> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Prisma Access

> Chain Prisma Access Explicit Proxy to Forge for selected AI traffic.

Configure an upstream proxy profile and policy to forward selected traffic from
Prisma Access Explicit Proxy to Forge. Use this guide for Prisma Access managed
by Strata Cloud Manager or Panorama. For standalone firewalls with
GlobalProtect, see [Palo Alto Networks](/integrations/palo-alto-networks).

## Before you start

Confirm these requirements with your Prisma administrator:

* Prisma Access mobile-user licensing and Explicit Proxy configuration.
* A supported release. Palo Alto's proxy-chaining guide lists Prisma Access
  5.2.2 and PAN-OS dataplane 11.2.6 as requirements.
* Devices or virtual desktop sessions using Explicit Proxy. Being protected by
  Prisma through another access path is not sufficient.
* The users or groups, source criteria, and URL category to include in
  forwarding.
* Your assigned Forge proxy hostname, port, and public CA certificate.

GlobalProtect proxy or tunnel-and-proxy mode and Prisma Browser are among the
supported connection methods. Confirm the clients' access method before
configuring the rule. For pooled virtual desktops, combine user and source
criteria to select the intended protected population.

## Open upstream proxy configuration

Choose the path for your management platform:

| Platform | Configuration path |
| - | - |
| Strata Cloud Manager | **Configuration → NGFW and Prisma Access → Network Policies → Upstream Proxy Policy**, with configuration scope **Explicit Proxy** |
| Panorama | **Panorama → Cloud Services → Configuration → Explicit Proxy → Upstream Proxy Configuration** |

## Create the Forge profile

1. Open **Profiles** and add an upstream proxy profile named `Forge`.
2. Set the primary proxy to the assigned Forge FQDN and port. The hostname must
   resolve to a reachable IPv4 address.
3. Enable **X-Authenticated-User (XAU)** at the **Connect** layer. Enable XFF
   too if source-address evidence is required.
4. Enable **Connect Upstream Proxy over SSL Channel**.
5. Configure certificate trust for the supplied Forge endpoint CA using the
   procedure supported by your management version. Confirm endpoint validation
   with your Prisma administrator; do not disable certificate verification.
6. Save the profile.

Prisma authenticates the user and sends a base64-encoded username in XAU. This
is different from Netskope's unencoded XAU setting. The header is provider
identity evidence, not standalone authentication for a Forge user.

The supplied endpoint CA secures the Prisma-to-Forge connection. It is distinct
from the certificate trust needed for content inspection. Upload only the public
certificate material required to trust the endpoint. Do not upload your
organization's CA private key.

## Create the upstream proxy rule

1. Create a dedicated custom URL category containing the AI destinations to
   forward through Forge. Use the URL syntax supported by your Prisma/PAN-OS
   version.

2. Open **Rules** in upstream proxy configuration and add `Forge`.

3. Set the source user and source-address criteria to the users or groups and
   source networks to protect.

4. Set the destination URL category to the dedicated AI destination category.

5. Set **Action → Upstream Proxy** to the Forge profile.

6. Choose the fallback behavior with your network administrator.
   * **Failopen** lets matching traffic continue through Prisma when the
     upstream proxy is unreachable. Such traffic bypasses Forge.
   * **Failclose** resets or drops matching traffic when the upstream proxy is
     unreachable.

7. Review rule order and the complete source and destination scope.

Palo Alto requires the rule to be enabled to save it in this workflow. Saving
and pushing are separate steps. Prepare the rule with the administrator, then
coordinate the configuration push; do not assume it can be staged as a disabled
rule. Rules are evaluated in order, so check for earlier rules that shadow the
forwarding rule.

## Apply the configuration

Activating the rule redirects matching traffic and can interrupt that traffic if
the endpoint or its trust configuration is wrong.

1. In Strata Cloud Manager, save and **Push Config**. In Panorama, commit and
   push to **Explicit\_Proxy\_Device\_Group**.
2. Verify that the configuration push completes for the Explicit Proxy scope.

## Validate forwarding

1. From a device in the protected population, request a destination in the
   category.
2. Confirm the matching upstream proxy rule in Prisma logs.
3. Confirm the corresponding connection reaches the assigned Forge endpoint.
4. Verify that XAU is included on CONNECT and carries the expected
   base64-encoded username.
5. Request an unlisted destination and verify that it retains its existing path.
6. Verify that excluded users or devices do not match the rule.
7. Validate the configured fallback behavior during a scheduled maintenance
   window.

Maintain the upstream proxy profile, source scope, and destination category in
your Prisma management platform. Apply configuration changes through the same
push workflow.

## Roll back

Disable the dedicated upstream proxy rule and push the configuration. Verify
that affected devices return to their expected network path. Remove the profile
and category only after no active rule references them. Stopping Forge alone can
interrupt matching requests when the rule uses Failclose.

## Palo Alto references

* [Configure proxy chaining on Prisma Access Explicit Proxy](https://docs.paloaltonetworks.com/prisma-access/administration/prisma-access-mobile-users/mobile-users-explicit-proxy/configure-proxy-chaining-on-prisma-access-explicit-proxy)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.