GlobalProtect
Configure a GlobalProtect Gateway
Table of Contents
Expand All
|
Collapse All
GlobalProtect Docs
-
- 10.1 & Later
- 9.1 (EoL)
-
- 6.3
- 6.2
- 6.1
- 6.0
- 5.1
-
- 6.1
- 6.0
- 5.1
-
- 6.3
- 6.2
- 6.1
- 6.0
- 5.1
Configure a GlobalProtect Gateway
Configure a GlobalProtect gateway to enforce security
policies and provide VPN access for your users.
Because the GlobalProtect portal configuration
that is delivered to the apps includes the list of gateways to which
the endpoint can connect, it is recommended that you configure the
gateways before configuring the portal.
GlobalProtect Gateways
are configured to provide two main functions:
- Enforce security policy for the GlobalProtect apps that connect to the gateways. You can also enable HIP collection on the gateway for enhanced security policy granularity.
- Provide virtual private network (VPN) access to the internal corporate network. VPN access is provided through an IPSec or SSL tunnel between the endpoint and the tunnel interface on the firewall hosting the gateway.
- Before you begin configuring the gateway make sure you have:
- Created the interfaces (and zones) for the firewall on which you plan to configure each gateway. For gateways that require tunnel connections, you must configure both the physical interface and the virtual tunnel interface.
- Set up the gateway server certificates and SSL/TLS service profile required for the GlobalProtect app to establish an SSL connection with the gateway.
- Defined the authentication profiles and/or certificate profiles that will be used to authenticate GlobalProtect users.
- Add a gateway.
- Adda new gateway ().NetworkGlobalProtectGateways
- Namethe gateway.The gateway name cannot contain spaces and must be unique for each virtual system. As a best practice, include the location or other descriptive information to help users and administrators identify the gateway.
- (Optional) Select the virtual systemLocationto which this gateway belongs.
- Specify the network information that enables endpoints to connect to the gateway.If it does not already exist, create the network interface for the gateway.Do not attach an interface management profile that allows HTTP, HTTPS, Telnet, or SSH to the interface where you configure; doing so enables access to your management interface from the internet. Follow Adminstrative Access Best Practices to ensure that you are securing administrative access to your firewalls in a way that will prevent successful attacks.
- Select theInterfacefor the endpoints to use when communicating with the gateway.
- Specify theIP Address TypeandIP Addressfor the gateway web service:
- Set theIP Address TypetoIPv4 Only,IPv6 Only, orIPv4 and IPv6.UseIPv4 and IPv6if your network supports dual stack configurations, where IPv4 and IPv6 run at the same time.
- The IP address must be compatible with the IP address type. For example,172.16.1.0for IPv4 addresses or21DA:D3:0::2F3bfor IPv6 addresses. For dual stack configurations, enter both an IPv4 and IPv6 address.
- Configure Decryption log settings.You can log successful and unsuccessful TLS/SSL handshakes and you can forward Decryption logs to Log Collectors, other storage devices, and to specific administrators.
- By default, the firewall logs only unsuccessful TLS handshakes. It is a best practice to log successful handshakes as well so that you gain visibility into as much decrypted traffic as available resources permit (but don’t decrypt private or sensitive traffic; follow decryption best practices and decrypt as much traffic as you can).
- If you have not already done so, create a Log Forwarding profile to forward Decryption logs and specify it in the Gateway configuration.
- If you log successful TLS handshakes in addition to unsuccessful TLS handshakes, configure a larger log storage space quota for the Decryption log (). The default quota (allocation) is one percent of the device’s log storage capacity for Decryption logs and one percent for the general decryption summary. There is no default allocation for hourly, daily, or weekly decryption summaries. Configure Decryption Logging provides more information about how to allocate firewall log space to Decryption logs.DeviceSetupManagementLogging and Reporting SettingsLog Storage
- Specify how the gateway authenticates users.If an SSL/TLS service profile for the gateway does not already exist, Deploy Server Certificates to the GlobalProtect Components.If authentication profiles or certificate profiles do not already exist, use the authentication setup task to configure these profiles for the gateway.Configure any of the following gatewayAuthenticationsettings ():NetworkGlobalProtectGateways<gateway-config>Authentication
- To secure communication between the gateway and the GlobalProtect app, select theSSL/TLS Service Profilefor the gateway.TheMax Versionof TLS in theSSL/TLS Service ProfileisTLSv1.2.TLSv1.3is currently not supported for the GlobalProtect app and Clientless VPN connections.To provide the strongest security, set theMin Versionof the SSL/TLS service profile toTLSv1.2.
