Prisma Access
GlobalProtect in Proxy Mode (Panorama)
Table of Contents
Expand All
|
Collapse All
Prisma Access Docs
-
- Prisma Access China
- 4.0 & Later
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
-
-
-
- 5.2 Preferred and Innovation
- 5.1 Preferred and Innovation
- 5.0 Preferred and Innovation
- 4.2 Preferred
- 4.1 Preferred
- 4.0 Preferred
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
GlobalProtect in Proxy Mode (Panorama)
Panorama
) Configure the GlobalProtect app in Proxy mode.
If you convert a single-tenant
Prisma Access (Managed by Panorama)
deployment to
multitenancy, only the first tenant (the tenant you migrated) supports this
feature. Also, in this first tenant, you must set up your policy rules in the
predefined Explicit_Proxy_Device_Group rather than in a custom device group. Any
subsequent tenants you create for the multitenant deployment after the first do
not support this feature.- Enable the agent-based proxy functionality for mobile users.
- Enable explicit proxy.
- Select.PanoramaCloud ServicesConfigurationMobile Users—Explicit Proxy
- Configurethe explicit proxy setup to specify anExplicit Proxy URL.
- SelectUse GlobalProtect app to Authenticateto enable the agent-based proxy functionality.
- Enter thePAC (Proxy Auto-Configuration) FileURL. Ensure that you enter a port of 8080 in the PAC file.
- Ensure that you enter a port of 8080 in the PAC file.
- For your PAC file to work with the GlobalProtect app-based proxy, it cannot exceed 750 MB.
- The Proxy statement in the PAC file must use thePrisma AccessFQDN you configured above.
- The PAC file must be configured to bypass 3rd party VPN traffic.
Sample PAC file:function FindProxyForURL (url, host) { /* Bypass localhost and Private IPs * / var resolved_ ip = dnsResolve (host) ; if (isplainHostName (host) || shExpMatch (host,"* ‚local") || isInNet (resolved_ip,"10.0.0.0", "255.0.0.0") || isInNet (resolved ip,"172.16.0.0","255.240.0.0") || isInNet (resolved_ip,"192.168.0.0","255.255.0.0") || isInNet (resolved ip, "127.0.0.0", "255.255.255.0" )) return "DIRECT"; /* Bypass Non-HTTP * / if (url.substring (0,4) == "ftp: ") return "DIRECT”; /* Bypass VPN */ if (shExpMatch (host, "vpn. acme.com") || shExpMatch (host, "gateway. acme.com" )) return "DIRECT"; /* Bypass Private Apps */ if (shExpMatch (host,"internalapps. acme.com" ) ) return "DIRECT"; /* Forward toPrisma Access*/ return "PROXY acme-demo.proxy.prismaaccess.com: 8080";}Select theConnection Namefor the explicit proxy setup that you configured.Select theLocationsand the regions where you want to deploy your explicit proxy for mobile users.Prisma Accessadds a proxy node into each location that you select. Explicit proxy supports a subset of allPrisma Access. For the best user experience, if you are limiting the number of locations, choose locations that are closest to your end users. If a location is not available in the country where your mobile users reside, choose a location that is closest to the mobile users. - Bypass identity providers (IDPs).All requests to the proxy are authenticated. However, if you're passing IDP flows through the proxy, then you need to bypass them for the authentication to be successful.In this example, we're bypassing the GlobalProtect portal and Okta, but please customize these to the IDPs that you use.
- With theExplicit_Proxy_Device_Groupselected, selectand create a custom URL category.ObjectCustom ObjectsURL Category
- In the custom URL category, add all the FQDN domains that need to be bypassed from EP authentication.
- Selectand attach the custom URL category.Cloud ServicesConfigurationMobile UsersExplicit ProxySettingsAuthentication Settings
- Commit and push to theExplicit_Proxy_Device_Group.
- Configure the GlobalProtect portal.In Proxy mode, the connect method you set does not change the behavior of the proxy functionality. Even if you set an on-demand connect method, all internet-bound traffic will still be proxied for always-on internet security.
- In the Onboarding section, clickConfigure.
