Explicit Proxy System Guidelines and Requirements

Set Up an Explicit Proxy to Secure Mobile Users

Configure SAML authentication, including configuring a
SAML Identity Provider
and an
Authentication Profile
, for Prisma Access. You specify the authentication profile you create in a later step.
Use the following guidelines when configuring authentication for the IdP and in Panorama:
Panorama Guidelines:
Be sure that you configure the authentication profile under the
Explicit_Proxy_Template
.
Use
mail
as the user attribute in the IdP server profile and in the
Authentication Profile
on Panorama.
Explicit proxy does not support
Sign SAML Message to IdP
in the SAML Identity Provider Server Profile.
If you configure a Master Device or Directory Sync, use
mail
or
userPrincipalName
as the
SamAccountName
in Group Mapping.
When configuring
Group Mapping Settings
during explicit proxy setup, use the same Directory Attribute for Primary Username and email, or Prisma Access does not accurately reflect user counts. For example, given the following user profile:
sAMAccountName: muser
Netbios: example
userPrincipalName: muser@example.com
mail: mobile.user@example.com
If, in the Directory Sync configuration, you use a
Primary Username
of
userPrincipalName
and an
E-Mail
of
mail
, the user information that Cortex Data Lake returns in traffic logs and the user information that the ACS returns in authentication logs will be different. In this example, ACS sends the
mail
attribute (mobile.user@example.com) to the authentication logs and Cortex Data Lake sends the
userPrincipalName
attribute (muser@example.com) to the traffic logs. As a result of this mismatch, your user count will not be accurate in the
Current Users
and
Users (Last 90 days)
fields when checking the explicit proxy status in the Status (
Panorama
Cloud Services
Status
Status
page. For this reason, use the same directory attribute for
Primary Username
and
E-Mail
(for example,
mail
) when specifying
Group Mapping Settings
.
When using Panorama to manage Prisma Access, the
Cloud Identity Engine
(formerly Directory Sync) does not auto-populate user and group information to security policy rules. To populate user and group information from Directory Sync and simplify rule creation, you can optionally configure a next-generation firewall as a Master Device using an on-premises or VM-series next generation firewall and associate it to Prisma Access.
IdP Guidelines:
SAML is the only supported authentication protocol. Prisma Access supports PingOne, Azure AD, and Okta as SAML authentication providers, but you should be able to use any vendor that supports SAML 2.0 as a SAML identity provider (IdP).
Use the following URLs when configuring SAML:
SAML Assertion Consumer Service
URL:
https://global.acs.prismaaccess.com/saml/acs
Entity ID
URL:
https://global.acs.prismaaccess.com/saml/metadata
For more details about configuring SAML authentication with Prisma Access, including examples for Okta and Active Directory Federation Services (ADFS) 4.0, see Authenticate Mobile Users in the Prisma Access Integration Guide (Panorama Managed).
If you use Okta as the IdP, use
mail
as the login username in the Okta profile.
Enter a single sign on URL of
global.acs.prismaaccess.com
.
Single Logout (SLO) is not supported.
To troubleshoot IdP authentication issues, use the IdP’s monitoring and troubleshooting capabilities. The ACS does not log IdP authentication failures.
When creating an
Authentication Profile
for the SAML IdP, in the
Advanced
tab, select
all
in the
Allow List
or explicit proxy will not be able to retrieve group mapping.
Configure explicit proxy settings.
Select
Panorama
Cloud Services
Configuration
Mobile Users—Explicit Proxy
and click the gear icon to edit explicit proxy
Settings
.
In the
Settings
tab, edit the following settings:
(
Optional
) In the Templates section,
Add
the template or templates that contains the configuration you want to push for explicit proxy.
By default, Prisma Access creates a new template stack
Explicit_Proxy_Template_Stack
and a new template
Explicit_Proxy_Template
. If you have existing settings you want to import, import them now. If you are starting with a new explicit proxy configuration, make sure that you are using this template when you create and edit your
Network
and
Device
settings in Panorama.
You can
Add
more than one existing template to the stack and then order them appropriately using
Move Up
and
Move Down
. Panorama evaluates the templates in the stack from top to bottom, and settings in templates that are higher in the stack take priority over the same settings specified in templates that are lower in the stack. You cannot move the default
Explicit_Proxy_Template
from the top of the stack; this prevents you from overriding any required explicit proxy settings.
In the Device Group section, select the
Parent Device Group
that contains the configuration settings you want to push for the explicit proxy, or leave the parent device group as
Shared
to use the Prisma Access device group shared hierarchy. The
Device Group Name
cannot be changed.
(
Optional
) in the Master Device section, specify a
Master Device
.
Explicit proxy uses Directory Sync to retrieve user and group information. Directory Sync does not auto-populate user and group information to security policy rules and to Panorama. To simplify rule creation based on user and group information, you can associate an on-premises or VM-series next generation firewall as a Master Device.
In the License Allocation section, specify the number of mobile users to allocate for explicit proxy.

