Prisma Access can secure mobile users through more than one traffic-steering model, and the right choice depends on what must be protected. GlobalProtect establishes an agent-based connection that can steer broad endpoint traffic to Prisma Access. Explicit Proxy is designed around proxy-aware traffic, commonly using PAC-based or related proxy steering for web access. Both can enforce cloud-delivered security, but they have different application coverage, endpoint requirements, identity paths, and troubleshooting patterns. Current Prisma Access also supports GlobalProtect Proxy Mode, which uses the GlobalProtect app to proxy traffic without creating a VPN\/IPsec tunnel, and Tunnel-and-Proxy Mode, which can send internet-bound traffic to Explicit Proxy while private-app traffic follows tunnel and split-tunnel logic. Those modes narrow the old assumption that GlobalProtect always means full tunnel steering, so designs should compare traffic coverage and operating model rather than product names alone.<\/p>\n
The current Security Service Edge Engineer<\/a> certification treats Prisma Access planning and post-deployment operation as job skills. A useful comparison therefore asks which traffic each model can see, what must be installed or configured on the endpoint, and how private applications and non-web protocols behave.<\/p>\n GlobalProtect is appropriate when the organization wants an agent on the endpoint and needs to protect traffic beyond browser-based HTTP and HTTPS. Tunnel mode can carry internet, SaaS, and private-application traffic through Prisma Access while also giving policy access to endpoint and user context. It fits managed laptops where administrators can control software, certificates, authentication, and client configuration.<\/p>\n The agent relationship is operationally significant. Client version, portal and gateway behavior, authentication, DNS, endpoint posture, split-tunnel rules, and local network conditions can all affect user experience. That complexity buys broad protocol coverage and consistent protection, but it also means troubleshooting must include the endpoint rather than only a cloud proxy.<\/p>\n Explicit Proxy is useful when web traffic can be directed through a proxy using a PAC file or compatible forwarding mechanism. It is particularly attractive for organizations migrating from an existing secure web gateway or where a proxy is required for compliance. The endpoint does not need a full network tunnel simply to secure supported browser and web application traffic.<\/p>\n The limitation is intentional: proxy steering is not the same as tunneling the entire IP stack. Applications that do not honor proxy settings, use unsupported protocols, or behave unusually with proxy authentication may require another access method. That is why a proxy design should begin with an application inventory, not with the assumption that all endpoint traffic is web traffic.<\/p>\n GlobalProtect is the stronger default when the requirement is \u201csecure this endpoint\u2019s broad traffic regardless of protocol.\u201d Explicit Proxy is a better fit when the requirement is \u201csecure supported proxy-aware web traffic without forcing all endpoint traffic through a tunnel.\u201d A hybrid environment may legitimately use both for different populations or in supported combined modes. In particular, Tunnel-and-Proxy Mode is a first-class combined design: PAC rules can steer internet traffic to the proxy while the tunnel carries private applications, giving one managed GlobalProtect endpoint two explicit forwarding behaviors.<\/p>\n SASE architecture<\/a> explains why cloud-delivered enforcement accepts multiple traffic-steering patterns. The design objective is not to standardize every user on one method; it is to preserve application function while meeting security, identity, and support requirements.<\/p>\n Managed corporate devices are natural candidates for GlobalProtect because administrators can install the app, distribute configuration, manage certificates, and collect device posture. Contractors, unmanaged endpoints, specialized systems, or browser-centric populations may be easier to support with proxy-based access when policy and licensing permit it.<\/p>\n Headless devices and branch scenarios require additional care. A PAC-based model can work well for certain systems that only need outbound web access, but it should not be mistaken for a general site tunnel. If the site needs broad application reachability, a remote-network connection or other site-based architecture is usually more appropriate than treating every branch system as an individual proxy client.<\/p>\n GlobalProtect mobile users can reach private resources through service connections or supported private-application architectures. Explicit Proxy can also support private-app use cases in defined Prisma Access designs, but the organization must confirm how the private application is published, how DNS resolves it, and whether the application\u2019s protocol is compatible with the chosen steering method.<\/p>\n The conceptual ZTNA model<\/a> is useful here because private access should be application- and identity-aware rather than an automatic extension of the entire corporate network. If an application requires broad non-web protocols, dynamic ports, or server-initiated behavior, validate the chosen Prisma Access private-app mechanism before standardizing the user access model.<\/p>\n Both models need reliable identity, but the evidence appears in different places. GlobalProtect can combine user authentication, endpoint state, gateway assignment, and tunnel information. Explicit Proxy depends on proxy authentication and user identification appropriate to that workflow. A policy failure may therefore originate in different identity components even when the security rule is identical.<\/p>\n Design support procedures around those differences. A help-desk script for a GlobalProtect user should collect client state, gateway, tunnel details, DNS, and authentication events. A script for Explicit Proxy should inspect PAC delivery or forwarding configuration, proxy reachability, authentication behavior, browser\/application proxy use, and whether the destination is eligible for the proxy path.<\/p>\n GlobalProtect can be configured so selected traffic bypasses the tunnel, and proxy deployments naturally only capture traffic that follows the proxy decision. In both cases, bypass is a security architecture decision. Document why traffic is excluded, what enforcement remains on the direct path, and how users are protected if the destination changes behavior.<\/p>\nGlobalProtect is a broad endpoint tunnel model<\/h2>\n
Explicit Proxy is optimized for proxy-aware web traffic<\/h2>\n
Compare coverage before comparing convenience<\/h2>\n
Endpoint control changes the answer<\/h2>\n
Private application access needs a deliberate path<\/h2>\n
Identity and authentication behave differently operationally<\/h2>\n
Split tunneling and bypass must be intentional<\/h2>\n