>
    Configure Remote Browser Isolation
    Focus
    Download PDF
    Focus
    1. Home
    2. Remote Browser Isolation
    3. Configure Remote Browser Isolation
    Download PDF
    Remote Browser Isolation

    Configure Remote Browser Isolation

    Table of Contents

    Configure
    Remote Browser Isolation

    Learn how to configure
    Remote Browser Isolation
     using
    Strata Cloud Manager
     or
    Panorama Managed Prisma Access
    .
    Where Can I Use This?
    What Do I Need?
    • Prisma Access (Managed by Strata Cloud Manager)
    • Prisma Access (Managed by Panorama)
    To onboard your end users to
    RBI
    , you need to configure
    RBI
     using
    Strata Cloud Manager
     or
    Panorama Managed Prisma Access
     and push the configuration to the endpoints.
    In this procedure, you will:
    • Set up the infrastructure settings for
      RBI
       that define the session and browser appearance during isolated browsing
    • Set up isolation profiles that define what browser actions a user can or cannot perform
    • Use the existing policy framework in
      Prisma Access
       to quickly and easily define the URLs or websites (including categories) that a user can access using
      RBI

    Configure
    Remote Browser Isolation
     (Cloud Management)

    Learn how to configure
    Remote Browser Isolation
     using
    Strata Cloud Manager
    .
    You can secure your end users' browsing experience by configuring
    Remote Browser Isolation (RBI)
     to isolate their browser traffic.
    Configure
    RBI
     by completing the following steps:
    1. Before you can begin to configure
      RBI
      , ensure that you:
    2. In
      Strata Cloud Manager
      , go to the
      Remote Browser Isolation
       Setup page by selecting
      Workflows
      Prisma Access
       Setup
      Remote Browser Isolation
      .
      The
      Remote Browser Isolation
       Setup page is available only if you purchased and activated the
      Remote Browser Isolation
       license.
      Alternatively, you can select
      Manage
      Configuration
      NGFW and
      Prisma Access
      Security Services
      URL Access Management
      . Then, select
      Settings
      , open the
      Third Party
      Remote Browser Isolation
       Settings
      , and click
      Configure Remote Browser Isolation
      .
      The
      Configure Remote Browser Isolation
       button is available only if you purchased and activated the
      Remote Browser Isolation
       license.
    3. Set up the infrastructure settings for
      RBI
       that will define the browser behavior and appearance during isolated browsing sessions.
      1. If you're setting up
        RBI
         for the first time, select
        Infrastructure
        Set Up Infrastructure Settings
        .
        Otherwise, edit the
        Settings
         and select
        Customize
        .
      2. Define the browser behavior during an isolated browsing session.
        • Idle Tab Timeout (Mins)
          —Specify the duration that elapses before a browser tab will time out due to user inactivity. The default timeout value is 10 minutes. The range is 5-20 minutes.
          The inactivity timer starts from the user's last action, such as mouse click, scrolling, navigation, file upload or download, and stopping video or audio. Just moving the cursor isn't considered an activity.
        • Max Tabs Per Browser
          —Select the maximum number of tabs that the user can open per browser. You can choose either 5, 10, or 15 maximum tabs. The default is 10.
          When the number of tabs exceeds the maximum, the users will be prompted to close existing tabs if they want to open more tabs for browsing.
        • Clear cache and cookies when isolated browsing session ends
          —Enable this setting to clear the browser's cache and cookies when the user ends the isolated browsing session (by closing the browser). Clearing the cache and cookies can potentially help resolve some browser issues by speeding page loads or removing website tracking data.
        • Allow users to report issues encountered in isolation sessions
          —When this setting is
          Enabled
          , mobile users can report issues that they encountered during isolated browsing. The users can click the floating action button and select
          Report an issue
          .
      3. Set up advanced settings for isolated browsing, such as split tunnel settings.
        • Agent Split Tunneling for RBI
          —To further improve the user experience while in isolation, enable split tunneling, which allows the remote browser to connect directly to endpoints for quicker access.
          This setting is enabled by default and applies only to mobile user connections such as GlobalProtect and Explicit Proxy. For Remote Networks, all traffic goes through the tunnel to
          Prisma Access
          . For Explicit Proxy, you need to exclude the
          RBI
           domain in the PAC file by adding the following statements:
          if (shExpMatch(host, "*.rbi.io"))
return "DIRECT";
          The
          RBI
           split tunnel configuration is not viewable in the split tunnel configuration area of GlobalProtect.
          RBI
           uses split tunneling based on the domain and application, and the configuration is FQDN-based. For split tunneling to work, you must enable Split DNS to enable mobile users to direct their DNS queries for applications and resources over the tunnel or outside the tunnel in addition to network traffic.
        • Action for sites that cannot be decrypted (technical or policy reason)
          —
          Prisma Access
           needs to decrypt encrypted websites so that it can inspect traffic to determine which websites to isolate according to the policies that you configured.
          Choose whether to
          Allow
           or
          Block
           access to websites that can't be decrypted due to technical or policy reasons.
      4. Set up theme settings for the isolated browsing session. When a user enters an isolated browsing session, an end-user notification appears to let them know that they are entering isolation. You can customize this notification to align with your organization's look and feel.
        The following is an example of a notification banner:
        Here is where you set up the isolation theme:
        • Name
          —Enter the name that will appear on the notification banner when the user enters an isolated session on their browser. (Required field)
        • Description
          —Enter the text that goes on the notification banner. (Required field)
        • Banner Logo
          —
          Choose File
           to upload a graphics file that will appear as the logo for the banner. If you do not upload a file, the Palo Alto Networks logo will be used by default. You can upload only one file. The valid file formats are JPG and PNG.
