GlobalProtect — Customize Tunnel Settings (Strata Cloud Manager)

1. Click ConfigurationNGFW and Prisma AccessConfiguration ScopePrisma AccessGlobalProtectGlobalProtect AppTunel Settings.

   Alternatively, you can Clone an existing app setting and modify it.

2. Enter a name and the Match Criteria to specify the users, devices, or systems that should receive the settings. For example, you could specify that a tunnel settings rule applies to all instances of the GlobalProtect app in a certain region.
3. Enable Authentication Override for Prisma Access to generate and accept secure, encrypted cookies for user authentication. This setting allows the user to provide login credentials only once during the specified period of time.

   • Generate cookie for authentication override—Enables the Prisma Access to generate encrypted, endpoint-specific cookies and issue authentication cookies to the endpoint.
   • Accept cookie for authentication override—Enables Prisma Access to authenticate users with a valid, encrypted cookie. When the app presents a valid cookie, Prisma Access verifies that the cookie was encrypted by Prisma Access originally, decrypts the cookie, and then authenticates the user.
     The GlobalProtect app must know the username of the connecting user to match and retrieve the associated authentication cookies from the user’s endpoint. After the app retrieves the cookies, it sends them to Prisma Access for user authentication.
4. Enable Split Tunneling to define what traffic the GlobalProtect app allows or restricts through the VPN tunnel to Prisma Access. Split Tunneling conserves bandwidth by excluding Prisma Access traffic that is not business critical or does not enable productivity.

   • Local Network Access—Give Windows and Mac users access to local resources, without requiring them to first connect to Prisma Access.
     Exclude Traffic—Specify traffic to exclude from Prisma Access policy inspection and enforcement based on application, domain, and route (like an IP address).
     Customize Include Traffic—By default, the GlobalProtect app routes all traffic to Prisma Access except what's in the exclude list. Specify traffic that the GlobalProtect app should always route to Prisma Access, even when it meets exclude list criteria.
5. (Optional) Exclude Traffic to not send Video Traffic and Application Traffic from the listed applications to Prisma Access.

   By excluding lower risk video streaming traffic (such as YouTube and Netflix) and applications (such as Microsoft updates (ms-updates)) from the VPN tunnel, you can decrease bandwidth consumption. The video streaming exclusions are applied to all traffic the GlobalProtect app sends to Prisma Access, not just the match criteria you've defined for this rule.

6. Save the settings. Repeat the above steps to add more tunnel settings.
7. (Optional) Move to set the order of priority in which the VPN tunnel setting is used while connecting to Prisma Access.