>
    GlobalProtect in Proxy Mode
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Access
    3. Prisma Access Mobile Users
    4. Mobile Users: Explicit Proxy
    5. GlobalProtect in Proxy Mode
    Download PDF
    Prisma Access

    GlobalProtect in Proxy Mode

    Table of Contents

    GlobalProtect in Proxy Mode

    Configure the GlobalProtect app to forward traffic to
    Prisma Access
     using explicit proxy, without creating a VPN or IPSec tunnels.
    Where Can I Use This?
    What Do I Need?
    • Prisma Access (Managed by Panorama)
    • Prisma Access (Managed by Strata Cloud Manager)
    If you'd like to use this feature in your
    Prisma Access
     environment, get in touch with your account team to learn more.
    • Prisma Access
       4.0
    • GlobalProtect app version 6.2 for Windows or macOS
    • Content release version 8700-7994
    • Prisma Access
       Mobile User license
    With
    Proxy
     mode, the GlobalProtect app provides always-on internet security. In this mode, the GlobalProtect app proxies traffic to
    Prisma Access
     based on forwarding rules and logic from the PAC file, hosted in
    Prisma Access
     or in your environment. This is useful if you have an existing (legacy) proxy architecture or have a requirement to maintain your proxy architecture for regulatory or compliance reasons.
    The agent-based proxy feature facilitates coexistence and interoperability of the GlobalProtect app with third-party VPNs wherein you can secure your mobile users’ internet traffic through the GlobalProtect app to the explicit proxy and use the third-party VPN of your choice to secure private application access.
    When running the GlobalProtect app in Proxy mode, Autonomous DEM (ADEM) and host information profile (HIP) functionality is not supported.
    In this scenario, the GlobalProtect app sends internet traffic to
    Prisma Access
     based on the PAC file rules you define, while the endpoint routes access to your private applications through a third-party VPN using an IPSec/TLS tunnel.

    GlobalProtect in Proxy Mode (
    Strata Cloud Manager
    )

