Proxy Auto Configuration (PAC) Deployment from GlobalProtect

Software Support: Starting with GlobalProtect™ app 6.1 with Content Release version 8587-7455 or later.

OS Support: Windows 10, ARM64-Based Windows 10, macOS 11 and later releases, and ARM-Based macOS 11 and later releases, and Linux.

With Endpoint Proxy Configuration from the GlobalProtect app, you can now push the URL for your proxy auto-configuration (PAC) files to your endpoints via the GlobalProtect portal. When the GlobalProtect app connects to the portal, the portal returns the PAC URL to the endpoint. Then, upon establishing a tunnel with the GlobalProtect gateway, the endpoint connects to the PAC URL and fetches the PAC file, which in turn updates the proxy settings on the endpoint. You can deploy different PAC URLs to different endpoints based username or group membership. Once the endpoint has the proxy settings, it uses the proxy server to access the internet.

After you enable the feature, the new proxy configurations pushed through the app replaces the proxy settings already available on the endpoint.When the user disconnects the GlobalProtect app, the endpoint proxy configurations get automatically disabled, reverting to the previous settings.

This feature is available for all GlobalProtect users. When connecting to an on-premises GlobalProtect portal and gateway, the workflow looks as follows:

By default, the endpoint proxy configuration through the GlobalProtect app is disabled.

Use the following steps to configure the endpoint proxy through the GlobalProtect app.

1. Ensure that the URL to Proxy Auto-Configuration (PAC) file is available.
2. (Optional) Configure the selection criteria such as user, user group and/or operating system on the portal for which you want to push the proxy settings through the GlobalProtect app.
   1. NetworkGlobalProtectPortals.
   2. Select the portal configuration to which you are adding the agent configuration, and then select the Agent tab.
   3. On the Agent tab, select Config Selection Criteria and then configure user, user group, and/or operating system to which you want to push the endpoint proxy configuration.
   4. To ensure that this endpoint proxy configuration is only pushed to agents running on supported operating systems, on the Config Selection CriteriaUser/User Group tab, click Add in the OS column and select the operating system. Set the OS to Any to deploy the configuration to all operating systems.
   5. If you only want to push the endpoint proxy configuration to specific users, in the User/User Group column Add the specific users or user groups.
   6. Click OK to save the agent configuration.
3. Enable endpoint proxy configuration through the GlobalProtect app.
   1. Select NetworkGlobalProtectPortals.
   2. Select the portal configuration to which you are adding the agent configuration, and then select the Agent tab.
   3. On the Agent tab, select App. The App Configuration area displays the app settings with default values that you can customize for each agent configuration.
   4. In the App Configurations area, specify the Proxy Auto-Configuration (PAC) File URL that you want to push to the endpoint to configure proxy settings. The maximum URL length is 256 characters. The following Proxy Auto-Configuration (PAC) File URL methods are supported:
      • Proxy Auto-Config (PAC) standard (for example, http://pac.<hostname or IP>/proxy.pac).
      • Web Proxy Auto-Discovery Protocol (WPAD) standard (for example, http://wpad.<hostname or IP>/wpad.dat).
   5. Click OK and commit the changes.

4. View the logs to verify the endpoint proxy configuration through the GlobalProtect app.
   You can view endpoint proxy configuration- related log details in the GlobalProtect logs and Cortex Data Lake (CDL) logs for GlobalProtect App troubleshooting. You can view the following events in the PanGPS log:

   • Receipt of proxy configurations.
   • Enable endpoint proxy configuration - success or failure.
   • Revert endpoint proxy configuration - success or failure.
   • Enable proxy enforcement -success or failure.
   • Disable proxy enforcement -success or failure.
   1. View the PanGPS log to verify whether Proxy Auto Configuration (PAC) URL is configured or not on the GlobalProtect portal.
      • If the Proxy Auto Configuration (PAC) URL is configured, the PanGPS log displays the following event:
        Deploy Proxy auto proxy pac is <proxy auto-configuration (PAC) file URL>.
      • If the Proxy Auto Configuration (PAC) URL is not configured, the PanGPS log displays the following event:
        Deploy Proxy auto proxy pac is not enabled.
   2. To view endpoint proxy configuration- related details in the PanGPS log for Windows, macOS, and linux:
      • Open the GlobalProtect app.
      • Report an issue from the GlobalProtect from the end user’s endpoint.
      • (Optional) Allow the GlobalProtect app to run additional diagnostic test and send the troubleshooting log bundle together with the issue reports upon user request.
      • View the PanGPS log to verify the endpoint proxy configuration- related events.
5. Verify the Proxy Auto Configuration (PAC) URL on the proxy settings of your endpoints.
   In the proxy settings of your endpoints, you can view the Proxy Auto Configuration (PAC) URL that you configured in the App Configurations area of the Agent tab (NetworkGlobalProtectPortals).
   1. To view proxy settings for Windows endpoints, select SettingsNetwork & InternetProxy.

   2. To view proxy settings for macOS endpoints, select System PreferencesNetworkProxies.

   3. To view proxy settings for Linux endpoints, select SettingsNetworkNetwork Proxy.