>
    Strata Copilot
    Configure Native RDP/SSH/SMB
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma Browser
    3. Manage Prisma Browser Applications
    4. Configure Native RDP/SSH/SMB
    Download PDF
    Prisma Browser

    Configure Native RDP/SSH/SMB

    Table of Contents

    Configure Native RDP/SSH/SMB

    Guide to configure RDP/SSH
    Native RDP/SSH/SMB is a feature in Prisma Browser that allows you to access RDP (Remote Desktop Protocol) and SSH (Secure Shell) applications without the need for additional licenses.
    RDP connections can route through an RDS Gateway instead of requiring direct connections.
    Key Changes Upon Activation:
    • Native RDP takes precedence over PRA (Prisma Access Remote Access) and Remote Connections will no longer work via Prisma Browser on the tenant.
    • A new option, Remote Connection, appears under the Applications Tab.
    • Be sure to properly configure the Prisma Access Security Policy.
      1. To ensure that Prisma Browser has the correct network access when traffic is routed via Prisma Access, verify that a security policy rule allows the browser to securely access your application.
      2. Navigate to Manage > Prisma Access > Security Policy.
      3. Add a rule that allows web traffic in your security policy.
      4. Click Configuration to apply the rule.
      Refer to
    • When specifying an Access and Data Control rule, options related to Remote Connections can be found under Access and Data Control Rule → Applications → Remote Connections.

    Configure the Native RDP/SSH

    A. Applications Tab (Remote Connections)
    In the Applications directory, do the following:
    1. Click the Remote Connections tab and click Add Remote Connection.
    2. In the Add remote connection window, enter the information as needed.
    3. Be sure to configure the Remote Connection using an FQDN (Fully Qualified Domain Name), an IP address, or a PC Name (the server where the application resides).
    4. The configuration supports non-standard ports.
      1. The standard RDP port is 3389
      2. The standard SSH port is 22
    5. Select the Classification for the connection. The options are:
      • Sanctioned: A Remote Connection that is permitted.
      • Tolerated: A Remote Connection that is allowed, but is not sanctioned by the organization.
      • Unsanctioned: The connection is not authorized by the organization at all.
      • Unclassified: The connection has not yet been classified.
    6. In the Additional settings section, select the following:
      • Tags, if needed
      • Routing: Select whether or not to route the Remote Connection through Prisma Access.
      • RDS Gateway: When this field is populated, the FQDN/IP/PC Name address field above no longer requires FQDN or IP address validation. Users can enter a PC name instead.
    B. Access and Data Control Rule
    • The rule creation flow remains the same as for any other application.
    • Within the Remote Connection Application settings,
      • First, check to enable the Remote connections setting for your rule. This allows users to view and establish remote connections from the Prisma Browser.
        When this option is enabled, users can access remote connection capabilities in the browser. You can control which remote connections are available to users by configuring one or both of the following options:
        • Administrator-Defined Remote Connections
          Allow usders to access remote connections that were created and managed by an administrator.
          You can select one of the following options:
          • Any defined connection — Users can access any remote connection defined by the administrator.
          • Specific connections — Users can access only the remote connections selected in the rule.
          Use this option when administrators need to control which RDP, SSH, or other supported remote connection targets are available to users.
        • Any Remote Connection Using Manual Connect
        Allow users to manually create remote connections from the Prisma Browser.
        When this option is enabled, users can add their own remote connections from the Remote connections settings panel in the browser by selecting “+ New connection.”
        Use this option when users need the flexibility to connect to remote resources that were not preconfigured by an administrator.
    For tenants with Prisma Access entitlement, all traffic associated with user-created applications established through the manual connections option is routed through Prisma Access by default.

    Enable Native RDP/SSH

    RDP does not support Session Recording
    To enable and fully utilize the Native RDP/SSH feature, follow these steps:
    1. Configure a Remote Connection under the Applications directory.
    2. Create an Access and Data Control Policy allow access to the newly configured Remote Connection.
    3. Create a Security Policy under Explicit Proxy (EP).
      • This step is necessary to allow access to RDP/SSH applications that may reside within your data center.
        1. Navigate to Configuration > NGFW and Prisma Access.
        2. Change the Configuration Scope to Prisma Access or Explicit Proxy.
        3. Create a Security Rule in Explicit Proxy with the following parameters:
          • Source: Trust
          • Destination: Any or Specific Location
          • Applications: ms-RDP and SSH
          • Action: Allow
          You may need to duplicate these policies on other intermediaries, such as the Next-generation Firewall (NGFW), that are in the path to your private applications.
          Once a port is selected, it cannot be changed in any way. You need to define a new application with the desired port.

