Prisma Access Browser

[DickyAnggara]

We will now deploy the prism access browser. Can the user access the internal application directly through the prisma access browser via a service connection? Or does it still need to connect to Global protect Mobile users?

[Vickynet]

---

@DickyAnggara wrote:

We will now deploy the prism access browser. Can the user access the internal application directly through the prisma access browser via a service connection? Or does it still need to connect to Global protect Mobile users?

---

@DickyAnggara , When deploying the Prisma Access Browser, users can access internal applications through a service connection without a need for Global Protect Mobile Users but there is a need for Explicit Proxy for this to be accomplish. Access to your Internal applications could either via GP or Explicit Proxy. I hope that is helpful. 

[DickyAnggara]

Can we force gp users to only use the PAB browser? Can we set it through the policy mobile users - GP?

[Vickynet · Accepted solution]

---

@DickyAnggara wrote:

Can we force gp users to only use the PAB browser? Can we set it through the policy mobile users - GP?

---

@DickyAnggara , Yes, you can and there are several enforcement options available:

1. For managed devices, enforcement can be implemented via MDM/Cortex.
2. Header or user-agent checks (less preferred, but an option).
3. IDP proxy.
4. PABX

I hope you find this helpful. 

[DickyAnggara]

Thanks VIckynet.

Currently we build 1 service connection with 2 ipsec tunnels primary and secondary. However, for the secondary tunnel is not up, Phase 1 phase 2 has matched and there is no blocking.

Is the secondary ipsec tunnel behavior up if the ipsec tunnel is down? or must both be up first.