Prisma Access GlobalProtect Integration[Old]

1. Navigate to Configuration → NGFW and Prisma Access → Setup, then select the Mobile Users Container Configuration Scope
2. Enable Explicit Proxy (if not already enabled)
3. Click Explicit Proxy Setup
4. Click the Infrastructure Settings (gear icon)
5. Enable Agent Proxy



6. Click Save
7. Click the Prisma Access Locations (gear icon)
8. Select the regions where your GlobalProtect users are located
9. Click Save, then Back
10. Copy the Explicit Proxy URL
    (example: foo.proxy.prismaaccess.com:8080)
    You will send this to Lumia in the next step.



11. Push Config
    Make sure to include both GlobalProtect and Explicit Proxy

1. Send your Explicit Proxy URL to info@lumia.security
2. Lumia will respond (usually within the same business day) with your:
• Lumia Tenant Certificate
• Lumia Proxy FQDN
• Lumia GlobalProtect PAC URL

1. Navigate to Configuration → NGFW and Prisma Access → Objects → Certificate Management, then select the Prisma Access Configuration Scope
2. Click Import
• Certificate Name: Lumia-CA
• Upload the Lumia Certificate provided to you
3. Click Save
4. Select Lumia-CA from the list
• Enable Trusted Root CA
• Click Update

4.1 Create an Address Object for Lumia

1. Navigate to Configuration → NGFW and Prisma Access → Objects → Address → Addresses, then select the Prisma Access Configuration Scope
2. Click Add Address
• Name: LumiaProxy
• Type: FQDN: Domain Name)
• FQDN: The Lumia Proxy FQDN provided to you
3. Click Save

4.2 Create an HTTP Header Insertion Profile

1. Navigate to Configuration → NGFW and Prisma Access → Security Services → HTTP Header Insertion, then select the Prisma Access Configuration Scope
2. Click Add Profile
• Name: Lumia-AddHeader
3. Click Add Rule
• Name: Lumia-AddHeader
• Type: Dynamic Fields
• Domains: * (all domains)
• Remove the Authorization header
• Click the X-Authenticated-User
• Value: ($user)
• Enable Log
4. Click Save, then Save again to save the header insertion profile

4.3 Create a Security Profile Group

1. Navigate to Configuration → NGFW and Prisma Access → Security Services → Profile Group, then select the Prisma Access Configuration Scope
2. Click Add Profile Group
• Name: Lumia-SecurityProfileGroup
• HTTP Header Insertion Profile: Lumia-AddHeader
3. Click Save

4.4 Create a Security Policy Rule

1. Navigate to Configuration → NGFW and Prisma Access → Security Services → Profile Group, then select the Prisma Access Configuration Scope
2. Click Add Rule → Pre Rule / Security Rule
• Name: Lumia-SecurityPolicy
• Source Zones: trust
• Source Addresses: Any
• Destination Zones: Any
• Destination Addresses: Address → LumiaProxy
• Application: Any
• Action: Allow
• Profile Group: Lumia-SecurityProfileGroup
3. Click Save

5.1 Create a Decryption Profile

1. Navigate to Configuration → NGFW and Prisma Access → Security Services → Decryption, then select the Prisma Access Configuration Scope
2. Click Add Profile under Decryption Profiles
• Name: Lumia-DecryptionProfile
• Under SSL Forward Proxy, click on Advanced
• Enable Strip ALPN
3. Click Save

5.2 Create a Decryption Policy Rule

1. Click Add Rule under Decryption Policies
• Name: Lumia-DecryptionPolicy
• Under Destination, click on Add Addresses, then select: LumiaProxy



• Action: Decrypt
• Decryption Profile: Lumia-DecryptionProfile
2. Click Save

1. Navigate to Configuration → NGFW and Prisma Access → Setup, then select the GlobalProtect Configuration Scope
2. Open the GlobalProtect App tab

3. Edit the Default app settings
• Scroll to App Configuration and select > Show Advanced Options



• Open Proxy
• Agent Mode for Prisma Access: Tunnel and Proxy
• Forwarding Option: Proxy Auto-Configuration (PAC) File URL
• Proxy Auto-Configuration (PAC) File URL: The Lumia GlobalProtect PAC URL provided to you