    File Transfer in Native RDP Sessions

    File transfer policy enforcement automatically controls the visibility of the upload and download options in the Native RDP toolbar based on the active Access and Data Control policy rules. When a user connects to a remote desktop through Prisma Browser, the file transfer toolbar adapts to display only the actions permitted by the policy.
    Prisma Browser evaluates multiple policy directives to determine whether file upload and file download options are visible in the RDP session toolbar.
    Upload (local to remote desktop> - The Upload to Desktop session remains hidden when any of the following directives is set to block in the matching Access and Data Control rule:
    • File Upload - Blocks file uploads to the remote desktop.
    • Paste from Other Apps - Blocks pasting content from other applications into the remote session.
    • Copy/Paste Between Apps - Blocks bidirectional copy and paste between applications.
    The toolbar appearance changes based on which file transfer actions the policy permits:
    Policy StateToolbar LabelToolbar Behavior
    Upload and download allowedFile transferBoth Upload to Desktop and Download sections are visible.
    Upload only allowedFile transferOnly the Upload to Desktop section is visible.
    Download only allowedFile transferOnly the Download section is visible.
    Both upload and download blockedOptionsThe file transfer icon is removed and the toolbar displays session options only.
    The toolbar adjusts automatically when the RDP session is established. Administrators do not need to configure the toolbar appearance separately — it reflects the active policy rules applied to the remote connection.
    The RDP toolbar in compact Options mode with file transfer sections hidden
    For details on configuring File Upload and File Download directives, refer to Configure Data Leak Prevention.

    Migration from Remote Connections

    Native Clients and Remote Connections/PRA cannot co-exist in Prisma Browser. Remote Connections/PRA must be disabled first for Native RDP/SSH to work.
    If Remote Connections/PRA is currently not enabled on your tenant, you must request that this feature be added by contacting your customer-success manager.
    1. Take Note of All Configurations: Before disabling, record all existing Remote Connection configurations as you will need to manually reconfigure the applications and update the policies later.
      • Self-Correction: You will need this information to re-configure the apps as Remote Connection Apps.
    2. Disable Remote Connections:
      • Navigate to Administration > Remote Connection.
      • Disable the toggle switch.
    1. Configure Remote Connection Apps: Once disabled, Remote Connections will be renamed to Remote Connection Apps in the administration screens. You can now configure the applications and policies for the new feature.
    2. Follow the Enablement Steps: Proceed with the steps outlined in Enable Native RDP/SSH.

    User Experience

    Users access the Remote Connections feature through the Prisma Browser client interface.
    1. Click on the Prisma Browser Profile Icon.
    2. Click on Remote Connections
      This will open a list of the available remote connections.
    3. Select the remote connection that you need, and click Connect.
    4. In the window, enter your username and password.
    5. Select the check boxes you need. Select Use these credentials for gateway to apply the entered credentials to both the remote connection authentication and the gateway authentication..
    6. Click Connect now.
    This will open a new tab for Remote Connections where the user can view:
    • All RDP/SSH applications allowed per the policy created by the administrator.
    • An option to add "New Connections," if the Manual Connect option is enabled for their profile/scope.
    Connection Management:
    • Connections defined by the user can be Edited or Deleted from the list.
    • Connections defined by the administrator cannot be edited by the user.
    Only 1 additional connection can be defined with the same IP/FQDN. This means that a maximum of 2 IP/FQDNs can share the same connection.

    Native SMB File Sharing

    Native SMB file sharing** enables users to browse, upload, download, and manage files on remote SMB (Server Message Block) file shares directly from the Prisma Browser — without requiring a VPN client or native SMB/CIFS tools. Connections are established over TCP on port 445 (or a custom port) and can route through Prisma Access when configured.
    Native SMB file sharing requires the Prisma Browser Desktop. The Prisma Browser Extension amd the Prisma Browser for Mobile do not support this feature.

    Configure an SMB Remote Connection

    To add an SMB file share as a remote connection:
    1. In the Applications directory, click the Remote Connections tab and click Add Remote Connection.
    2. In the Add remote connection window, select SMB as the protocol.
    3. Enter the server address in the Address field. Specify a fully qualified domain name (FQDN) or IP address.
    4. The default port is 445. Modify the port if the SMB server uses a non-standard port.
    5. In the SMB Share field, enter the share name on the server (for example, `SharedDocs` or `Finance`).
    6. Select the Classification for the connection:
      • Sanctioned - The connection is permitted by the organization.
      • Tolerated - The connection is allowed but not sanctioned by the organization.
      • Unsanctioned - The connection is not authorized by the organization.
      • Unclassified - The connection has not yet been classified.
    7. In the **Additional settings** section, configure the following as needed:
      • Tags - Assign tags to the connection.
      • Routing - Select whether to route the connection through Prisma Access.

