Explicit Proxy and GlobalProtect: Set It Up (Strata Cloud Manager)

1. Decide which applications you want to send to GlobalProtect and which applications you want to send to Explicit Proxy.

   The following steps direct private applications hosted at your data center to GlobalProtect and requests to internet and public SaaS applications to Explicit Proxy.
2. Edit GlobalProtect portal settings.

   Go to GlobalProtectApp SettingsApp ConfigurationAdvanced Settings

   1. In Proxy settings:

      • Check Detect Proxy for Each Connection
      • Clear Set Up Tunnel Over Proxy (Windows & Mac Only)
   2. In Authentication settings:

      • Check Use Default Browser for SAML Authentication

3. Create a split tunnel in GlobalProtect that allows you to direct the internal traffic to GlobalProtect.

   Go to GlobalProtectTunnel SettingsSplit Tunneling. Configure a split tunnel based on domain (FQDN), access routes, or applications.
4. Configure the PAC file to exclude the domains you specified for the GlobalProtect split tunnel.

   To download the PAC file so you can edit it, go to WorkflowsPrisma Access SetupExplicit ProxyInfrastructureInfrastructure SettingsProxy Auto Configuration..

   The following example shows a PAC file with the URL that hosts private apps (internal-app.corp.com) bypassing the internal proxy. The parameters in the following PAC file are all example values:

   • The portal hostname is splittunnel.gpcloudservice.com.
   • The mobile user gateways are contained in the wildcard FQDN *examplegateways.gw.gpcloudservice.com.
   • The PAC File URL is https://pacfileurl.pac.
   • internal-app.corp.com is hosting the private apps that are being protected by Mobile Users—GlobalProtect.
   • Okta is being used for SAML authentication.
   • The Explicit Proxy URL is example.proxy.prismaacess.com.

   function FindProxyForURL(url, host) {
   						/* Bypass FTP */
   						if (url.substring(0,4) == "ftp:")
   						return "DIRECT";
   						/* Bypass the Prisma Access Portal Hostname */
   						if (shExpMatch(host, "*.splittunnel.gpcloudservice.com"))
   						return "DIRECT";
   						/* Bypass the Prisma Access Gateway */
   						if (shExpMatch(host, "*examplegateways.gw.gpcloudservice.com"))
   						return "DIRECT";
   						/* Bypass the Prisma Access PAC File URL */
   						if (shExpMatch(host, "https://pacfileurl.pac"))
   						return "DIRECT";
   						/* Bypass the URLs Being Sent to the GlobalProtect Portal */
   						if (shExpMatch(host, "*.internal-app.corp.com"))
   						return "DIRECT";
   						/* Bypass ACS */
   						if (shExpMatch(host, "*.acs.prismaaccess.com"))
   						return "DIRECT";
   						/* Forward to Prisma Access */
   						return "PROXY example.proxy.prismaaccess.com:8080";
   						}