption for sessions originating from Prisma Browser. Because Prisma Browser already performs local inline security inspection and Data Loss Prevention (DLP) at the endpoint, skipping redundant decryption on the firewall saves processing resources while maintaining full decryption for unmanaged browsers.

    Architecture and How It Works

    • Session Authentication & Token Issuance: When an end user launches Prisma Browser, the browser authenticates to the Prisma Access backend cloud infrastructure and obtains a cryptographically secured session token.
    • Proof-of-Possession Insertion: During outbound HTTPS sessions, Prisma Browser derives a cryptographic proof-of-possession verification payload from its session token and embeds it into the initial TLS ClientHello message—the unencrypted opening packet of the TLS handshake.
    • Pre-Decryption Validation: The Palo Alto Networks NGFW inspects the TLS ClientHello packet, extracts the proof-of-possession payload, and validates it against the Prisma Access backend service to confirm authenticity.
    • Zero-Decryption Identification: Because token verification takes place during the initial TLS handshake prior to session encryption, the firewall accurately identifies Prisma Browser traffic without needing to decrypt the underlying TLS payload.
    Confirm whether external customer documentation should explicitly cite the underlying DPoP token mechanism or maintain a mechanism-agnostic administrative description

    Prerequisites and System Requirements

    • Firewall Software: Next-Generation Firewall running PAN-OS 12.2.5 or later, managed via Panorama or Strata Cloud Manager. [TBD - Confirm standalone deployment support status prior to GA release.]
    • Endpoint Agent: Prisma Browser deployed and managed across target client endpoints.
    • Licensing: No additional feature licenses or standalone SKUs are required beyond active subscriptions for Prisma Browser and NGFW / PAN-OS.

    Configuring Policy Rules for Prisma Browser Traffic

    Configure Security and Decryption rules to enforce differentiated access controls or optimize SSL/TLS decryption workflows based on browser identity.

    Task 1: Restrict Application Access to Prisma Browser

    Create rule pairs to allow target applications exclusively when accessed through Prisma Browser, while denying access from all non-Prisma browsers.

    Using Strata Cloud Manager

    1. Navigate to Security Policy (Prisma Access) and select Add Security Policy Rule.
    2. In the Match Criteria > Source tab, set Access Method to Prisma Browser.
    3. In the Application / Service tab, select the enterprise or GenAI applications you wish to restrict.
    4. Under the Action tab, select Allow.
    5. Create a second rule positioned directly below the Allow rule, targeting the same application(s), with Access Method set to Any, and set the Action to Deny or Reset.
    6. Verify rule ordering to ensure the Prisma Browser Allow rule is evaluated first.
    7. Click Save, then Commit and Push changes.

    Using Panorama or PAN-OS Web Interface

    1. Navigate to Policies > Security and select Add.
    2. In the Source tab, locate Source Device and add prisma-browser.
    3. In the Application tab, specify target applications.
    4. In the Actions tab, set Action Setting to Allow.
    5. Create a companion rule positioned below the primary rule with identical application scope, leaving Source Device empty (Any), and set action to Deny or Reset Client.
    6. Confirm rule evaluation order puts the Allow rule higher in the rule base.
    7. Click OK, then Commit changes.

    Task 2: Bypass Decryption for Prisma Browser Traffic

    Configure decryption policy rules to bypass NGFW SSL/TLS decryption for Prisma Browser traffic while maintaining full decryption inspection on unmanaged browser sessions.

    Using Strata Cloud Manager

    1. Navigate to Decryption Policy and select Add Decryption Policy Rule.
    2. Under Source > Access Methods, select Prisma Browser.
    3. Under Action, select No Decrypt.
    4. Create a secondary rule below this rule, setting Access Methods to Any, and set the action to Decrypt.
    5. Verify rule evaluation order so the No Decrypt rule evaluates prior to general decryption rules.
    6. Click Save, then Commit and Push.

    Using Panorama or PAN-OS Web Interface

    1. Navigate to Policies > Decryption and click Add.
    2. In the Source tab, under Source Device, add prisma-browser.
    3. In the Action tab, set the action to No Decrypt.
    4. Create a second rule positioned below with no Source Device condition, setting its action to Decrypt.
    5. Ensure the Prisma Browser No Decrypt rule precedes general decryption rules.
    6. Click OK, then Commit.

    Monitoring and Log Verification

    Administrators can verify policy matches and inspect session behavior through PAN-OS Traffic Logs and Decryption Logs.
    Current Logging Behavior: At initial release, PAN-OS logs record policy hits based on the matched rule name. Logs do not currently display a dedicated, standalone metadata attribute flagging sessions as "Prisma Browser-identified."
    Operational Best Practice: To easily trace Prisma Browser traffic in log views, implement clear naming conventions for rules containing the Prisma Browser match condition (for example, Sec-Allow-PrismaBrowser-GenAI or Decrypt-Bypass-PrismaBrowser). A dedicated log field for browser identification is planned as a future software enhancement.

    © 2026 Palo Alto Networks, Inc. All rights reserved.