Proxy Auto Configuration (PAC) Deployment from GlobalProtect

Software Support

: Starting with GlobalProtect™ app 6.1 with Content Release version 8587-7455 or later.

OS Support

: Windows 10, ARM64-Based Windows 10, macOS 11 and later releases, and ARM-Based macOS 11 and later releases

, and Linux

.

With Endpoint Proxy Configuration from the GlobalProtect app, you can now push the URL for your proxy auto-configuration (PAC) files to your endpoints via the GlobalProtect portal. When the GlobalProtect app connects to the portal, the portal returns the PAC URL to the endpoint. Then, upon establishing a tunnel with the GlobalProtect gateway, the endpoint connects to the PAC URL and fetches the PAC file, which in turn updates the proxy settings on the endpoint. You can deploy different PAC URLs to different endpoints based username or group membership. Once the endpoint has the proxy settings, it uses the proxy server to access the internet.

After you enable the feature, the new proxy configurations pushed through the app replaces the proxy settings already available on the endpoint.When the user disconnects the GlobalProtect app, the endpoint proxy configurations get automatically disabled, reverting to the previous settings.

This feature is available for all GlobalProtect users. When connecting to an on-premises GlobalProtect portal and gateway, the workflow looks as follows:

By default, the endpoint proxy configuration through the GlobalProtect app is disabled.

Use the following steps to configure the endpoint proxy through the GlobalProtect app.

Ensure that the URL to Proxy Auto-Configuration (PAC) file is available.

(

Optional

) Configure the selection criteria such as user, user group and/or operating system on the portal for which you want to push the proxy settings through the GlobalProtect app.

Network
GlobalProtect
Portals
.
Select the portal configuration to which you are adding the agent configuration, and then select the
Agent
tab.
On the
Agent
tab, select
Config Selection Criteria
and then configure user, user group, and/or operating system to which you want to push the endpoint proxy configuration.
To ensure that this endpoint proxy configuration is only pushed to agents running on supported operating systems, on the
Config Selection Criteria
User/User Group
tab, click
Add
in the
OS
column and select the operating system. Set the
OS
to
Any
to deploy the configuration to all operating systems.
If you only want to push the endpoint proxy configuration to specific users, in the
User/User Group
column
Add
the specific users or user groups.
Click
OK
to save the agent configuration.

Enable endpoint proxy configuration through the GlobalProtect app.

Select
Network
GlobalProtect
Portals
.
Select the portal configuration to which you are adding the agent configuration, and then select the
Agent
tab.
On the
Agent
tab, select
App
. The
App Configuration
area displays the app settings with default values that you can customize for each agent configuration.
In the App Configurations area, specify the
Proxy Auto-Configuration (PAC) File URL
that you want to push to the endpoint to configure proxy settings. The maximum URL length is 256 characters. The following Proxy Auto-Configuration (PAC) File URL methods are supported:
Proxy Auto-Config (PAC) standard (for example, http://pac.<hostname or IP>/proxy.pac).
Web Proxy Auto-Discovery Protocol (WPAD) standard (for example, http://wpad.<hostname or IP>/wpad.dat).
Click
OK
and commit the changes.



View the logs to verify the endpoint proxy configuration through the GlobalProtect app.

You can view endpoint proxy configuration- related log details in the GlobalProtect logs and Cortex Data Lake (CDL) logs for GlobalProtect App troubleshooting. You can view the following events in the PanGPS log:

Receipt of proxy configurations.
Enable endpoint proxy configuration - success or failure.
Revert endpoint proxy configuration - success or failure.
Enable proxy enforcement -success or failure.
Disable proxy enforcement -success or failure.

View the PanGPS log to verify whether Proxy Auto Configuration (PAC) URL is configured or not on the GlobalProtect portal.
If the Proxy Auto Configuration (PAC) URL is configured, the PanGPS log displays the following event:
Deploy Proxy auto proxy pac is <proxy auto-configuration (PAC) file URL>.
If the Proxy Auto Configuration (PAC) URL is not configured, the PanGPS log displays the following event:
Deploy Proxy auto proxy pac is not enabled.
To view endpoint proxy configuration- related details in the PanGPS log for Windows, macOS
, and linux
:
Open the GlobalProtect app.
Report an issue from the GlobalProtect from the end user’s endpoint.
(
Optional
) Allow the GlobalProtect app to run additional diagnostic test and send the troubleshooting log bundle together with the issue reports upon user request.
View the PanGPS log to verify the endpoint proxy configuration- related events.

Verify the Proxy Auto Configuration (PAC) URL on the proxy settings of your endpoints.

In the proxy settings of your endpoints, you can view the Proxy Auto Configuration (PAC) URL that you configured in the

App Configurations

area of the

Agent

tab (

Network

GlobalProtect

Portals

).

To view proxy settings for Windows endpoints, select

Settings

Network & Internet

Proxy

.



To view proxy settings for macOS endpoints, select

System Preferences

Network

Proxies

.



To view proxy settings for Linux endpoints, select

Settings

Network

Network Proxy

.