Prisma Access (SCM-managed) – Internal Gateway, Internal Host Detection & DNS behavior

[IlliasElHanbali]

Hi all,

I’m looking for clarification on Internal Gateway selection in a Strata Cloud Manager–managed Prisma Access deployment.

Context 

• Prisma Access fully managed by SCM

• Remote Network connected

• Internal Gateway enabled

• Internal Host Detection (IHD) enabled

• GlobalProtect set to Always-On

Issue:
GlobalProtect correctly detects the endpoint as internal (“You are on the internal corporate network”), but still selects an external gateway.
Logs show:

• Internal network detection succeeds

• PTR lookup succeeds technically

• Internal gateway count = 0 → fallback to external gateways

This suggests a DNS / IHD interpretation issue, not network detection.

Questions:

1. When IHD is enabled in Prisma Access (SCM), must endpoints use the Prisma Access DNS Proxy for Internal Gateway discovery (PTR any-igw.*.gw.gpcloudservice.com)?

2. If endpoints use a corporate/internal DNS, is it expected that IHD may succeed but Internal Gateway selection still fail?

3. Any other required configuration (GP app settings, auth profiles, User-ID/HIP) needed for Internal Gateway selection in Remote Networks?

Any insights or real-world experience appreciated. Thanks!