Remote Browser Isolation for NGFW Users
Extend Remote Browser Isolation (RBI) to branch and data center users by routing NGFW
internet traffic through Prisma® Access over an IPSec Remote Networks tunnel.
| Where Can I Use This? | What Do I Need? |
|---|
Remote Browser Isolation (RBI) protects branch and data center users whose internet traffic
routes through a PAN-OS Next Generation Firewall (NGFW). By establishing an IPSec Remote
Networks tunnel from the NGFW to Prisma Access, all internet-bound traffic is routed
through Prisma Access for URL filtering, threat prevention, and browser isolation —
without installing endpoint agent or reconfiguring existing network IP addresses.
Traffic Flow and Data Path
Traffic flows from branch and data center endpoints enters the NGFW trust interface. The
NGFW routes the web traffic through an IKEv2 IPSec tunnel (UDP 500/4500) to the Prisma Access Remote Networks Service Node. Prisma Access applies configured
security services, including URL filtering, threat prevention, and Advanced WildFire®
inspection. Traffic matching the RBI isolation policy is rendered
in a secure cloud browser. The endpoint receives only a graphical rendering of the page,
with no HTML, CSS, or JavaScript executing on the device. All other traffic egresses
directly to the internet.
To configure this integration, complete the following steps:
