GlobalProtect in Proxy Mode (Strata Cloud Manager)
Focus
Focus
Prisma Access

Cloud Management

Table of Contents


GlobalProtect in Proxy Mode (
Strata Cloud Manager
)

Configure GlobalProtect in Proxy mode.
  1. Enable the agent-based proxy functionality for mobile users on Prisma Access.
    1. Enable Explicit Proxy.
      1. Select
        Settings
        Prisma Access
        Setup
        Mobile Users
        and click
        Explicit Proxy Setup
        .
        If you're using Strata Cloud Manager, go to
        Workflows
        Prisma Access
        Setup
        Mobile Users
        and click
        Explicit Proxy Setup
        .
      2. In the Infrastructure Settings area, click
        Setup Proxy Settings
        and specify an
        Explicit Proxy URL
        .
    2. Enable Agent Proxy
      and click
      Save
      .
    3. Choose the
      Prisma Access
      where you want to support mobile users.
      For the best user experience, if you're limiting the number of locations, choose locations that are closest to your end users. If a location isn't available in the country where your mobile users reside, choose a location that’s closest to the mobile users.
    4. Configure a proxy auto-configuration (PAC) file for Explicit Proxy that meets the following requirements.
      • For your PAC file to work with the GlobalProtect app-based proxy, it cannot exceed 1 MB.
      • The Proxy statement in the PAC file must use the
        Prisma Access
        FQDN you configured above.
      • The PAC file must be configured to bypass 3rd party VPN traffic.
      Sample PAC file:
      function FindProxyForURL (url, host) { /* Bypass localhost and Private IPs * / var resolved_ ip = dnsResolve (host) ; if (isplainHostName (host) || shExpMatch (host,"* ‚local") || isInNet (resolved_ip,"10.0.0.0", "255.0.0.0") || isInNet (resolved ip,"172.16.0.0","255.240.0.0") || isInNet (resolved_ip,"192.168.0.0","255.255.0.0") || isInNet (resolved ip, "127.0.0.0", "255.255.255.0" )) return "DIRECT"; /* Bypass Non-HTTP * / if (url.substring (0,4) == "ftp: ") return "DIRECT”; /* Bypass VPN */ if (shExpMatch (host, "vpn. acme.com") || shExpMatch (host, "gateway. acme.com" )) return "DIRECT"; /* Bypass Private Apps */ if (shExpMatch (host,"internalapps. acme.com" ) ) return "DIRECT"; /* Forward to
      Prisma Access
      */ return "PROXY acme-demo.proxy.prismaaccess.com: 8080";}
    5. Select
      Settings
      Prisma Access
      Setup
      Explicit Proxy
      Advanced Security Settings - Explicit Proxy
      Authentication Settings
      and add the domains you need to bypass.
      If you're using Strata Cloud Manager, go to
      Workflows
      Prisma Access
      Setup
      Explicit Proxy
      Advanced Security Settings
      Authentication Settings
      .
      All requests to the proxy undergo authentication. However, if you're passing IdP flows through the proxy, then you need to bypass them for the authentication to be successful.
      In this example, we are bypassing the GlobalProtect portal and Okta, but please customize these to the IdPs that you use.
  2. Set up the GlobalProtect portal, authentication, and configure Proxy mode for the GlobalProtect app.
    1. Enable GlobalProtect for mobile users and set up the GlobalProtect portal.
    2. Enable GlobalProtect proxy mode for
      Prisma Access
      in the GlobalProtect app settings to send internet traffic to the agent-based proxy.
      The GlobalProtect connect method does not apply in proxy mode as it's always on.
      • Select
        Settings
        Prisma Access
        Setup
        GlobalProtect
        .
        If you're using Strata Cloud Manager, go to
        Workflows
        Prisma Access
        Setup
        GlobalProtect
        .
      • On the
        GlobalProtect App
        tab, click
        Default
        to customize the app settings or
        Add App Settings
        add a new configuration.
      • Click
        Show Advanced Options
        and in the
        App Configuration
        section.
      • Set
        Agent Mode for
        Prisma Access
        to
        Proxy
        to instruct the GlobalProtect app to send the internet traffic to the Explicit Proxy on Prisma Access.
      • (
        Optional