    Access and Data Control for SMB

    The rule creation flow for SMB connections follows the same process as for RDP and SSH applications. Within the Remote Connection Application settings:
    1. Enable the Remote connections setting for the rule. This allows users to view and establish remote connections from the Prisma Browser.
    2. Configure access using one or both of the following options:
      • Administrator-Defined Remote Connections - Allow users to access remote connections created and managed by an administrator. Select Any defined connection to allow all administrator-defined connections, or Specific connections to allow only selected connections.
      • Any Remote Connection Using Manual Connect - Allow users to manually create remote connections from the Remote connections settings panel in the browser.
      For tenants with Prisma Access entitlement, all traffic associated with user-created applications established through the manual connections option is routed through Prisma Access by default.

    SMB User Experience

    Users access SMB file shares through the Prisma Browser client interface.

    Connect to an SMB File Share

    1. Click the Prisma Browser Profile Icon.
    2. Click Remote Connections.
    3. Select the SMB file share from the list of available remote connections and click Connect.
    4. In the Login window, enter the following credentials
      • Username - The SMB account username.
      • Password - The SMB account password.
      • SMB Share - The share name (pre-filled from the administrator-defined connection configuration).
      • Host - The server address (displayed only for manually created connections).
    5. (Optional) Select Remember credentials to save the username and password for future connections.
    6. Click Connect now.
    After a successful connection, the SMB file browser opens and displays the root directory of the file share.

    File Browser Interface

    The SMB file browser provides a file-manager interface with the following components:
    • Navigation bar - Displays the current directory path. Click path segments to navigate to parent directories.
    • Sidebar - Lists the server name, saved favorites, and a link to the share root.
    • File list - Displays files and folders in the current directory with names, sizes, and modification dates.
    • Status bar - Shows the item count and total size of the current directory page.
    Directories with more than 500 items display pagination controls (First, Previous, Next, Last) and a Refresh button.

    Supported File Operations

    OperationDescription
    BrowseNavigate through directories. Click a folder to open it.
    Upload FilesClick **Upload Files** in the toolbar. Select one or more files from the local file picker. Up to 4 files upload simultaneously.
    Upload ~FolderClick **Upload Folder** in the toolbar. Select a folder to upload its entire contents, including subdirectories.
    DownloadSelect one or more files and click **Download** in the toolbar. A save dialog appears for each file.
    Create FolderClick **Create Folder** in the toolbar. Enter a folder name (maximum 255 characters).
    RenameRight-click a file or folder and select **Rename**. Enter the new name and press Enter.
    DeleteRight-click a file or folder and select **Delete**. Confirm the deletion in the dialog. For non-empty folders, confirm recursive deletion of all contents.
    MoveDrag and drop files or folders to a different directory within the file browser
    FavoriteAdd the current folder to favorites for quick access from the sidebar.
    File Operation Details
    Upload Behavior
    • Files upload in 64 KB chunks with a maximum of 4 concurrent uploads.
    • Folder uploads process files sequentially.
    • If a file the same name already exists, a prompt asks whether to replace it.
    • An upload that makes no progress for 10 minutes is automatically cancelled.
    • A progress overlay displays the upload status, including files completed, bytes transferred, and the current file path
    Download Behavior:
    • Files download one at a time.
    • Folder download is not supported. Select individual files to download.
    • A native save dialog appears for each downloaded file.
    Delete Behavior:
    • Deleting a non-empty folder prompts for confirmation before recursively removing all contents.
    • A progress overlay displays the deletion status during recursive folder deletion.

    Limitations

    • Folder download is not supported. Select individual files to download
    • File and folder names cannot exceed 255 characters or contain `/`, `\`, or control characters.
    • The file browser connects to one SMB share at a time.
    • Double-clicking a file initiates a download. File preview is not available within the file browser.
    • File search is limited to the current page of the paginated list within the selected folder; other pages and nested folders are not searched.
    • Native SMB file sharing requires the Prisma Browser Desktop. The Prisma Browser Extension and Prisma Browser for Mobile do not support this feature.

    © 2026 Palo Alto Networks, Inc. All rights reserved.