Set Up Access to the GlobalProtect Portal

Before you begin configuring the portal make sure you have:
Created the interfaces (and zones) for the firewall where you plan to configure the portal.
Set up the portal server certificate, gateway server certificate, SSL/TLS service profiles, and, optionally, any client certificates to deploy to end users to enable SSL/TLS connections for the GlobalProtect™ services.
Defined the authentication profiles and certificate profiles that the portal can use to authenticate GlobalProtect users.
Configured a GlobalProtect Gateway and understand Gateway Priority in a Multiple Gateway Configuration.
Add the portal.
Select
Network
GlobalProtect
Portals
, and then
Add
a portal.
Enter a
Name
for the portal.
The gateway name cannot contain spaces and must be unique for each virtual system.
(
Optional
) Select the virtual system to which this portal belongs from the
Location
field.
Specify network settings to enable the GlobalProtect app to communicate with the portal.
If you have not yet created a network interface for the portal, see Create Interfaces and Zones for GlobalProtect. If you have not yet created an SSL/TLS service profile for the portal, see Deploy Server Certificates to the GlobalProtect Components.
Do not attach an interface management profile that allows HTTP, HTTPS, Telnet, or SSH on the interface where you have configured a GlobalProtect portal or gateway because this enables access to your management interface from the internet. Follow the Adminstrative Access Best Practices to ensure that you are securing administrative access to your firewalls in a way that will prevent successful attacks.
Select
General
.
In the Network Settings area, select an
Interface
.
Specify the
IP Address Type
and
IP address
for the portal web service:
The IP address type can be
IPv4 Only
,
IPv6 Only
, or
IPv4 and IPv6.
Use
IPv4 and IPv6
if your network supports dual stack configurations, where IPv4 and IPv6 run at the same time.
The IP address must be compatible with the IP address type. For example,
172.16.1.0
for IPv4 addresses or
21DA:D3:0::2F3b
for IPv6 addresses. For dual stack configurations, enter both an IPv4 and IPv6 address.
Select an
SSL/TLS Service Profile
.
Select
General
and configure Decryption log settings.
You can log successful and unsuccessful TLS/SSL handshakes and you can forward Decryption logs to Log Collectors, other storage devices, and to specific administrators.
By default, the firewall logs only unsuccessful TLS handshakes. It is a best practice to log successful handshakes as well so that you gain visibility into as much decrypted traffic as available resources permit (but don’t decrypt private or sensitive traffic; follow decryption best practices and decrypt as much traffic as you can).
If you have not already done so, create a Log Forwarding profile to forward Decryption logs and specify it in the Gateway configuration.
If you log successful TLS handshakes in addition to unsuccessful TLS handshakes, configure a larger log storage space quota for the Decryption log (
Device
Setup
Management
Logging and Reporting Settings
Log Storage
). The default quota (allocation) is one percent of the device’s log storage capacity for Decryption logs and one percent for the general decryption summary. There is no default allocation for hourly, daily, or weekly decryption summaries. Configure Decryption Logging provides more information about how to allocate firewall log space to Decryption logs.
Select custom login and help pages or disable the login and help pages entirely. See Customize the GlobalProtect Portal Login, Welcome, and Help Pages for more details on creating a custom login page and help page.
Select
General
.
In the Appearance area, configure any of the following settings:
To set the
Portal Login Page
for user access to the portal, select the
factory-default
login page,
Import
a custom login page, or
Disable
access to the login page.
To set the
App Help Page
to provide assistance to users with the GlobalProtect app, select the
factory-default
help page,
Import
a custom help page, or select
None
to remove the
Help
option from the
Settings
menu of the GlobalProtect status panel.
Specify how the portal authenticates users.
Select
Authentication
.
Configure any of the following portal authentication settings:
If you have not yet created a server certificate for the portal and issued gateway certificates, see Deploy Server Certificates to the GlobalProtect Components.
To secure communication between the portal and the GlobalProtect app, select the
SSL/TLS Service Profile
that you configured for the portal.
To authenticate users through a local user database or an external authentication service, such as LDAP, Kerberos, TACACS+, SAML, or RADIUS (including OTP), Define the GlobalProtect Client Authentication Configurations
.
To authenticate users based on a client certificate or a smart card/CAC, select the corresponding
Certificate Profile
. You must pre-deploy the client certificate or Deploy User-Specific Client Certificates for Authentication using the Simple Certificate Enrollment Protocol (SCEP).
If you want to require users to authenticate to the portal using both user credentials AND a client certificate, both a
Certificate Profile
and Authentication Profile are required.
If you want to allow users to authenticate to the portal using either user credentials OR a client certificate, and you select an Authentication Profile for user authentication, the
Certificate Profile
is optional.
If you want to allow users to authenticate to the portal using either user credentials OR a client certificate, and you do not select an Authentication Profile for user authentication, the
Certificate Profile
is required.
If you do not configure any Authentication Profile that matches a specific OS, the
Certificate Profile
is required.
If you allow users to authenticate to the portal using either user credentials OR a client certificate, select a
Certificate Profile
with the
Username Field
set to
Subject
or
Subject Alt
.
Define the data that the GlobalProtect app collects from connecting endpoints after users successfully authenticate to the portal.
The GlobalProtect app sends this data to the portal to match against the selection criteria that you define for each portal agent configuration. Based on this criteria, the portal delivers a specific agent configuration to the GlobalProtect apps that connect.
Select
Portal Data Collection
.
Configure any of the following data collection settings:
If you want the GlobalProtect app to collect machine certificates from connecting endpoints, select the
Certificate Profile
that specifies the machines certificates that you want to collect.
If you want the GlobalProtect app to collect custom host information from connecting endpoints, define the following registry, plist, or process list data in the Custom Checks area:
To collect registry data from Windows endpoints, select
Windows
and then
Add
the
Registry Key
and corresponding
Registry Value
.
To collect plist data from macOS endpoints, select
Mac
and then
Add
the
Plist
key and corresponding
Key
value.
Save the portal configuration.
Click
OK
to save the settings.
Commit
the changes.