In PAN-OS, find a GlobalProtect client's public IP address before
the VPN tunnel is established by filtering traffic logs and system
logs.
| Where Can I Use This? | What Do I Need? |
|---|
- NGFW (managed by Panorama)
|
- GlobalProtect Subscription License
|
Before a VPN tunnel is established, a GlobalProtect® client
connects to the portal or gateway using its public IP address.
The GP source zone in traffic logs only
captures post-tunnel connections using the client's assigned
private (tunnel) IP — it does not reflect the client's public IP
or pre-tunnel activity. To correlate a client's public IP address
with its geographic source region before login, filter traffic
logs using the portal or gateway IP as the destination, or use
the portal-prelogin event ID in system
logs.