        ) Configure the local proxy port. The port range is 1024 to 65534 and the default port is 9999. If the default port isn't available, GlobalProtect will try 10 other ports in the range of 9999 to 10009 and use the port that is available. You can also pick your own port number within the range.
      • (
        Optional
        ) Configure PAC Auto-Configuration (PAC) File URL if you want to push the new PAC URL for the proxy settings to the endpoint. The PAC URL pushes to the endpoint once the user connects. When the user disconnects the GlobalProtect app, the endpoint proxy configurations are automatically disabled and reverting to the previous settings.
      • (
        Optional
        ) Enable Allow User to Rediscover Network if you want the user to check the portal for any new settings.
      • (
        Optional
        ) Configure GlobalProtect App Config Refresh Interval (hours). By default, the GlobalProtect client refreshes the cached portal configuration every 24 hours. You can change the refresh interval based on your business requirements.
      • Disable
        Set Up Tunnel Over Proxy (Windows & Mac Only)
        .
    3. Enable Always-On internet security by configuring the following settings on the
      Settings
      Prisma Access
      Setup
      GlobalProtect
      GlobalProtect App
      Add App Settings
      page:
      If you're using Strata Cloud Manager, go to
      Workflows
      Prisma Access
      Setup
      GlobalProtect
      GlobalProtect App
      Add App Settings
      .
      1. Set Disable GlobalProtect to
        Disallow
        ,
        Allow with Passcode
        , or
        Allow with Ticket
        .
  3. Configure decryption for Explicit Proxy traffic.
    • Select
      Manage
      Security Services
      Decryption
      .
      If you're using Strata Cloud Manager, go to
      Manage
      Configuration
      NGFW and
      Prisma Access
      Security Services
      Decryption
      .
    • If you enable decryption, make sure you set up the decryption certificate as a trusted root CA.
  4. Configure Security policy rules for Explicit Proxy traffic.
  5. (
    Optional
    ) Configure the GlobalProtect app in proxy mode in a no default route network.
    • (
      Optional
      ) Host a PAC file internally and add the
      Prisma Access
      Explicit Proxy FQDN as a proxy in the PAC file, or host the PAC file in a Forwarding Profile and add routes in your network for PAC service IP addresses.
    • In the PAC file, forward the IdP URL and
      Prisma Access
      portal URL to Explicit Proxy.
    • On Explicit Proxy, exclude the IdP and portal URL from the authentication settings. Add the IdP and portal URL to the domain used in the authentication flows.
    • Set up routes to the Explicit Proxy FQDN or IP addresses on perimeter devices to allow users to access the internet via the Explicit Proxy.
    • (
      Optional
      ) Add DNS records to resolve the
      Prisma Access
      Explicit Proxy FQDN to an internal IP address if users can’t resolve public domains in the branch network and add destination NAT for the internal IP address to the Explicit Proxy FQDN or IP address.
  6. Click
    Save
    and
    Push Config
    to
    GlobalProtect
    and
    Explicit Proxy
    .
  7. Verify and troubleshoot the agent proxy deployment.
    1. Verify the information about your network connection on the GlobalProtect app
      Connections
      tab under
      Settings
      .
      1. Open the GlobalProtect app.
      2. Select
        Settings
        to open the GlobalProtect Settings panel, and then select
        Connections
        .
    2. View and collect the GlobalProtect logs.
      View the PanGPS log to verify the proxy mode configuration on the GlobalProtect portal.
      You can verify that Proxy mode is configured by looking for the following event in the PanGPS log:
      OnProxyAgentMode: proxy only mode
      To view GlobalProtect logs in
      Prisma Access
      , select
      Activity
      Logs
      Log Viewer
      and:
      If you're using Strata Cloud Manager, go to
      Incidents & Alerts
      Log Viewer
      .
      • GlobalProtect
        , for authentication logs
      • Traffic
        and
        Decryption
        for user access logs


Recommended For You