Configure the GlobalProtect Portals and Gateways for IoT Devices
- Review the GlobalProtect for IoT Requirements.
- Configure your GlobalProtect gateways to support the GlobalProtect app for IoT.
- Install a GlobalProtect subscription for each gateway that supports the GlobalProtect app for IoT. If you use Prisma Access, a GlobalProtect subscription is not required.
- Customize a gateway configuration for your IoT devices:When you configure a gateway, you can specify client authentication settings that apply specifically to IoT. For example, you can configure Windows and macOS endpoints to use two-factor authentication and require IoT devices to use certificate-based authentication.You can also configure supported network and client settings—such as specific IP pools, access routes, and split tunneling—for IoT devices.
- Selectand then select orNetworkGlobalProtectGatewaysAdda gateway configuration.
- Add a Client Authentication configuration for IoT devices:
- SelectAuthenticationandAdda new Client Authentication configuration.
- Enter aNameto identify the Client Authentication configuration, setOStoIoT, specify theAuthentication Profileto use for authenticating users on this gateway. Choose a profile that enables client certificate authentication.
- To configure specific client settings that apply to only IoT endpoints, configure a new Client Settings configuration:
- SelectAgentandAdda new Client Settings configuration.
- Configure the Client Authentication settings as desired.
- SelectUser/User Groupand thenAddan OS, and selectIoT.
- Committhe configuration.
- Configure the portal to support the GlobalProtect app for IoT devices.To support IoT devices, you must configure one or more gateways to which the GlobalProtect app can connect and then configure the portal and app settings. The portal sends configuration information and information about the available gateways to the app. After receiving the configuration from the GlobalProtect portal, the app discovers the gateways listed in the client configuration and selects the best gateway. Use the following workflow to configure the GlobalProtect portal to support the GlobalProtect app for IoT devices.
- If you have not already done so, complete the prerequisite tasks for setting up a GlobalProtect portal.
- Define client settings for IoT devices to authenticate to the portal.
- Selectand then select a portal configuration.NetworkGlobalProtectPortals
- Configure Client Authentication settings that apply to IoT devices when users access the portal:
- SelectAuthenticationand thenAdda new Client Authentication configuration.
- Enter aNameto identify the Client Authentication configuration, setOStoIoT, specify the Authentication Profile to use for authenticating users on this portal. Choose a profile that enables client certificate authentication.
- Customize an agent configuration for IoT devices.Whether you modify an existing configuration or create a new one depends on your environment. For example, if you use OS-specific gateways or want to collect host information that is specific to IoT devices, consider creating a new agent configuration.For information about supported features, refer to the Palo Alto Networks Compatibility Matrix for a list of features supported by OS for IoT devices.
- Define a GlobalProtect Agent Configuration:
- SelectAgentand select an existing orAdda new portal agent configuration.
- Configure the Authentication settings for IoT devices.
- SelectUser/User Groupand then add anOSand selectIoT.
- Specify the external gateways to which users with this configuration can connect.
- (Optional) SelectAppand customize the applicable portal settings for the GlobalProtect app for IoT. The GlobalProtect app discards any settings that do not apply for IoT. For a list of supported features by operating system, refer to the Palo Alto Networks Compatibility Matrix for a list of features supported by OS for IoT devices.
- Committhe configuration.
- Enforce Policies on IoT devices ().ObjectsGlobalProtectHIP ObjectsYou can now create HIP objects using Host Info that is specific to IoT devices and use it for match conditions in any HIP profiles. You can then use a HIP profile as a match condition in a policy rule to enforce the corresponding security policy.
Recommended For You
Recommended videos not found.