- On theGeneraltab, specify thePortal Name Type:Use Default Domain—If you select this option, your portal hostname uses the default domain name: .gpcloudservice.com. In this case, simply enter a Portal hostname to append to the default domain name.Prisma Accesswill automatically create the necessary certificates and publish the hostname to public DNS servers.Use Company Domain—Select this option if you want the domain in the portal hostname to match your company domain name (for example, myportal.mydomain.com).
- Select anAuthentication Profilethat specifies howPrisma Accessshould authenticate mobile users or create a new one.
- (Optional) Select anAuthentication Override Certificateto encrypt the secure cookies that mobile users use to authenticate to the portal and gateway.
- Enable Proxy mode on GlobalProtect.
- Select.NetworkGlobalProtect Portals
- Select the portal configuration to which you are adding the agent configuration, and then select theAgenttab.
- On theAgenttab, selectApp.
- In the App Configurations area, set theAgent Mode fortoPrisma AccessProxyto send internet traffic to the GlobalProtect agent-based proxy
- Perform optional configurations.
- (Optional) Configure the local proxy port. The port range is 1024 to 65534 and the default port is 9999. If the default port isn't available, GlobalProtect will try 10 other ports in the range of 9999 to 10009 and use the port that is available. You can also pick your own port number within the range.
- (Optional) Configure PAC Auto-Configuration (PAC) File URL if you want to push a custom PAC URL for the proxy settings to the endpoint. The PAC URL pushes to the endpoint once the user connects. When the user disconnects the GlobalProtect app, the endpoint proxy configurations are automatically disabled and reverting to the previous settings.
- (Optional) Enable Allow User to Rediscover Network if you want the user to check the portal for any new settings.
- (Optional) Configure GlobalProtect App Config Refresh Interval (hours). By default, the GlobalProtect client refreshes the cached portal configuration every 24 hours. You can change the refresh interval based on your business requirements.
- Enable Always-On internet security by configuring the following settings:
- (Optional) Configure decryption policy for explicit proxy traffic.If you enable decryption, make sure the decryption certificate is also set up as a trusted root CA.
- Selectand create a certificate that is a Trusted Root CA and a Forward Trust Certificate.DeviceCertificate ManagementCertificates
- Create a Decryption rule underExplicit_Proxy_Device Groupwith SSL forward proxy.
- Configure security policy rules for explicit proxy traffic.
- Select.PoliciesSecurity
- Set theDevice GrouptoExplicit_Proxy_Device_Group.
- Follow the Internet Gateway Security Policy Best Practices.
- (Optional) Configure the GlobalProtect app in proxy mode in a non-default route network.
- (Optional) Host a PAC file internally and add thePrisma Accessexplicit proxy FQDN as a proxy in the PAC file, or host the PAC file in a Forwarding Profile and add routes in your network for PAC service IP addresses.
- In the PAC file, forward the IDP URL andPrisma Accessportal URL to explicit proxy.
- On explicit proxy, exclude the IDP and portal URL from the authentications settings. Add the IDP and portal URL to the domain used in the authentication flows.
- Set up routes to the explicit proxy FQDN or IP addresses on perimeter devices to allow users to access the internet via the explicit proxy.
- (Optional) Add DNS records to resolve thePrisma Accessexplicit proxy FQDN to an internal IP address if users can’t resolve public domains in the branch network and add destination NAT for the internal IP address to the explicit proxy FQDN or IP address.
- Commitand your changes to Panorama andCommit and Pushthe configuration changes to Prisma AccessMobile UsersandExplicit Proxy.
- Verify and troubleshoot the agent proxy deployment.
- Verify the information about your network connection on the GlobalProtect appConnectionstab underSettings.
- Open the GlobalProtect app.
- SelectSettingsto open the GlobalProtect Settings panel, and then selectConnections.
- View and collect the GlobalProtect logsView the PanGPS log to verify the proxy mode configuration on the GlobalProtect portal.You can verify that Proxy mode is configured by looking for the following event in the PanGPS log:OnProxyAgentMode: proxy only modeTo view GlobalProtect logs in Panorama, selectand:MonitorLogs
- GlobalProtect, for authentication logs
- TrafficandDecryptionfor user access logs