    Configure GlobalProtect in Proxy mode.
    1. Enable the agent-based proxy functionality for mobile users on Prisma Access.
      1. Enable Explicit Proxy.
        1. Select
          Settings
          Prisma Access
           Setup
          Mobile Users
           and click
          Explicit Proxy Setup
          .
          If you're using Strata Cloud Manager, go to
          Workflows
          Prisma Access
           Setup
          Mobile Users
           and click
          Explicit Proxy Setup
          .
        2. In the Infrastructure Settings area, click
          Setup Proxy Settings
           and specify an
          Explicit Proxy URL
          .
      2. Enable Agent Proxy
        and click
        Save
        .
      3. Choose the
        Prisma Access
         where you want to support mobile users.
        For the best user experience, if you're limiting the number of locations, choose locations that are closest to your end users. If a location isn't available in the country where your mobile users reside, choose a location that’s closest to the mobile users.
      4. Create a Forwarding Profile to define the traffic you want to send through Explicit Proxy. While configuring the forwarding profile, bypass *.prismaaccess.com and *.gpcloudservice.com domains.
      6. Select
        Settings
        Prisma Access
         Setup
        Explicit Proxy
        Advanced Security Settings - Explicit Proxy
        Authentication Settings
         and add the domains you need to bypass.
        If you're using Strata Cloud Manager, go to
        Workflows
        Prisma Access
         Setup
        Explicit Proxy
        Advanced Security Settings
        Authentication Settings
        .
        All requests to the proxy undergo authentication. However, if you're passing IdP flows through the proxy, then you need to bypass them for the authentication to be successful.
        In this example, we are bypassing the GlobalProtect portal and Okta, but please customize these to the IdPs that you use.
    2. Set up the GlobalProtect portal, authentication, and configure Proxy mode for the GlobalProtect app.
      1. Select
        Workflows
        Prisma Access
         Setup
        GlobalProtect
        Infrastructure
        Infrastructure Settings
         and specify the
        Portal Name
        .
        • Default Domain
          —If you select this option, your portal hostname uses the default domain name:
          .gpcloudservice.com
          . In this case, simply enter a
          Portal Hostname
           to append to the default domain name.
          Prisma Access
           for Users will automatically create the necessary certificates and publish the hostname to public DNS servers.
        • Custom Domain
          —You can also customize the portal address if you want the domain in the portal hostname to match your company domain name (for example, myportal.mydomain.com).
      3. Enable GlobalProtect proxy mode for
        Prisma Access
         in the GlobalProtect app settings to send internet traffic to the agent-based proxy.
        The GlobalProtect connect method does not apply in proxy mode as it's always on.
        • Select
          Settings
          Prisma Access
           Setup
          GlobalProtect
          .
          If you're using Strata Cloud Manager, go to
          Workflows
          Prisma Access
           Setup
          GlobalProtect
          .
        • On the
          GlobalProtect App
          tab, click
          Default
           to customize the app settings or
          Add App Settings
           add a new configuration.
        • Click
          Show Advanced Options
           and in the
          App Configuration
          section.
        • Set
          Agent Mode for
          Prisma Access
           to
          Proxy
           to instruct the GlobalProtect app to send the internet traffic to the Explicit Proxy on Prisma Access.
        • (
          Optional
          ) Configure the local proxy port. The port range is 1024 to 65534 and the default port is 9999. If the default port isn't available, GlobalProtect will try 10 other ports in the range of 9999 to 10009 and use the port that is available. You can also pick your own port number within the range.
        • (
          Optional
          ) Configure PAC Auto-Configuration (PAC) File URL if you want to push the new PAC URL for the proxy settings to the endpoint. The PAC URL pushes to the endpoint once the user connects. When the user disconnects the GlobalProtect app, the endpoint proxy configurations are automatically disabled and reverting to the previous settings.
        • (
          Optional
          ) Enable Allow User to Rediscover Network if you want the user to check the portal for any new settings.
        • (
          Optional
          ) Configure GlobalProtect App Config Refresh Interval (hours). By default, the GlobalProtect client refreshes the cached portal configuration every 24 hours. You can change the refresh interval based on your business requirements.
        • Disable
          Set Up Tunnel Over Proxy (Windows & Mac Only)
          .
      4. Enable Always-On internet security by configuring the following settings on the
        Settings
        Prisma Access
         Setup
        GlobalProtect
        GlobalProtect App
        Add App Settings
         page:
        If you're using Strata Cloud Manager, go to
        Workflows
        Prisma Access
         Setup
        GlobalProtect
        GlobalProtect App
        Add App Settings
        .
        1. Set Disable GlobalProtect to
          Disallow
          ,
          Allow with Passcode
          , or
          Allow with Ticket
          .
    3. Configure decryption for Explicit Proxy traffic.
      • Select
        Manage
        Security Services
        Decryption
        .
        If you're using Strata Cloud Manager, go to
        Manage
        Configuration
        NGFW and
        Prisma Access
        Security Services
        Decryption
        .
      • If you enable decryption, make sure you set up the decryption certificate as a trusted root CA.
    4. Configure Security policy rules for Explicit Proxy traffic.
    5. (
      Optional
      ) Configure the GlobalProtect app in proxy mode in a no default route network.
      • (
        Optional
        ) Host a PAC file internally and add the
        Prisma Access
         Explicit Proxy FQDN as a proxy in the PAC file, or host the PAC file in a Forwarding Profile and add routes in your network for PAC service IP addresses.
      • In the PAC file, forward the IdP URL and
        Prisma Access
         portal URL to Explicit Proxy.
      • On Explicit Proxy, exclude the IdP and portal URL from the authentication settings. Add the IdP and portal URL to the domain used in the authentication flows.
      • Set up routes to the Explicit Proxy FQDN or IP addresses on perimeter devices to allow users to access the internet via the Explicit Proxy.
      • (
        Optional
        ) Add DNS records to resolve the
        Prisma Access
         Explicit Proxy FQDN to an internal IP address if users can’t resolve public domains in the branch network and add destination NAT for the internal IP address to the Explicit Proxy FQDN or IP address.
    6. Click
      Save
       and
      Push Config
       to
      GlobalProtect
       and
      Explicit Proxy
      .
    7. Verify and troubleshoot the agent proxy deployment.
      1. Verify the information about your network connection on the GlobalProtect app
        Connections
         tab under
        Settings
        .
        1. Open the GlobalProtect app.
        2. Select
          Settings
           to open the GlobalProtect Settings panel, and then select
          Connections
          .
      2. View and collect the GlobalProtect logs.
        View the PanGPS log to verify the proxy mode configuration on the GlobalProtect portal.
        You can verify that Proxy mode is configured by looking for the following event in the PanGPS log:
        OnProxyAgentMode: proxy only mode
        To view GlobalProtect logs in
        Prisma Access
        , select
        Activity
        Logs
        Log Viewer
         and:
        If you're using Strata Cloud Manager, go to
        Incidents & Alerts
        Log Viewer
        .
        • GlobalProtect
          , for authentication logs
        • Traffic
           and
          Decryption
           for user access logs