        • Floating Banner Logo
          —
          Choose File
           to upload a graphics file that will appear in the floating action button that users can click to invoke an action such as reporting an issue. If you do not upload a file, the Palo Alto Networks logo will be used by default. You can upload only one file. The valid file formats are JPG and PNG.
      5. Save
         your infrastructure settings.
    4. Set up one or more isolation profiles that define what browser actions users can perform during an isolated session.
      1. From the
        Remote Browser Isolation
         Setup page, select
        Isolation Profiles
        .
      2. A default isolation profile is provided for you. You can create custom isolation profiles when you
        Add Isolation Profile
        .
      3. Enter a
        Name
         and
        Description
         for the isolation profile.
      4. Select the security controls that you want to put in place for the browser. You can allow or prohibit a user from doing the following actions:
        • View files in isolation
        • Upload files
        • Download files
        • Copy content
        • Paste content
        • Use the keyboard for input
        • Print content
        By selecting an action, the action will be enabled and allowed for the user in isolation.
      5. Save
         your isolation profile settings.
    5. Create or update a URL access management profile and attach the isolation profile to it.
      1. From
        Strata Cloud Manager
        , select
        Manage
        Configuration
        NGFW and
        Prisma Access
        .
      2. Select
        Security Services
        URL Access Management
        .
      3. Edit an existing URL access management profile by selecting the profile name or
        Add Profile
         to create a new one.
      4. If you are adding a profile, enter a
        Name
         and
        Description
         for the profile, select the check box next to the
        Category
         column heading, and select
        Set Access
        Isolate
        .
        This action automatically sets the
        Site Access
         to
        isolate
        , and associates the
        Default_Isolation_Profile
         to all the URL categories.
      5. If necessary, change the
        Access Control
         for specific website categories.
        1. Search
           for a URL category or scroll to a category.
        2. If you are editing an existing URL management profile, click the
          Site Access
           drop-down for a URL category and select
          Isolate
           to permit isolated browsing of websites in that category.
          For websites that belong in multiple URL categories, the effective URL category action is the highest priority match action across all these categories. The priority in descending order is as follows:
          Block
          Isolate
          Override
          Continue
          Alert
          Allow
          . Therefore, for
          RBI
           to work, you need to set the action to
          Isolate
           for all categories that match a website.
          For example, cnn.com belongs in both the
          news
           and
          low-risk
           categories. If the
          news
           category is set to
          Block
           and the
          low-risk
           category is set to
          Isolate
          , the cnn.com website will be blocked because the
          Block
           action overrides the
          Isolate
           action. For isolated browsing to work for cnn.com, you must set both categories to the
          Isolate
           action.
        3. After you select the site access, the
          Default_Isolation_Profile
           is automatically attached to the URL category. If you created additional isolation profiles that control the browser actions in isolation mode, you can attach a different profile by clicking the
          Isolation Profile
           drop-down and selecting an available profile.
      6. Save
         your settings.
    6. Create a security policy rule that uses the URL access management profile that you set up for isolation.
      1. From
        Strata Cloud Manager
        , select
        Manage
        Configuration
        NGFW and
        Prisma Access
        .
      2. If you have not done so already, create a profile group.
        1. Select
          Security Services
          Profile Groups
           and
          Add Profile Group
          .
        2. Enter the
          Name
           of the profile group.
        3. Select the security profiles that you want to use, and ensure that you select the
          URL Access Management Profile
           that you want to use for isolation.
        4. Save
           your changes.
      3. Associate the profile group to a security rule. If you have not done so already, create a security rule.
        1. Select
          Security Services
          Security Rules
          Add Rule
          Pre Rules
          .
        2. Enter the
          Name
           for the security rule.
        3. Select a source zone for the
          Match Criteria
          .
        4. Select a destination zone and address for the
          Match Criteria
          .
        5. Select an
          Application
          .
        6. Select the
          Allow
           action and select the
          Profile Group
           that you created for isolation.
          You can use the groups that you created or populated in Cloud Identity Engine for user and user group mapping for
          RBI
          .
    7. You can also create a web security rule where you can control the access for websites in URL categories based on the isolation profile that you set up previously.
      1. From
        Strata Cloud Manager
        , select
        Manage
        Configuration
        NGFW and
        Prisma Access
        .
      2. Select
        Security Services
        Web Security
        Add Policy
        .
      3. Enter the
        Name
         for the custom web access policy.
      4. Add the
        Allowed URL Categories
         for isolated browsing. For example, to allow websites in the Entertainment and Arts category for isolated browsing, click
        +
         and select
        Entertainment and Arts
        .
      5. Click
        None
         in the Additional Action column and select
        Isolate
        .
      6. In the
        Isolation Profile
         column, use the default isolation profile or select an isolation profile that you created.
      7. Save
         your changes.
    8. Push the configuration to your mobile users or remote networks by selecting
      Push Config
      Push
      , selecting the
      Target
       for the configuration, and
      Push
      .

