How Explicit Proxy Works With GlobalProtect

Before you decide what applications or traffic you should protect with Explicit Proxy and which applications you should protect with either GlobalProtect or a third-party VPN, you should understand how GlobalProtect and Prisma Access make their forwarding decisions based on the Explicit Proxy and VPN configuration. The examples in this section assume that you have already deployed Explicit Proxy and GlobalProtect into your organization’s network and have configured GlobalProtect split tunnel options. The following figure shows the process.

When a mobile user requests an private or internet-based resource or app, the request is evaluated by the Explicit Proxy PAC file on the endpoint.

• A return "DIRECT"; function in the PAC file causes the traffic specified in the expression to bypass Explicit Proxy processing.
  Explicit Proxy provides you with a sample PAC file that uses the return "DIRECT"; function with IP addresses and URLs. See PAC File Guidelines and Requirements to see the contents of the PAC file and a description of how to use it.
• A dnsresolve(host) function in the PAC file forces the endpoint to make a DNS query to resolve a hostname to an IP address. This query then follows the VPN policy (for example, split tunnel or split DNS) for forwarding the DNS request to the destination DNS server.
  The PAC file provided with Explicit Proxy uses dnsresolve(host), return "DIRECT";, and private IP addresses together in an expression. If, after a DNS lookup, the returned IP address is included with the private IP addresses in the expression, the traffic associated with the private IP address bypasses Explicit Proxy processing.
• Traffic that is specified in the PAC file as return "PROXY sitename:8080"; is forwarded to Explicit Proxy.

After the web request is evaluated based on the conditions in the PAC file, it is then sent to the GlobalProtect or third-party VPN configuration on the endpoint for processing and the traffic is evaluated in the GlobalProtect app for split tunnel configuration options. You can split traffic based on domain (URL) or application or subnet. If you have configured split DNS options in GlobalProtect, traffic is also evaluated based on those DNS options.

After the traffic is processed, it is then sent to GlobalProtect, direct to the internet, or to Explicit Proxy, based on the PAC file and VPN processing.

The following figure shows a mobile user attempting to access a private resource using the URL internal-app.corp.com.

• The PAC file has the following configuration to allow internal-app.corp.com to bypass Explicit Proxy.

      /* Bypass internal URL */ 
      if (shExpMatch(host, "*internal-app.corp.com")) 
          return "DIRECT"; 
  

• When the mobile user requests internal-app.corp.com from their browser, the browser evaluates the conditions in the PAC file. Based on that evaluation, the browser does not forward the request to the proxy and sends it directly to the GlobalProtect app.
• GlobalProtect notes that internal-app.corp.com is listed in the Include Domain and sends it through the VPN tunnel.
• GlobalProtect sends the request to the resource in internal-app.corp.com based on the configuration options in GlobalProtect.

You might want to configure some resources, such as login resources, so that they do not use either Explicit Proxy or the GlobalProtect or third-party VPN for processing. The following figure shows a user logging in to Microsoft Online by entering login.microsoftonline.com from their browser.

• The PAC file has the following configuration to allow internal-app.corp.com to bypass Explicit Proxy traffic.

      /* Bypass internal URL */ 
      if (shExpMatch(host, "login.microsoftonline.com")) 
          return "DIRECT"; 
  

• When the mobile user requests login.microsoftonline.com from their browser, the PAC file evaluates the request from the PAC file in the mobile user’s endpoint and then sends it to the GlobalProtect VPN configuration (GlobalProtect in this case) for processing.
• The GlobalProtect app notes that login.microsoftonline.com is listed in the Exclude Domain.
• GlobalProtect bypasses the VPN and sends the request direct to the internet, based on the configuration options in GlobalProtect.

Requirements and Recommendations for Using Explicit Proxy with GlobalProtect and Third-Party VPNs

Use Explicit Proxy with GlobalProtect

1. Plan your Mobile Users—Explicit Proxy deployment and your GlobalProtect deployment (either your Mobile Users—GlobalProtect or standalone GlobalProtect deployment).
2. Decide which applications you want to send to GlobalProtect and which applications you want to send to Explicit Proxy.

   The following steps direct private applications hosted at your data center to GlobalProtect and requests to internet and public SaaS applications to Explicit Proxy.
3. In the Panorama that manages Prisma Access, configure GlobalProtect portal settings.