- To authenticate users with a local user database or an external authentication service, such as LDAP, Kerberos, TACACS+, SAML, or RADIUS (including OTP),AddaClient Authenticationconfiguration with the following settings:
- Specify aNameto identify the client authentication configuration.
- Identify the type ofOS(operating system) to which this configuration applies. By default, the configuration applies toAnyoperating system.
- Select or add anAuthentication Profileto authenticate endpoints seeking access to the gateway.
- Enter a customUsername Labelfor gateway login (for example,Email Address (username@domain).
- Enter a customPassword Labelfor gateway login (for example,Passcodefor two-factor, token-based authentication).
- Enter anAuthentication Messageto help end-users understand which credentials to use during login. The message can be up to 256 characters in length (default isEnter login credentials).
- Select one of the following options to define whether users can authenticate to the gateway using credentials and/or client certificates:
- To require users to authenticate to the gateway using both user credentials AND a client certificate, set theAllow Authentication with User Credentials OR Client Certificateoption toNo (User Credentials AND Client Certificate Required)(default).
- To allow users to authenticate to the gateway using either user credentials OR a client certificate, set theAllow Authentication with User Credentials OR Client Certificateoption toYes (User Credentials OR Client Certificate Required).When you set this option toYes, the gateway first checks the endpoint for a client certificate. If the endpoint does not have a client certificate or you do not configure a certificate profile for your client authentication configuration, the endpoint user can then authenticate to the gateway using his or her user credentials.
- To authenticate users based on a client certificate or a smart card/CAC, select the correspondingCertificate Profile. You must pre-deploy the client certificate or Deploy User-Specific Client Certificates for Authentication using the Simple Certificate Enrollment Protocol (SCEP).
- If you want to require users to authenticate to the gateway using both their user credentials and a client certificate, you must specify both aCertificate Profileand an authentication profile
- If you want to allow users to authenticate to the gateway using either their user credentials or a client certificate and you specify anAuthentication Profilefor user authentication, then theCertificate Profileis optional.
- If you want to allow users to authenticate to the gateway using either their user credentials or a client certificate and you don’t select anAuthentication Profilefor user authentication, then theCertificate Profileis required.
- If you do not configure anyAuthentication Profilethat matches a specific OS, then theCertificate Profileis required.
If you allow users to authenticate to the gateway using either user credentials or a client certificate, do not select aCertificate Profilethat has theUsername Fieldconfigured asNone. - To use two-factor authentication, select both anAuthentication Profileand aCertificate Profile. This requires the user to authenticate successfully using both methods to gain access.(Chrome only) If you configure the gateway to use client certificates and LDAP for two-factor authentication, Chromebooks that run Chrome OS 47 or later versions encounter excessive prompts to select the client certificate. To prevent excessive prompts, configure a policy to specify the client certificate in the Google Admin console and then deploy that policy to your managed Chromebooks.
- Log in to the Google Admin console and select.Device managementChrome managementUser settings
- In the Client Certificates section, enter the following URL pattern toAutomatically Select Client Certificate for These Sites:{"pattern": "https://[*.]","filter":{}}
- ClickSave. The Google Admin console deploys the policy to all devices within a few minutes.
- To block GlobalProtect users from logging in from quarantined devicesto the GlobalProtect gateway, selectBlock login for quarantined devices.
