* For Proxy Mode on Agent, Firefox requires a manual policy rule pushed through Mobile Device Management that instructs it to
honor the system proxy
†
Explicit Proxy supports only HTTP traffic, not UDP. With SAML, Explicit Proxy
does not provide User-ID for client apps flows. For Agent proxy, you need to use a PAC
file to send client app authentication flows to the cloud proxy.
‡
No User-ID is available for auth bypass.
§
You can't apply DNS Security profiles to Explicit Proxy flows. Block domains instead.
App Support Considerations
Explicit Proxy does not support apps that need IP affinity. The app must support
traffic coming from multiple IPs for a given user session.
Explicit Proxy downgrades decrypted HTTP/2 Flows to HTTP/1.
Explicit Proxy does not fetch on-premises external dynamic lists.
Agentless SAML only:
Configure an SSL decryption policy to allow auth bypass by domain for
agentless PAC-based Explicit Proxy with SAML Auth
Decryption is required for
Prisma Access to read the authentication state cookie set up by
Prisma Access on the mobile user's browser. Failing to enforce
decryption enables the abuse of Explicit Proxy as an open proxy that
can attackers can use as a forwarding service for denial-of-service
attacks.
In traffic logs, Explicit Proxy will show undecrypted and
HTTP-CORS mobile user traffic logs as SWG-authenticated users.
Make a note of the following browser requirements and usage
guidelines:
If you use Explicit Proxy, don't disable cookies in
your browser; if you do, you can't browse any webpages.
If you're using Explicit Proxy with Microsoft Edge,
be sure to set
Settings
Privacy, Search, and Services
Tracking prevention
to
Basic
.
Connectivity Requirements
If mobile users are connecting from remote sites or headquarters or data center locations
using an Explicit Proxy, the mobile user endpoint must be able to reach and route to the
IdP, ACS FQDN, Explicit Proxy URL, and URL of the PAC file hosted by Prisma Access.
PAC File Requirements and Guidelines
—Follow the PAC File Guidelines when you set up the PAC file to use with Explicit
Proxy.
Proxy Chaining Guidelines
—If you use proxy chaining from a third-party proxy to
Explicit Proxy, specify the
Explicit Proxy URL
in the third-party
proxy to forward traffic to Explicit Proxy
On-Premises Support
—Explicit Proxy is a cloud-based proxy solution and not an
on-premises product. For an on-premises proxy solution, configure a PAN-OS web proxy.
