Force URL-Filter if GlobalProtect is disconnected

[GuenterPekar]

Hi together!

Is there a possibility to force a client to use a (local/cloud) URL-Filter if the Global Protect Client is NOT connected to the gateway?

Enforce Global Protect connection / define 40 FQDN exceptions is not really a solution.

Maybe there is a PA product / license which cover this topic?

Best regards and thanks a lot in advance!

[TeemuH]

Since the filtering is done on the firewall itself it is not possible to enforce URL-filtering when you are not connected to GlobalProtect. You would need to route your traffic through the NGFW or Prisma Access.

[Claw4609]

Hello,

Adding onto what @TeemuH provided. If you dont want Global Protect to be connected you would need a web proxy of some sort. Palo does provide a Prisma Access secure web gateway./ web proxy that you could look at purchasing if it fits for you. I would reach out to your sales team to learn more.  

[GuenterPekar]

Hi together, 

Thanks a lot for your feedbacks!

In general I tried to bypass a "proxysolution" but it looks like we have to search in this direction..

Best regards and thanks a lot again!