Proxy Auto Configuration (PAC) Deployment from GlobalProtect
Software Support: Starting with GlobalProtect™
app 6.1 with Content Release version 8587-7455 or later.
OS
Support: Windows 10, ARM64-Based Windows 10, macOS 11 and later
releases, and ARM-Based macOS 11 and later releases,
and Linux.
With Endpoint Proxy Configuration from the
GlobalProtect app, you can now push the URL for your proxy auto-configuration
(PAC) files to your endpoints via the GlobalProtect portal. When
the GlobalProtect app connects to the portal, the portal returns
the PAC URL to the endpoint. Then, upon establishing a tunnel with
the GlobalProtect gateway, the endpoint connects to the PAC URL
and fetches the PAC file, which in turn updates the proxy settings
on the endpoint. You can deploy different PAC URLs to different
endpoints based username or group membership. Once the endpoint has
the proxy settings, it uses the proxy server to access the internet.
After
you enable the feature, the new proxy configurations pushed through
the app replaces the proxy settings already available on the endpoint.When
the user disconnects the GlobalProtect app, the endpoint proxy configurations
get automatically disabled, reverting to the previous settings.
This
feature is available for all GlobalProtect users. When connecting
to an on-premises GlobalProtect portal and gateway, the workflow
looks as follows:
By default,
the endpoint proxy configuration through the GlobalProtect app is
disabled.
Use the following steps to configure the endpoint
proxy through the GlobalProtect app.
Ensure that the URL to Proxy Auto-Configuration
(PAC) file is available.
Select the portal configuration to which you are adding
the agent configuration, and then select the Agent tab.
On the Agent tab, select Config
Selection Criteria and then configure user, user group,
and/or operating system to which you want to push the endpoint proxy
configuration.
To ensure that this endpoint proxy configuration is
only pushed to agents running on supported operating systems, on
the Config Selection CriteriaUser/User Group tab, click Add in
the OS column and select the operating system.
Set the OS to Any to
deploy the configuration to all operating systems.
If you only want to push the endpoint proxy configuration
to specific users, in the User/User Group column Add the
specific users or user groups.
Click OK to save the agent
configuration.
Enable endpoint proxy configuration through the GlobalProtect
app.
Select NetworkGlobalProtectPortals.
Select the portal configuration to which you are adding
the agent configuration, and then select the Agent tab.
On the Agent tab, select App.
The App Configuration area displays the app
settings with default values that you can customize for each agent
configuration.
In the App Configurations area, specify the Proxy
Auto-Configuration (PAC) File URL that you want to push
to the endpoint to configure proxy settings. The maximum URL length
is 256 characters. The following Proxy Auto-Configuration (PAC)
File URL methods are supported:
Proxy Auto-Config (PAC) standard (for example,
http://pac.<hostname or IP>/proxy.pac).
Web Proxy Auto-Discovery Protocol (WPAD) standard (for example,
http://wpad.<hostname or IP>/wpad.dat).
Click OK and commit the changes.
View the logs to verify
the endpoint proxy configuration through the GlobalProtect app.
You can view endpoint proxy configuration- related log
details in the GlobalProtect logs and Cortex Data Lake (CDL) logs for
GlobalProtect App troubleshooting. You can view the following events
in the PanGPS log:
Receipt of proxy configurations.
Enable endpoint proxy configuration - success or failure.
Revert endpoint proxy configuration - success or failure.
Enable proxy enforcement -success or failure.
Disable proxy enforcement -success or failure.
View the PanGPS log to verify whether Proxy
Auto Configuration (PAC) URL is configured or not on the GlobalProtect
portal.
If the Proxy Auto Configuration (PAC) URL is configured,
the PanGPS log displays the following event:
Deploy Proxy auto proxy pac is <proxy auto-configuration (PAC) file URL>.
If the Proxy Auto Configuration (PAC) URL is not configured,
the PanGPS log displays the following event:
Deploy Proxy auto proxy pac is not enabled.
To view endpoint proxy configuration- related details
in the PanGPS log for Windows, macOS,
and linux:
Open the GlobalProtect app.
Report an issue from the GlobalProtect from the end user’s
endpoint.
(Optional) Allow the GlobalProtect app to run additional
diagnostic test and send the troubleshooting log bundle together
with the issue reports upon user request.
View the PanGPS log to verify the endpoint proxy configuration-
related events.
Verify the Proxy Auto Configuration (PAC) URL on the
proxy settings of your endpoints.
In the proxy settings of your endpoints, you can view the
Proxy Auto Configuration (PAC) URL that you configured in the App
Configurations area of the Agent tab
(NetworkGlobalProtectPortals).
To view proxy settings for Windows endpoints,
select SettingsNetwork
& InternetProxy.
To view proxy settings for macOS endpoints, select System PreferencesNetworkProxies.
To view proxy settings for Linux
endpoints, select SettingsNetworkNetwork Proxy.