Considerations when using the SWG
While the explicit proxy SWG is an easy-to-deploy security enforcement solution, it does have some operational differences from MU-SPNs. Using the SWG will allow users and endpoints to connect from virtually anywhere via the TLS protocol, just like the MU-SPN. The connection uses TCP port 8080, where SAML authentication is used, or TCP port 8081, where Kerberos authentication is used. Consider that these ports need to be allowed from all locations that users are connecting from, and some networks may block these ports to prevent bypassing local security policies.
As you may have noticed in the previous paragraph, the SWG supports Kerberos and SAML authentication, whereas GlobalProtect can authenticate using many different protocols.
It is important to note that in contrast to its IPSec counterpart, GlobalProtect, the proxied method does not allow for network traffic other than HTTP/HTTPS and does not provide access to any other networks, resources...
