Panorama

Contact your Palo Alto Networks account representative to activate this functionality.
When configuring multiple GlobalProtect portals with Traffic Steering, do not configure
Accept Default Routes over Service Connections
(
Panorama
Cloud Services
Configuration
Traffic Steering
Settings
Accept Default Route over Service Connection
); if you do, mobile users cannot connect to the secondary portal.
Configure a mobile user and the authentication method for it.
Select
Cloud Services
Configuration
Mobile Users—GlobalProtect
Settings
Advanced
.
Enable Multiple Portal for Multiple Authentication Methods
.

The new portal appears for the 8443 port for the same tenant. This portal inherits the configuration settings from the original port, which is port 443.

Edit the portal configurations to update the authentication settings.
Click the portal hyperlink or select
Panorama
Templates
Network
GlobalProtect
Portals
and click the portal hyperlink.
In the
Authentication
section,
Add
a
Client Authentication
with a different
Authentication Profile
.
You can edit only the
Client Authentication
and
Certificate Profile
authentication settings.
If you use certificate-based authentication in both portals, ensure that the gateway doesn't have certificate-based authentication.
This feature enables the authentication override settings to generate cookie for both portals in the GlobalProtect app settings.

This feature enables the authentication override settings to generate and accept cookie for both portals in the tunnel settings.

Commit all your changes to Panorama and push the configuration changes to
Prisma Access
.
Click
Commit
Commit and Push
.
Edit Selections
and, in the
Prisma Access
tab, make sure that
Mobile Users
is selected in the
Push Scope
, then click
OK
.

Click
Commit and Push
.
Add the portals manually or using endpoint management software in the GlobalProtect app.
Verify if you can connect to both portals with different authentication profiles for the gateway.
Log in to your Windows machine.
Connect to the portals in your GlobalProtect app.
When you change the connection between portals of different authentication methods, authenticate the user login.

If the authentication cookie expires when you connect to the 8443 portal and switch to the manual gateway, GlobalProtect connects to the
Best Available Gateway
.
If your GlobalProtect app uses cached portal configurations, fallback to portal does not work.
View logs for both portals in
Monitor
Logs
GlobalProtect
to see the portal and authentication information.