Secure Mobile Users with an Explicit Proxy
Table of Contents
Expand All
|
Collapse All
Prisma Access Docs
-
- Prisma Access China
- 4.0 & Later
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
-
-
-
- 5.2 Preferred and Innovation
- 5.1 Preferred and Innovation
- 5.0 Preferred and Innovation
- 4.2 Preferred
- 4.1 Preferred
- 4.0 Preferred
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
Secure Mobile Users with an Explicit Proxy
Secure Prisma Access mobile users by creating an Explicit
Proxy and using a PAC file.
To secure mobile users with an Explicit Proxy,
complete the following steps.
Before you configure Explicit
Proxy guidelines, be aware of how explicit proxy
works and how explicit proxy
identifies users, go through the planning checklist,
and learn how to set up the Explicit
Proxy PAC file.
- Configure SAML authentication, including configuring aSAML Identity Providerand anAuthentication Profile, for Prisma Access. You specify the authentication profile you create in a later step.Use the following guidelines when configuring authentication for the IdP and in Panorama:
- Panorama Guidelines:
- Be sure that you configure the authentication profile under theExplicit_Proxy_Template.
- Usemailas the user attribute in the IdP server profile and in theAuthentication Profileon Panorama.
- Explicit Proxy does not supportSign SAML Message to IdPin the SAML Identity Provider Server Profile.
- When you configure the Cloud Identity Engine to retrieve user and group mapping information, usemailoruserPrincipalNameas theSamAccountNamein Group Mapping.
- When configuringGroup Mapping Settingsduring Explicit Proxy setup, use the same Directory Attribute for Primary Username and email, or Prisma Access does not accurately reflect user counts. For example, given the following user profile:sAMAccountName: muser Netbios: example userPrincipalName: muser@example.com mail: mobile.user@example.comIf, in the Cloud Identity Engine configuration, you use aPrimary UsernameofuserPrincipalNameand anE-Mailofmail, the user information thatStrata Logging Servicereturns in traffic logs and the user information that the ACS returns in authentication logs will be different. In this example, ACS sends themailattribute (mobile.user@example.com) to the authentication logs andStrata Logging Servicesends theuserPrincipalNameattribute (muser@example.com) to the traffic logs. As a result of this mismatch, your user count will not be accurate in theCurrent UsersandUsers (Last 90 days)fields when checking the Explicit Proxy status in the Status (page. For this reason, use the same directory attribute forPanoramaCloud ServicesStatusStatusPrimary UsernameandE-Mail(for example,mail) when specifyingGroup Mapping Settings.
- When using Panorama to manage Prisma Access, the Cloud Identity Engine does not auto-populate user and group information in security policy rules.
- IdP Guidelines:
- Use the following URLs when configuring SAML:SAML Assertion Consumer ServiceURL:https://global.acs.prismaaccess.com/saml/acsEntity IDURL:https://global.acs.prismaaccess.com/saml/metadata
- If you use Okta as the IdP, useEmailAddressfor theName ID Formatsetting.
- Enter a single sign on URL ofhttps://global.acs.prismaaccess.com/saml/acs.
- Single Logout (SLO) is not supported.
- To troubleshoot IdP authentication issues, use the IdP’s monitoring and troubleshooting capabilities. The ACS does not log IdP authentication failures.
- When creating anAuthentication Profilefor the SAML IdP, in theAdvancedtab, selectallin theAllow Listor Explicit Proxy will not be able to retrieve group mapping.
- Configure Explicit Proxy settings.
- Selectand click the gear icon to edit Explicit ProxyPanoramaCloud ServicesConfigurationMobile Users—Explicit ProxySettings.
- In theSettingstab, edit the following settings:
- (Optional) In the Templates section,Addthe template or templates that contains the configuration you want to push for Explicit Proxy.By default, Prisma Access creates a new template stackExplicit_Proxy_Template_Stackand a new templateExplicit_Proxy_Template. If you have existing settings you want to import, import them now. If you are starting with a new Explicit Proxy configuration, make sure that you are using this template when you create and edit yourDevicesettings in Panorama.You canAddmore than one existing template to the stack and then order them appropriately usingMove UpandMove Down. Panorama evaluates the templates in the stack from top to bottom, and settings in templates that are higher in the stack take priority over the same settings specified in templates that are lower in the stack. You cannot move the defaultExplicit_Proxy_Templatefrom the top of the stack; this prevents you from overriding any required Explicit Proxy settings.
- In the Device Group section, select theParent Device Groupthat contains the configuration settings you want to push for the Explicit Proxy, or leave the parent device group asSharedto use the Prisma Access device group shared hierarchy. TheDevice Group Namecannot be changed.