    Configure
    Remote Browser Isolation
     (
    Panorama
    )

    Learn how to configure
    Remote Browser Isolation
     using
    Panorama Managed Prisma Access
    .
    You can secure your end users' browsing experience by configuring
    Remote Browser Isolation (RBI)
     to isolate their browser traffic.
    Configure
    RBI
     by completing the following steps:
    1. Before you can begin to configure
      RBI
      , ensure that you:
    2. When setting the
      Site Access
       for a
      Category
      , select
      Isolate
       to permit isolated browsing of websites in the URL category.
      For websites that belong in multiple URL categories, the effective URL category action is the highest priority match action across all these categories. The priority in descending order is as follows:
      Block
      Isolate
      Override
      Continue
      Alert
      Allow
      . Therefore, for
      RBI
       to work, you need to set the action to
      Isolate
       for all categories that match a website.
      For example, cnn.com belongs in both the
      news
       and
      low-risk
       categories. If the
      news
       category is set to
      Block
       and the
      low-risk
       category is set to
      Isolate
      , the cnn.com website will be blocked because the
      Block
       action overrides the
      Isolate
       action. For isolated browsing to work for cnn.com, you must set both categories to the
      Isolate
       action.
    3. If you are setting up
      RBI
       for the first time in
      Panorama Managed Prisma Access
      , select
      Panorama
      Cloud Services
      Status
      Remote Browser Isolation
      Configure
      .
      The
      Configure
       button is available only if you purchased the
      Remote Browser Isolation
       license.
      If you set up
      RBI
       previously and want to edit the configuration, select
      Panorama
      Cloud Services
      Configuration
      Remote Browser Isolation
      .
    4. Set up the infrastructure settings for
      RBI
       that will define the browser behavior and appearance during isolated browsing sessions.
      1. Edit the
        Settings
        .
      2. Selecting the
        General
         tab to start defining the browser behavior during an isolated browsing session by
        1. Configure general browser settings:
          • Idle Tab Timeout (Mins)
            —Specify the duration that elapses before a browser tab will time out due to user inactivity. The default timeout value is 10 minutes. The range is 5-20 minutes.
            The inactivity timer starts from the user's last action, such as mouse click, scrolling, navigation, file upload or download, and stopping video or audio. Just moving the cursor isn't considered an activity.
          • Max Tabs Per Browser
            —Select the maximum number of tabs that the user can open per browser. You can choose either 5, 10, or 15 maximum tabs. The default is 10.
            When the number of tabs exceeds the maximum, the users will be prompted to close existing tabs if they want to open more tabs for browsing.
          • Clear cache and cookies when isolated browsing session ends
            —Enable this setting to clear the browser's cache and cookies when the user ends the isolated browsing session (by closing the browser). Clearing the cache and cookies can potentially help resolve some browser issues by speeding page loads or removing website tracking data.
        2. Set up theme settings for the isolated browsing session. When a user enters an isolated browsing session, an end-user notification appears to let them know that they are entering isolation. You can customize this notification to align with your organization's look and feel.
          The following is an example of a notification banner:
          Here is where you specify what goes on the banner:
          • Title
            —Enter the name that will appear on the notification banner when the user enters an isolated session on their browser.
          • Banner Content
            —Enter the text that goes on the notification banner.
          • Logo Type (Banner)
            —Select the type of logo that will appear on the banner. The default logo is the Palo Alto Networks icon. To customize the logo, click
            Custom
             and
            Browse
             to upload a graphics file of your choice. You can upload only one file. The valid file formats are JPG and PNG.
          • Logo Type (Floating Action Button)
            —Select the type of logo that will appear on the floating action button on the isolation browser. The floating action button provides a list of actions that the user can perform, such as reporting an issue. The user can drag the button to different locations on the browser.
            The
            Default
             logo for the floating action button is the Palo Alto Networks icon. To customize the logo, click
            Custom
             and
            Browse