In the
Advanced Settings
select
Allow undecrypted HTTPS traffic only from previously authenticated IPs
(selected by default).
For explicit proxy to authenticate users, decryption is mandatory.
Do not disable this check box if you have exceptions in your decryption policy. By leaving this check box selected, you only allow access to the sites that are undecrypted from IP addresses where users have previously authenticated to explicit proxy. If you choose to disable this check box, ensure that:
You do not have exceptions in your decryption policy.
You are applying source IP address-based restrictions in your security policy.
Failing to follow these recommendations and deselecting this check box enables the abuse of Explicit proxy as an open proxy that can be widely misused as a forwarding service for conducting denial of service attacks.
If a user accesses an undecrypted HTTPS site, and a user has not yet authenticated to explicit proxy from that IP address, the user is blocked. However, the user can access a decrypted site, complete authentication, and then access undecrypted sites.
In the
Group Mapping Settings
tab, configure Prisma Access to use Directory Sync for mobile users to retrieve user and group information.
You use Directory Sync to populate user and group information for an explicit proxy deployment. To configure Directory Sync, you set up Directory Sync on your AD and associate the Panorama that manages Prisma Access with Directory Sync in the hub; then, set up Directory Sync in Prisma Access.
Enter
mail
for the Directory Attribute in the
Primary Username
field and
mail
for the
E-Mail
field.

Click
OK
when finished.
Click
Configure
to configure explicit proxy setup.
Specify an
Explicit Proxy URL
.
By default, the name is
proxyname
.proxy.prismaaccess.com, where
proxyname
is the subdomain you specify, and uses port 8080. If you want to use your organization’s domain name in the Explicit Proxy URL (for example, thisproxy.proxy.mycompany.com), enter a CNAME record your organization’s domain.
For example, to map a proxy URL named thisproxy.prismaaccess.com to a proxy named thisproxy.proxy.mycompany.com, you would add a CNAME of thisproxy.proxy.prismaaccess.com to the CNAME record in your organization’s domain.
Specify an
Authentication Profile
and
Cookie Lifetime
.
Specify the SAML
Authentication Profile
you used in Step 1, or add a
New
authentication profile to use with Prisma Access.
You must configure SAML authentication, including configuring a
SAML Identity Provider
(IdP) and an
Authentication Profile
, to use an explicit proxy.
(
Optional
) Specify a
Cookie Lifetime
for the cookie that stores the users’ authentication credentials.
Prisma Access caches the user’s credentials and stores them in the form of a cookie. To change the value, specify the length of time to use in Seconds, Minutes, Hours, or Days.
If you are downloading a file, and the file download takes longer than the
Cookie Lifetime
, the file download will terminate when the lifetime value expires. For this reason, consider using a longer
Cookie Lifetime
if you download large files that take a long time to download.
Select the
Locations
and the regions associated with those locations where you want to deploy your explicit proxy for mobile users. Prisma Access adds a proxy node into each location you select.
Explicit proxy supports a subset of all Prisma Access locations. See Supported Explicit Proxy Locations for the list of locations.
The
Locations
tab displays a map. Highlighting the map shows the global regions (Americas, Europe, and Asia Pacific) and the locations available inside each region. Select a region, then select the locations you want to deploy in each region. Limiting your deployment to a single region provides more granular control over deployed regions and allows you to exclude regions as required by your policy or industry regulations. See List of Prisma Access Locations for the list of regions and locations. You can select a location in a region that is closest to your mobile users, or select a location as required by your policy or industry regulations.
Click the
Locations
tab and select a region.

Select one or more explicit proxy locations within your selected region using the map.
Hovering your cursor over a location highlights it. White circles indicate an available location; green circles indicate that you have selected that location.

In addition to the map view, you can view a list of regions and locations. Choose between the map and list view from the lower left corner. In the list view, the list displays regions sorted by columns, with all locations sorted by region. You can select
All
sites within a region (top of the dialog).

Click
OK
to add the locations.
Configure security policy rules to enforce your organization’s security policies.
Explicit proxy has rules and recommendations for configuring security policy rules. See Security Policy Guidelines and Requirements for details.
Commit your changes to Panorama and push the configuration changes to Prisma Access.
Click
Commit
Commit and Push
.
Edit Selections
and, in the
Prisma Access
tab, make sure that
Explicit Proxy
is selected in the
Push Scope
, then click
OK
.

Click
Commit and Push
.
Select the PAC file to use with explicit proxy.
Select
Panorama
Cloud Services
Configuration
Mobile Users
Explicit Proxy
.
Be sure that you enter a port of 8080 in the PAC file.
Select the
Connection Name
for the explicit proxy setup you just configured.
Enter the
PAC (Proxy Auto-Configuration) File
to use for explicit proxy.
Be sure that you understand how PAC files work and how to modify them before you upload them to Prisma Access.