- (Optional) If you have configured a next-generation firewall as a master device or added a Cloud Identity Engine profile to make user and group information selectable in security policies, selectUser-ID Master DeviceorCloud Identity Engine; then, select either the Master Device or the Cloud Identity Engine profile that you created.
- In the License Allocation section, specify the number of mobile users to allocate for Explicit Proxy.
- In theGroup Mapping Settingstab,Enable Directory Sync Integration(now known as the Cloud Identity Engine) to configure Prisma Access to use the Cloud Identity Engine to retrieve user and group information.You use the Cloud Identity Engine to populate user and group mapping information for an Explicit Proxy deployment. To configure the Cloud Identity Engine, you set up the Cloud Identity Engine on your AD and associate the Panorama that manages Prisma Access with the Cloud Identity Engine in the hub; then, set up the Cloud Identity Engine in Prisma Access.Entermailfor the Directory Attribute in thePrimary Usernamefield andmailfor theE-Mailfield.
- ClickOKwhen finished.
- (Optional, Innovation Deployments Starting with 3.0 Innovation Only) Configure Block Settings.Use Block Settings to block access to an internet destination at the DNS resolution stage.To restrict access to Explicit Proxy to specific source IP addresses, you can also use special objects. These Address Objects, Address Groups, and External Dynamic Lists (EDLs) that use specific names allow the IP addresses you specify for internet traffic and block any other IP addresses.
- In theAuthentication Settingstab, configure decryption, X-Authenticated-User (XAU), and authentication settings.
- Configure your settings for decrypted traffic.
- SelectDecrypt Traffic That Matches Existing Decryption rules; For Undecrypted Traffic, Allow Traffic Only From Known IPs Registered By Authenticated Usersto configure the following decryption rules:
- Traffic that matches decryption policy rules you have configured with anActiontoDecryptorDecrypt and Forwardwill be decrypted.If a user accesses an undecrypted HTTPS site, and a user has not yet authenticated to Explicit Proxy from that IP address, the user is blocked. However, the user can access a decrypted site, complete authentication, and then access undecrypted sites.
- Undecrypted traffic is allowed from IP addresses from which mobile user have already authenticated.
Explicit Proxy requires decryption to authenticate users. Enter the domains that can be decrypted in a custom URL category; then, specify those categories inIf Authentication traffic is forwarded through Explicit Proxy, specify the domains used in the authentication flow.Only add the domains that are required for authentication to the Custom URL category you specify, including all ACS and IdP FQDNs. You must add authentication URLs to the Custom URL category, even if you have added them to a decryption policy. - To allow all traffic to be decrypted, selectDecrypt All traffic (Overrides Existing Decryption Rules).If you choose this radio button, ensure that:
- You do not have exceptions in your decryption policy.
- You are applying source IP address-based restrictions in your security policy.
Failing to follow these recommendations enables the abuse of Explicit Proxy as an open proxy that can be widely misused as a forwarding service for conducting denial of service attacks.- You have at least one SSL Forward Proxy certificate specified as aForward Trust Certificate.If you do not have a forward trust certificate, create one on Panorama; then,Commit and Pushyour changes to Prisma Access. Failure to have a forward trust certificate will cause a commit error when you commit your Explicit Proxy changes.
- (Optional) Enter any IP addresses from which undecrypted HTTP or HTTP Cross-Origin Resource Sharing (CORS) traffic should be allowed to theTrusted Source Address.Add the IP addresses to IP address-based Address Objects andAddthe address objects in the field.Enter a maximum of 100,000 addresses. Make sure that the address object uses IP addresses only.
- (Optional) If you want to allow theTrusted Source AddressIP addresses to use XAU for identity, selectUse X-Authenticated-User (XAU) header on incoming HTTP/HTTPS requests for Identity.Select this option if you if you are using proxy chaining from a third-party proxy to Explicit Proxy, users have authenticated in that proxy, and the proxy uses XAU headers.XAU headers are the only HTTP headers supported for Explicit Proxy header ingestion. X-Forwarded-For (XFF) headers are not supported.
- (Optional) Specify settings for privacy-sensitive websites by creating security policy rules for those sites, then specifying theSecurity Policyor policies for those sites in theEnforce Authentication Onlyarea.For any websites you specify in the in theSecurity Policyor policies you add, Explicit Proxy decrypts the websites based on the decryption policies, but does not inspect or log the decrypted traffic.
