Configure the Remote Browser Isolation Policy

1. Create a URL Access profile that specifies which categories to isolate.

   1. In Strata Cloud Manager, select ConfigurationNGFW and Prisma AccessSecurity ServicesURL Access ManagementURL Access Management Profiles and click Add Profile.
   2. Enter a name for the profile.
   3. Under Access Control, add the URL categories you want RBI to isolate.

      The recommended categories to isolate are:

      • high-risk
      • hacking
      • phishing
      • newly-registered-domain
      • news
      • sports
      • artificial-intelligence
   4. Select the isolation profile and set the action as isolate.
   5. Click Save.
2. Configure the RBI infrastructure settings for your tenant.

   1. Select ConfigurationNGFW and Prisma AccessSetupRemote Browser IsolationInfrastructure.
   2. Configure the infrastructure settings that control how the RBI service is provisioned and click Save.
3. Create a profile group that includes the URL Access profile.

   1. Select ConfigurationNGFW and Prisma AccessSecurity ServicesProfile Groups and click Add Profile Group.
   2. Enter a name for the profile group.
   3. Add your security profiles — Anti-Spyware, Vulnerability Protection, WildFire Analysis, and Antivirus.
   4. For URL Access Profile, select the profile you created in the step 1.
   5. Click Save.
4. Attach the profile group to the Internet Access Policy for Remote Networks.

   1. Select ConfigurationNGFW and Prisma AccessConfiguration ScopeRemote NetworksSecurity ServicesSecurity Policy.

   2. Edit the existing internet access rule for Remote Networks, or add a pre-rule, and attach the profile group you created in the previous step.
   3. Verify the rule matches traffic from the Remote Networks zone and click Save.
5. Configure SSL decryption.

   1. Create a Decryption profile.

      1. Select ConfigurationNGFW and Prisma AccessSecurity ServicesDecryptionDecryption Profiles and click + Add Profile.
      2. Configure best-practice SSL Forward Proxy settings, or use the recommended best-practice profile.

      3. Click Save.
   2. Create a Decryption Policy rule.

      1. Select ConfigurationNGFW and Prisma AccessSecurity ServicesDecryptionDecryption Policies and click Add Rule.

      2. Under Action and Advanced Inspection section, configure the rule to match traffic from the Remote Networks zone with action Decrypt and select Type as SSL Forward Proxy.
      3. Click Save.
6. Distribute the decryption certificate to endpoints in the branch.

   1. Export both forward-proxy CA certificates from Strata Cloud Manager.

      Select ConfigurationNGFW and Prisma AccessObjectsCertificate Management, select the following certificates, and export it as a .cer file.

      Certificate	Purpose
      Forward-Trust-CA	Re-signs certificates for sites with valid, trusted certificates
      Forward-Trust-CA-ECDSA	Re-signs certificates for sites using ECDSA certificates

   2. Install both certificates on all endpoints in the branch as trusted root certificates to prevent certificate warnings in the browser.

      To install on Windows endpoints, run PowerShell as administrator and enter the following commands:

      Import-Certificate -FilePath "Forward-Trust-CA.cer" -CertStoreLocation Cert:\LocalMachine\Root
      Import-Certificate -FilePath "Forward-Trust-CA-ECDSA.cer" -CertStoreLocation Cert:\LocalMachine\Root

      For production deployments, distribute both certificates via Group Policy: Computer ConfigurationWindows SettingsSecurity SettingsPublic Key PoliciesTrusted Root Certification Authorities.
7. Push the RBI configuration.

   1. Select ConfigurationNGFW and Prisma AccessConfiguration ScopeRemote NetworksPush Config.
   2. Wait for the push to complete before verifying the integration.