    GlobalProtect in Proxy Mode (
    Panorama
    )

    Configure the GlobalProtect app in Proxy mode.
    If you convert a single-tenant
    Prisma Access (Managed by Panorama)
     deployment to multitenancy, only the first tenant (the tenant you migrated) supports this feature. Also, in this first tenant, you must set up your policy rules in the predefined Explicit_Proxy_Device_Group rather than in a custom device group. Any subsequent tenants you create for the multitenant deployment after the first do not support this feature.
    1. Enable the agent-based proxy functionality for mobile users.
      1. Enable explicit proxy.
        1. Select
          Panorama
          Cloud Services
          Configuration
          Mobile Users—Explicit Proxy
          .
        2. Configure
           the explicit proxy setup to specify an
          Explicit Proxy URL
          .
      2. Select
        Use GlobalProtect app to Authenticate
        to enable the agent-based proxy functionality.
      3. Enter the
        PAC (Proxy Auto-Configuration) File
         URL. Ensure that you enter a port of 8080 in the PAC file.
        • Ensure that you enter a port of 8080 in the PAC file.
        • For your PAC file to work with the GlobalProtect app-based proxy, it cannot exceed 750 MB.
        • The Proxy statement in the PAC file must use the
          Prisma Access
           FQDN you configured above.
        • The PAC file must be configured to bypass 3rd party VPN traffic.
        Sample PAC file:
        function FindProxyForURL (url, host) {
	/* Bypass localhost and Private IPs * /
	var resolved_ ip = dnsResolve (host) ;
	if (isplainHostName (host) ||
	shExpMatch (host,"* ‚local") ||
    	isInNet (resolved_ip,"10.0.0.0", "255.0.0.0") ||
    	isInNet (resolved ip,"172.16.0.0","255.240.0.0") ||
    	isInNet (resolved_ip,"192.168.0.0","255.255.0.0") ||
    	isInNet (resolved ip, "127.0.0.0", "255.255.255.0" ))
	return "DIRECT";
	/* Bypass Non-HTTP * / 
	if (url.substring (0,4) == "ftp: ")
		return "DIRECT”;
	/* Bypass VPN */
	if (shExpMatch (host, "vpn. acme.com") || shExpMatch (host, "gateway. acme.com" ))
		return "DIRECT";
	/* Bypass Private Apps */ 
	if (shExpMatch (host,"internalapps. acme.com" ) )
		return "DIRECT";
	/* Forward to 
        Prisma Access
         */
	return "PROXY acme-demo.proxy.prismaaccess.com: 8080";}
      4. Select the
        Connection Name
         for the explicit proxy setup that you configured.
      5. Select the
        Locations
         and the regions where you want to deploy your explicit proxy for mobile users.
        Prisma Access
         adds a proxy node into each location that you select. Explicit proxy supports a subset of all
        Prisma Access
        . For the best user experience, if you are limiting the number of locations, choose locations that are closest to your end users. If a location is not available in the country where your mobile users reside, choose a location that is closest to the mobile users.
    2. Bypass identity providers (IDPs).
      All requests to the proxy are authenticated. However, if you're passing IDP flows through the proxy, then you need to bypass them for the authentication to be successful.
      In this example, we're bypassing the GlobalProtect portal and Okta, but please customize these to the IDPs that you use.
      1. With the
        Explicit_Proxy_Device_Group
         selected, select
        Object
        Custom Objects
        URL Category
         and create a custom URL category.
      2. In the custom URL category, add all the FQDN domains that need to be bypassed from EP authentication.
      3. Select
        Cloud Services
        Configuration
        Mobile Users
        Explicit Proxy
        Settings
        Authentication Settings
         and attach the custom URL category.
      4. Commit and push to the
        Explicit_Proxy_Device_Group
        .
    3. Configure the GlobalProtect portal.
      In Proxy mode, the connect method you set does not change the behavior of the proxy functionality. Even if you set an on-demand connect method, all internet-bound traffic will still be proxied for always-on internet security.
      1. In the Onboarding section, click
        Configure
        .
      2. On the
        General
         tab, specify the
        Portal Name Type
        :
        Use Default Domain—
         If you select this option, your portal hostname uses the default domain name: .gpcloudservice.com. In this case, simply enter a Portal hostname to append to the default domain name.
        Prisma Access
         will automatically create the necessary certificates and publish the hostname to public DNS servers.
        Use Company Domain—
         Select this option if you want the domain in the portal hostname to match your company domain name (for example, myportal.mydomain.com).
      3. Select an
        Authentication Profile
         that specifies how
        Prisma Access
         should authenticate mobile users or create a new one.
      4. (