- (Optional) If you want to forward traffic to Explicit Proxy from your branches through a secure IPSec tunnel, configureAdvancedsettings and retrieve anycast IP addresses if you want to use Explicit Proxy in conjunction with a Prisma Access remote network.This solution uses anycast addresses with a remote network IPSec tunnel to allow Explicit Proxy to be used for users and devices at a remote network site or branch location.
- ClickConfigureto configure Explicit Proxy setup.
- Specify anExplicit Proxy FQDN.By default, the name isproxyname.proxy.prismaaccess.com, whereproxynameis the subdomain you specify, and uses port 8080. If you want to use your organization’s domain name in the Explicit Proxy URL (for example, thisproxy.proxy.mycompany.com), enter a CNAME record your organization’s domain.For example, to map a proxy URL named thisproxy.prismaaccess.com to a proxy named thisproxy.proxy.mycompany.com, you would add a CNAME of thisproxy.proxy.prismaaccess.com to the CNAME record in your organization’s domain.
- Specify anAuthentication ProfileandCookie Lifetime.
- Specify the SAMLAuthentication Profileyou used in Step 1, or add aNewauthentication profile to use with Prisma Access.You must configure SAML authentication, including configuring aSAML Identity Provider(IdP) and anAuthentication Profile, to use an Explicit Proxy.
- (Optional) Specify aCookie Lifetimefor the cookie that stores the users’ authentication credentials.Prisma Access caches the user’s credentials and stores them in the form of a cookie. To change the value, specify the length of time to use in Seconds, Minutes, Hours, or Days.To prevent issues with users not being able to download large files before the cookie lifetime expires, or the cookie expiring when users are accessing a single website for a long period of time, Palo Alto Networks recommends that you configure a Cookie Lifetime of at least one day. If Explicit Proxy users have a cookie lifetime expiration issue, they can browse to a different website to re-authenticate to ACS and refresh the ACS cookie.If you are downloading a file, and the file download takes longer than theCookie Lifetime, the file download will terminate when the lifetime value expires. For this reason, consider using a longerCookie Lifetimeif you download large files that take a long time to download.
- Select theLocationsand the regions associated with those locations where you want to deploy your Explicit Proxy for mobile users. Prisma Access adds a proxy node into each location you select.Explicit Proxy supports a subset of all Prisma Access locations. See Explicit Proxy Locations for the list of locations.TheLocationstab displays a map. Highlighting the map shows the global regions (Americas, Europe, and Asia Pacific) and the locations available inside each region. Select a region, then select the locations you want to deploy in each region. Limiting your deployment to a single region provides more granular control over deployed regions and allows you to exclude regions as required by your policy or industry regulations. See Prisma Access Locations for the list of regions and locations. You can select a location in a region that is closest to your mobile users, or select a location as required by your policy or industry regulations.
- Click theLocationstab and select a region.
- Select one or more Explicit Proxy locations within your selected region using the map.Hovering your cursor over a location highlights it. White circles indicate an available location; green circles indicate that you have selected that location.In addition to the map view, you can view a list of regions and locations. Choose between the map and list view from the lower left corner. In the list view, the list displays regions sorted by columns, with all locations sorted by region. You can selectAllsites within a region (top of the dialog).
- ClickOKto add the locations.
- Configure security policy rules to enforce your organization’s security policies.To make required configuration changes and to control the URLs that mobile users can access from Explicit Proxy, use security policies. Use the following guidelines and requirements when configuring your security policies:
- Based on your business goals, create security policies for sanctioned internet and SaaS apps using App-ID and user groups that need access to those applications.
- Attach security profiles to all security policy rules so that you can prevent both known and unknown threats following the security profile best practices.
- Commit your changes to Panorama and push the configuration changes to Prisma Access.
- Click.CommitCommit and Push
- Edit Selectionsand, in thePrisma Accesstab, make sure thatExplicit Proxyis selected in thePush Scope, then clickOK.
- ClickCommit and Push.
- Select the PAC file to use with Explicit Proxy.
- Select.PanoramaCloud ServicesConfigurationMobile UsersExplicit ProxyBe sure that you enter a port of 8080 in the PAC file.
- Select theConnection Namefor the Explicit Proxy setup you just configured.
- Enter thePAC (Proxy Auto-Configuration) Fileto use for Explicit Proxy.Be sure that you understand how PAC files work and how to modify them before you upload them to Prisma Access.Browseand upload the file.Prisma Access provides you with a sample PAC file; you canDownload sample PAC file, change the values, and upload that file. See Set Up Your Explicit Proxy PAC File for PAC file requirements and guidelines as we as a description of the contents of the sample PAC file.