Monitor and Troubleshoot Explicit Proxy

Select
Panorama
Cloud Services
Status
Status
to see Explicit Proxy status.

The mobile users
Status
and
Config Status
fields indicate whether the connection between Prisma Access and your mobile users is
OK
, unable to fetch the status on the tunnel (
Warning
), or that the mobile users cannot connect to Explicit Proxy (
Error
).
Click the hyperlink next to
Current Users
and
Users (Last 90 days)
to get more information about mobile users.
Current Users

—The current number of authenticated users who have browsed traffic in the last five minutes.

Users (Last 90 days)

—The number of unique authenticated Explicit Proxy users for the last 90 days.


Select
Panorama
Cloud Services
Status
Monitor
Mobile Users—Explicit Proxy
to display a map showing the deployed Explicit Proxy locations.

Select
Panorama
Cloud Services
Status
Network Details
Mobile Users—Explicit Proxy
to view the following details:

Explicit Proxy URL
—The URL used for Explicit Proxy.
ACS FQDN
—The FQDN of the ACS.
SAML Meta Data
—The authentication profile metadata used by SAML. You can
Export SAML Metadata
to save the metadata file.
To troubleshoot authentication-related issues, check the traffic logs (
Monitor
Logs
Traffic
) and authentication logs (
Monitor
Logs
Authentication
). Explicit Proxy displays the following IP addresses and locations in the logs:
IP Addresses
—If mobile users bypass the ACS FQDN in the PAC file, the IP address displayed in the
Source
column in the Traffic logs and the Traffic logs and the
IP Address
column in the Authentication logs, when viewed under the
Explicit_Proxy_Device_Group
, will be same as the mobile user’s IP address. If users do not bypass the ACS FQDN in the PAC file, the source IP address is the public IP address of the Explicit Proxy cloud firewall where redirects are going to ACS.
Locations
—If mobile users bypass the ACS FQDN in the PAC file, the Region Name displayed in the
Region
Column in
Authentication Logs
,
Current Users
, and
Users (Last 90 days)
is one of the five 5 regions (us-west-2, us-east-1, eu-west-2, eu-west-3, ap-south-1) where the ACS is deployed, and shows the region where Explicit Proxy is performing the redirects from the client’s browser. If users do not bypass the ACS FQDN in the PAC file, the Region Name displayed in the
Region
Column in
Authentication Logs
,
Current Users
, and
Users (Last 90 days)
is one of the five 5 regions (us-west-2, us-east-1, eu-west-2, eu-west-3, ap-south-1) where the ACS is deployed, and shows the region where Explicit Proxy is performing the redirects from the Explicit Proxy firewall.