Explicit Proxy: Is it only for RA VPN users ? Can I use for a certain Servers which doesnt have URL filter ?

[Ariq_Aziz]

Hi 

I have this question .

We use Prisma Access SASE and SD-WAN:

Background: One of our On Prem FW has an expired URL Filter license. We have some Test servers and they are not doing URL Filter any more. Is it possible that we use PAC file to redirect the Web Traffic to Prisma Access ? 

1. Is Explicit proxy in Prisma Access/Strata Cloud Manager for Mobile users only ? like the SASE VPN users ?

2. If we enable Explicit Proxy feature. will it cause any problem or impact on all existing users? Because we don't have any Pac file on the existing mobile users. At this moment feature is disabled. So, I would like to know if enabling feature will affect the existing users ??

note: We have no issue with the mobile users. Just want to make sure certain test servers gets url filtered. 

Thanks
AA

[Vickynet]

---

@Ariq_Aziz wrote:

Hi 

I have this question .

We use Prisma Access SASE and SD-WAN:

Background: One of our On Prem FW has an expired URL Filter license. We have some Test servers and they are not doing URL Filter any more. Is it possible that we use PAC file to redirect the Web Traffic to Prisma Access ? 

1. Is Explicit proxy in Prisma Access/Strata Cloud Manager for Mobile users only ? like the SASE VPN users ?

2. If we enable Explicit Proxy feature. will it cause any problem or impact on all existing users? Because we don't have any Pac file on the existing mobile users. At this moment feature is disabled. So, I would like to know if enabling feature will affect the existing users ??

note: We have no issue with the mobile users. Just want to make sure certain test servers gets url filtered. 

Thanks
AA

---

Hello @Ariq_Aziz,  I understand you are looking for clarification and more understanding how the Prisma SASE explicit proxy works and also determine if enabling this feature will cause some impact to your existing mobile Users GP deployment. 

We have explicit proxy feature available on some certain models of NGFW today (which is called Web proxy), and also for Prisma Access. So it all depends on the license you purchased. But in your own case, I can see you have the Prisma Access license for MU where you can easily enable the explicit proxy.

To answer you first question, yes, this particular explicit proxy that comes along with your Prisma Access is only meant for Mobile Users/SASE VPN Users, if you enable this feature, you can use it in parallel with your Global Protect Connection setup with no impact. The license counts that comes with your Prisma Access subscription will be shared between the Global Protect Setup and the Explicit Proxy setup.

Explicit Proxy uses a PAC file that instructs a web browser to forward traffic to the web proxy server instead of the destination server, and protects your web-based internet (HTTP and HTTPS) traffic.

To see a very detailed workflow on how Explicit Proxy works in Prisma Access, you can check this tech doc article: https://docs.paloaltonetworks.com/prisma/prisma-access/3-1/prisma-access-panorama-admin/prisma-acces...

I hope you find this helpful. 

Thank you. 

Vickynet