- Enable tunneling and then configure the tunnel parameters.Tunnel parameters are required for an external gateway; they are optional for an internal gateway.To force the use of SSL-VPN tunnel mode, disable (clear) theEnable IPSecoption. By default, SSL-VPN is used only if the endpoint fails to establish an IPSec tunnel.Extended authentication (X-Auth) is supported only on IPSec tunnels. If youEnable X-Auth Support, GlobalProtect IPSec Crypto profiles are not used.GlobalProtect app is not able to connect to the GlobalProtect Gateway via IPSec tunnel if source NAT is configured on the same firewall for the GlobalProtect client's public IP address. In this case, the tunnel connection will fall back to SSL.For more information on supported cryptographic algorithms, refer to GlobalProtect App Cryptographic Functions.
- In the GlobalProtect Gateway Configuration dialog, select.AgentTunnel Settings
- EnableTunnel Modeto enable split tunneling.
- Select theTunnel Interfacethat you defined when you created the network interface for the gateway.
- (Optional) Specify the maximum number of users (Max User) that can access the gateway at the same time for authentication, HIP updates, and GlobalProtect app updates. The range of values is displayed when the field is empty and varies based on the platform.
- Enable IPSecand then select aGlobalProtect IPSec Cryptoprofile to secure the VPN tunnels between the GlobalProtect app and the gateway. Thedefaultprofile uses AES-128-CBC encryption and sha1 authentication.IPSec is not supported with Windows 10 UWP endpoints.You can also create aNew GlobalProtect IPSec Cryptoprofile (GlobalProtect IPSec Cryptodrop-down) and then configure the following settings:
- Specify aNameto identify the profile.
- AddtheAuthenticationandEncryptionalgorithms that VPN peers can use to negotiate the keys for securing data in the tunnel:
- Encryption—If you don’t know what the VPN peers support, you can add multiple encryption algorithms in top-to-bottom order of most-to-least secure, as follows:aes-256-gcm,aes-128-gcm,aes-128-cbc. The peers will negotiate the strongest algorithm to establish the tunnel.
- Authentication—Select the authentication algorithm (sha1) to provide data integrity and authenticity protection. Although the authentication algorithm is required for the profile, this setting is only to the AES-CBC cipher (aes-128-cbc). If you use an AES-GCM encryption algorithm (aes-256-gcmoraes-128-gcm), the setting is ignored because these ciphers provide native ESP integrity protection.
- ClickOKto save the profile.
- (Optional)Enable X-Auth Supportif any endpoint must connect to the gateway using a third-party VPN (for example, a VPNC client running on Linux). If you enable X-Auth, you must provide theGroupname andGroup Password(if the endpoint requires it). By default, the user is not required to re-authenticate if the key that establishes the IPSec tunnel expires. To require users to re-authenticate, disable the option toSkip Auth on IKE Rekey.Extended authentication (X-Auth) is not supported for Prisma Access deployments.ToEnable X-Auth Supportfor strongSwan endpoints, you must also disable the option toSkip Auth on IKE Rekeybecause these endpoints require re-authentication during IKE SA negotiation. In addition, you must add thecloseaction=restartsetting to theconn %defaultsection of the strongSwan IPSec configuration file. (See Set Up Authentication for strongSwan Ubuntu and CentOS Endpoints for more information on the StrongSwan IPSec configuration.)Although X-Auth access is supported on iOS and Android endpoints, it provides limited GlobalProtect functionality on these endpoints. Instead, use the GlobalProtect app for simplified access to all security features that GlobalProtect provides on iOS and Android endpoints. The GlobalProtect app for iOS is available in the Apple App Store. The GlobalProtect app for Android is available in Google Play.
- (Tunnel Mode Only) Specify selection criteria for your client settings configurations.The gateway uses the selection criteria to determine which configuration to deliver to the GlobalProtect apps that connect. If you have multiple configurations, you must make sure to order them correctly. As soon as the gateway finds a match (based on theSource User,OS, andSource Address), it delivers the associated configuration to the user. Therefore, more specific configurations must precede more general ones. See step 13 for instructions on ordering the list of configurations for client settings.You cannotEnable X-Auth Supportwhen you specify the selection criteria for your client settings configurations.