             to upload a graphics file of your choice. You can upload only one file. The valid file formats are JPG and PNG.
            The following image shows an example of the floating action button:
        3. Enable
          Allow users to report issues encountered in isolated sessions?
           if you want your end users to report issues they encountered during isolated browsing. The users can click the floating action button and select
          Report an issue
          .
      3. Review a map of the
        RBI
         locations by selecting the
        Locations
         tab. The locations shown are the same as the GlobalProtect, Explicit Proxy, and Remote Network locations that you have already set up.
        If you did not set up any locations, you can click the links on the map to navigate to the relevant configuration pages.
      4. Set up advanced settings for isolated browsing, such as split tunnel settings, by selecting the
        Advanced
         tab.
        • Agent Split Tunneling for RBI
          —To further improve the user experience while in isolation, enable split tunneling, which allows the remote browser to connect directly to endpoints for quicker access.
          This setting is enabled by default and applies only to mobile user connections such as GlobalProtect and Explicit Proxy. For Remote Networks, all traffic goes through the tunnel to
          Prisma Access
          . For Explicit Proxy, you need to exclude the
          RBI
           domain in the PAC file by adding the following statements:
          if (shExpMatch(host, "*.rbi.io"))
return "DIRECT";
          The
          RBI
           split tunnel configuration is not viewable in the split tunnel configuration area of GlobalProtect.
          RBI
           uses split tunneling based on the domain and application, and the configuration is FQDN-based. For split tunneling to work, you must enable Split DNS to enable mobile users to direct their DNS queries for applications and resources over the tunnel or outside the tunnel in addition to network traffic.
        • Action for sites that cannot be decrypted (technical or policy reason)
          —
          Prisma Access
           needs to decrypt encrypted websites so that it can inspect traffic to determine which websites to isolate according to the policies that you configured.
          Choose whether to
          Allow
           or
          Block
           access to websites that can't be decrypted due to technical or policy reasons.
    5. Set up one or more isolation profiles that define what browser actions users can perform during an isolated session.
      1. From the
        Remote Browser Isolation
         configuration page, select
        Isolation Profile
        .
      2. A default isolation profile is provided for you. You can
        Add
         a custom isolation profile.
      3. Enter a
        Name
         and
        Description
         for the isolation profile.
      4. Select the security controls for the browser. You can allow or prohibit a user from doing the following actions:
        • View files in isolation
        • Upload files
        • Download files
        • Copy content
        • Paste content
        • Use the keyboard for input
        • Print content
        By selecting a security control, the browser action will be allowed for the user in isolation.
      5. Click
        OK
         to save your isolation profile.
    6. Attach an isolation profile to a security rule to which you applied a URL filtering profile containing categories for isolated browsing.
      1. From the
        Remote Browser Isolation
         configuration page, select
        Isolation Security Rules Association
        .
      2. Add
         a device group and associate an isolation profile and URL categories with the security rules for the device group.
        If you want to update an existing device group, select the check box next to the device group name and select
        Modify
         in the Actions column.
      3. Select a predefined
        Device Group
         and a predefined
        Security Rule
         for the selected device group.
      4. Search for or scroll to the URL categories that you want to associate with the device group and select the check boxes next to the URL categories.
        To quickly configure the access control for all URL categories, select the check box next to the
        URL Categories
         table heading. All the URL categories will be selected.
      5. To attach an isolation profile to the security rule, click
        Isolation Profile
         and select an available isolation profile.
        All the selected URL categories will be associated with the selected isolation profile.
      6. Click
        OK
         to save your settings.
    7. Commit and push your configuration changes to the cloud firewall.
    8. After the configuration has been pushed successfully, you can view the status of the
      RBI
       configuration in the
      Panorama
      Cloud Services
      Status
       page.

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.