Endpoint Traffic Policy Enforcement on Prisma Access

N.Nicolaides — Mon, 10 Aug 2026 09:10:43 GMT

Hello,

I am trying out the "Endpoint Traffic Policy Enforcement" feature on GP to enforce users who are actively trying to avoid connecting to VPN (even if this is set to connect automatically).

I have set this setting to "All traffic" on a small test group and it was working great. However, one of the users tried to connect to a Windows 11 VM remotely, and that had blocked everyone out of the machine. The VM is located on the internal network.

I cannot find anywhere in the Portal configuration where I can set an exception on a machine level; is there a way to allow inbound ICMP/RDP from machines on the internal network?

https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-portals/endpoint-traffic-policy-enforcement

topic Endpoint Traffic Policy Enforcement on Prisma Access in GlobalProtect Discussions

Endpoint Traffic Policy Enforcement on Prisma Access