topic Re: Force URL-Filter if GlobalProtect is disconnected in Next-Generation Firewall Discussions

Force URL-Filter if GlobalProtect is disconnected

GuenterPekar — Tue, 30 Jul 2024 12:42:27 GMT

Hi together!

Is there a possibility to force a client to use a (local/cloud) URL-Filter if the Global Protect Client is NOT connected to the gateway?

Enforce Global Protect connection / define 40 FQDN exceptions is not really a solution.

Maybe there is a PA product / license which cover this topic?

Best regards and thanks a lot in advance!

Re: Force URL-Filter if GlobalProtect is disconnected

TeemuH — Fri, 02 Aug 2024 18:48:37 GMT

Since the filtering is done on the firewall itself it is not possible to enforce URL-filtering when you are not connected to GlobalProtect. You would need to route your traffic through the NGFW or Prisma Access.

Re: Force URL-Filter if GlobalProtect is disconnected

Claw4609 — Fri, 02 Aug 2024 19:06:32 GMT

Hello,

Adding onto what @TeemuH provided. If you dont want Global Protect to be connected you would need a web proxy of some sort. Palo does provide a Prisma Access secure web gateway./ web proxy that you could look at purchasing if it fits for you. I would reach out to your sales team to learn more.

Re: Force URL-Filter if GlobalProtect is disconnected

GuenterPekar — Tue, 06 Aug 2024 05:07:56 GMT

Hi together,

Thanks a lot for your feedbacks!

In general I tried to bypass a "proxysolution" but it looks like we have to search in this direction..

Best regards and thanks a lot again!