   1. Select NetworkGlobalProtectPortals.

      Be sure that you are in the Mobile_Users_Template from the Template drop-down.
   2. Select GlobalProtect_Portal to edit the Prisma Access portal configuration.
   3. Select the Agent tab and select the DEFAULT configuration or Add a new one.
   4. Select the App tab.
   5. Make the following app configuration changes:

      • In Detect Proxy for Each Connection, select Yes.
      • In Set Up Tunnel Over Proxy (Windows & Mac Only), select No.
      • In Use Default Browser for SAML Authentication, select Yes.
4. Create a split tunnel in GlobalProtect that allows you to direct the internal traffic to GlobalProtect.

   The following example uses a split tunnel to direct traffic based on domain (FQDN); you could also configure a split tunnel based on the access route of traffic.

   1. While you are still in the GlobalProtect Agent configuration (NetworkGlobalProtectGatewaysGlobalProtect External Gateway), select AgentClient Settings.
   2. Select the DEFAULT configuration or Add a new one.
   3. Select Split TunnelDomain and Application.
   4. Add the Include Domain and, optionally, the Ports to use with the domain.

      This example uses internal-app.corp.com as the URL you use to host apps in your data center. You add this URL and the SAML authentication URL in the Exclude Domain.

   5. Click OK to save your changes.
   6. Commit and Push your changes.
5. Configure the PAC file to exclude the domains you entered for split tunnel.

   The following example shows a PAC file with the URL that hosts private apps (internal-app.corp.com) bypassing the internal proxy. The parameters in the following PAC file are all example values:

   • The portal hostname is splittunnel.gpcloudservice.com.
   • The mobile user gateways (PanoramaCloud ServicesStatusNetwork DetailsMobile Users—GlobalProtectGateways) are contained in the wildcard FQDN *examplegateways.gw.gpcloudservice.com.
   • The PAC File URL (PanoramaCloud ServicesConfigurationMobile Users—Explicit ProxyPAC File URL) is https://pacfileurl.pac.
   • internal-app.corp.com is hosting the private apps that are being protected by Mobile Users—GlobalProtect.
   • Okta is being used for SAML authentication.
   • The Explicit Proxy URL is example.proxy.prismaacess.com.

   For more information about what PAC files do and how to create and modify them, see PAC File Guidelines and Requirements.

   function FindProxyForURL(url, host) { 
         /* Bypass FTP */ 
       if (url.substring(0,4) == "ftp:") 
           return "DIRECT"; 
         /* Bypass the Prisma Access Portal Hostname */ 
       if (shExpMatch(host, "*.splittunnel.gpcloudservice.com")) 
           return "DIRECT"; 
     /* Bypass the Prisma Access Gateway */
       if (shExpMatch(host, "*examplegateways.gw.gpcloudservice.com")) 
           return "DIRECT"; 
     /* Bypass the Prisma Access PAC File URL */
       if (shExpMatch(host, "https://pacfileurl.pac"))
           return "DIRECT";  
         /* Bypass the URLs Being Sent to the GlobalProtect Portal */ 
       if (shExpMatch(host, "*.internal-app.corp.com")) 
           return "DIRECT"; 
           /* Bypass ACS */ 
       if (shExpMatch(host, "*.acs.prismaaccess.com")) 
           return "DIRECT"; 
       /* Forward to Prisma Access */ 
       return "PROXY example.proxy.prismaaccess.com:8080";
   }

Use Explicit Proxy with Third-Party VPNs

++++++++++++++++
function FindProxyForURL(url, host) {
   if (isPlainHostName(host) ||
                shExpMatch(host, "*.local") ||
                isInNet(dnsResolve(host), "10.0.0.0", "255.0.0.0") ||
                isInNet(dnsResolve(host), "127.0.0.0", "255.255.255.0"))
                return "DIRECT";
       /* Bypass SAML for AnyConnect Azure */
    if (shExpMatch(host, "login.microsoftonline.com"))
        return "DIRECT";
    if (shExpMatch(host, "login.windows.net"))
        return "DIRECT";
     if (shExpMatch(host, "login.microsoft.com"))
        return "DIRECT";
    /* Forward to Prisma Access */
    return "PROXY example.proxy.prismaaccess.com:8080";
}