Browse
and upload the file.
Prisma Access provides you with a sample PAC file; you can
Download sample PAC file
, change the values, and upload that file. See PAC File Guidelines and Requirements for PAC file requirements and guidelines as we as a description of the contents of the sample PAC file.

PAC File Guidelines and Requirements

function FindProxyForURL(url, host) { 
    /* Bypass localhost and Private IPs */ 
    var resolved_ip = dnsResolve(host); 
    if (isPlainHostName(host) || 
    shExpMatch(host, "*.local") || 
    isInNet(resolved_ip, "10.0.0.0", "255.0.0.0") || 
    isInNet(resolved_ip, "172.16.0.0",  "255.240.0.0") || 
    isInNet(resolved_ip, "192.168.0.0",  "255.255.0.0") || 
    isInNet(resolved_ip, "127.0.0.0", "255.255.255.0")) 
    return "DIRECT"; 
    /* Bypass FTP */ 
    if (url.substring(0,4) == "ftp:") 
        return "DIRECT"; 
    /* Bypass SAML, e.g. Okta */ 
    if (shExpMatch(host, "*.okta.com") || shExpMatch(host, "*.oktacdn.com")) 
        return "DIRECT"; 
        /* Bypass ACS */ 
    if (shExpMatch(host, "*.acs.prismaaccess.com")) 
        return "DIRECT"; 
    /* Forward to Prisma Access */ 
    return "PROXY foo.proxy.prismaaccess.com:8080";

var resolved_ip = dnsResolve(host); 

...

return "DIRECT";

if (url.substring(0,4) == "ftp:") 
return "DIRECT"; 

if (shExpMatch(host, "*.okta.com") || shExpMatch(host, "*.oktacdn.com")) 
return "DIRECT"; 

if (shExpMatch(host, "*.acs.prismaaccess.com")) 
return "DIRECT"; 

return "PROXY foo.proxy.prismaaccess.com:8080"

Security Policy Guidelines and Requirements

Verify and Monitor the Explicit Proxy Deployment

Check the status of your explicit proxy deployment.
Select
Panorama
Cloud Services
Status
Status
to see explicit proxy status.

The mobile users
Status
and
Config Status
fields indicate whether the connection between Prisma Access and your mobile users is
OK
, unable to fetch the status on the tunnel (
Warning
), or that the mobile users cannot connect to explicit proxy (
Error
).
Click the hyperlink next to
Current Users
and
Users (Last 90 days)
to get more information about mobile users.
Current Users

—The current number of authenticated users who have browsed traffic in the last five minutes.

Users (Last 90 days)

—The number of unique authenticated explicit proxy users for the last 90 days.


Select
Panorama
Cloud Services
Status
Monitor
Mobile Users—Explicit Proxy
to display a map showing the deployed explicit proxy locations.

Select
Panorama
Cloud Services
Status
Network Details
Mobile Users—Explicit Proxy
to view the following details:

Explicit Proxy URL
—The URL used for explicit proxy.
ACS FQDN
—The FQDN of the ACS.
SAML Meta Data
—The authentication profile metadata used by SAML. You can
Export SAML Metadata
to save the metadata file.
To troubleshoot authentication-related issues, check the traffic logs (
Monitor
Logs
Traffic
) and authentication logs (
Monitor
Logs
Authentication
). Explicit proxy displays the following IP addresses and locations in the logs:
IP Addresses
—If mobile users bypass the ACS FQDN in the PAC file, the IP address displayed in the
Source
column in the Traffic logs and the Traffic logs and the
IP Address
column in the Authentication logs, when viewed under the
Explicit_Proxy_Device_Group
, will be same as the mobile user’s IP address. If users do not bypass the ACS FQDN in the PAC file, the source IP address is the public IP address of the explicit proxy cloud firewall where redirects are going to ACS.
Locations
—If mobile users bypass the ACS FQDN in the PAC file, the Region Name displayed in the
Region
Column in
Authentication Logs
,
Current Users
, and
Users (Last 90 days)
is one of the five 5 regions (us-west-2, us-east-1, eu-west-2, eu-west-3, ap-south-1) where the ACS is deployed, and shows the region where explicit proxy is performing the redirects from the client’s browser. If users do not bypass the ACS FQDN in the PAC file, the Region Name displayed in the
Region
Column in
Authentication Logs
,
Current Users
, and
Users (Last 90 days)
is one of the five 5 regions (us-west-2, us-east-1, eu-west-2, eu-west-3, ap-south-1) where the ACS is deployed, and shows the region where explicit proxy is performing the redirects from the explicit proxy firewall.