        Optional
        ) Select an
        Authentication Override Certificate
        to encrypt the secure cookies that mobile users use to authenticate to the portal and gateway.
    4. Enable Proxy mode on GlobalProtect.
      1. Select
        Network
        GlobalProtect Portals
        .
      2. Select the portal configuration to which you are adding the agent configuration, and then select the
        Agent
         tab.
      3. On the
        Agent
         tab, select
        App
        .
      4. In the App Configurations area, set the
        Agent Mode for
        Prisma Access
         to
        Proxy
         to send internet traffic to the GlobalProtect agent-based proxy
    5. Perform optional configurations.
      1. (
        Optional
        ) Configure the local proxy port. The port range is 1024 to 65534 and the default port is 9999. If the default port isn't available, GlobalProtect will try 10 other ports in the range of 9999 to 10009 and use the port that is available. You can also pick your own port number within the range.
      2. (
        Optional
        ) Configure PAC Auto-Configuration (PAC) File URL if you want to push a custom PAC URL for the proxy settings to the endpoint. The PAC URL pushes to the endpoint once the user connects. When the user disconnects the GlobalProtect app, the endpoint proxy configurations are automatically disabled and reverting to the previous settings.
      3. (
        Optional
        ) Enable Allow User to Rediscover Network if you want the user to check the portal for any new settings.
      4. (
        Optional
        ) Configure GlobalProtect App Config Refresh Interval (hours). By default, the GlobalProtect client refreshes the cached portal configuration every 24 hours. You can change the refresh interval based on your business requirements.
    6. Enable Always-On internet security by configuring the following settings:
      1. Set Allow User to Disable GlobalProtect to
        Disallow
        ,
        Allow with Passcode
        , or
        Allow with Ticket
        .
    7. (
      Optional
      ) Configure decryption policy for explicit proxy traffic.
      If you enable decryption, make sure the decryption certificate is also set up as a trusted root CA.
      1. Select
        Device
        Certificate Management
        Certificates
         and create a certificate that is a Trusted Root CA and a Forward Trust Certificate.
      2. Create a Decryption rule under
        Explicit_Proxy_Device Group
         with SSL forward proxy.
    8. Configure security policy rules for explicit proxy traffic.
      1. Select
        Policies
        Security
        .
      2. Set the
        Device Group
         to
        Explicit_Proxy_Device_Group
        .
    9. (
      Optional
      ) Configure the GlobalProtect app in proxy mode in a non-default route network.
      • (
        Optional
        ) Host a PAC file internally and add the
        Prisma Access
         explicit proxy FQDN as a proxy in the PAC file, or host the PAC file in a Forwarding Profile and add routes in your network for PAC service IP addresses.
      • In the PAC file, forward the IDP URL and
        Prisma Access
         portal URL to explicit proxy.
      • On explicit proxy, exclude the IDP and portal URL from the authentications settings. Add the IDP and portal URL to the domain used in the authentication flows.
      • Set up routes to the explicit proxy FQDN or IP addresses on perimeter devices to allow users to access the internet via the explicit proxy.
      • (
        Optional
        ) Add DNS records to resolve the
        Prisma Access
         explicit proxy FQDN to an internal IP address if users can’t resolve public domains in the branch network and add destination NAT for the internal IP address to the explicit proxy FQDN or IP address.
    10. Commit
       and your changes to Panorama and
      Commit and Push
       the configuration changes to Prisma Access
      Mobile Users
       and
      Explicit Proxy
      .
    11. Verify and troubleshoot the agent proxy deployment.
      1. Verify the information about your network connection on the GlobalProtect app
        Connections
         tab under
        Settings
        .
        1. Open the GlobalProtect app.
        2. Select
          Settings
           to open the GlobalProtect Settings panel, and then select
          Connections
          .
      2. View and collect the GlobalProtect logs
        View the PanGPS log to verify the proxy mode configuration on the GlobalProtect portal.
        You can verify that Proxy mode is configured by looking for the following event in the PanGPS log:
        OnProxyAgentMode: proxy only mode
        To view GlobalProtect logs in Panorama, select
        Monitor
        Logs
         and:
        • GlobalProtect
          , for authentication logs
        • Traffic
           and
          Decryption
           for user access logs

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.