- In the GlobalProtect Gateway Configuration dialog, select.AgentClient Settings
- Select an existing client settings configuration orAdda new one. You can add up to 64 client configuration entries for a single gateway.
- Configure the followingConfig Selection Criteria:
- To deploy this configuration to specific users or user groups,AddtheSource User(or user group). To deploy this configuration only to users with apps in pre-logon mode, selectpre-logonfrom theSource Userdrop-down; to deploy this configuration to all users, selectany.To deploy the configuration to specific groups, you must first map users to groups as described when you Enable Group Mapping.
- To deploy this configuration based on the endpoint operating system,AddanOS(such as Android or Chrome). To deploy this configuration to all operating systems, selectAny.
- To deploy this configuration based on user location,Adda sourceRegionorIP address(IPv4 and IPv6). To deploy this configuration to all user locations, do not specify theRegionorIP Address.
- ClickOKto save your configuration selection criteria.
- (Tunnel Mode Only) Configure authentication override settings to enable the gateway to generate and accept secure, encrypted cookies for user authentication.This capability allows the user to provide login credentials only once during the specified period of time (for example, every 24 hours).By default, gateways authenticate users with an authentication profile and optional certificate profile. When authentication override is enabled, GlobalProtect caches the result of a successful login and uses the cookie to authenticate the user instead of prompting the user for credentials. For more information, see Cookie Authentication on the Portal or Gateway. If client certificates are required, the endpoint must also provide a valid certificate to gain access.If you must immediately block access to a device whose cookie has not expired (for example, if the device is lost or stolen), you can immediately Identification and Quarantine of Compromised Device by adding the device to a quarantine list.
- On the GlobalProtect Gateway Configuration dialog, select.AgentClient Settings
- Select an existing client settings configuration orAdda new one.
- Configure the followingAuthentication Overridesettings:
- Name—Identifies the configuration.
- Generate cookie for authentication override—Enables the gateway to generate encrypted, endpoint-specific cookies and issue authentication cookies to the endpoint.The authentication cookie includes the following fields:
- user—Username that is used to authenticate the user.
- domain—Domain name of the user.
- os—Application name that is used on the device.
- hostID—Unique ID that is assigned by GlobalProtect to identify the host.
- gen time—Date and time that the authentication cookie was generated.
- ip—IP address of the device that is used to successfully authenticate to GlobalProtect and to obtain the cookie.
- Accept cookie for authentication override—Enables the gateway to authenticate users with a valid, encrypted cookie. When the app presents a valid cookie, the gateway verifies that the cookie was encrypted by the portal or gateway, decrypts the cookie, and then authenticates the user.The GlobalProtect app must know the username of the connecting user in order to match and retrieve the associated authentication cookies from the user’s endpoint. After the app retrieves the cookies, it sends them to the portal or gateway for user authentication.(Windows only) If you set the Use Single Sign-On option toYes(SSO is enabled) in the portal agent configuration (), the GlobalProtect app uses the Windows username to retrieve the local authentication cookie for the user. If you set theNetworkGlobalProtectPortals<portal-config>Agent<agent-config>.AppUse Single Sign-Onoption toNo(SSO is disabled), you must enable the GlobalProtect app to Save User Credentials in order for the app to retrieve the authentication cookie for the user. Set theSave User Credentialsoption toYesto save both the username and password orSave Username Onlyto save only the username.
- Cookie Lifetime—Specifies the hours, days, or weeks for which the cookie is valid (default is 24 hours). The range for hours is 1 to 72; for weeks is 1 to 52; and for days is 1 to 365. After the cookie expires, the user must re-enter their login credentials and then the gateway subsequently encrypts a new cookie to send to the app. This value can be the same as or different from theCookie Lifetimethat you configure for the portal.
- Certificate to Encrypt/Decrypt Cookie—Selects the RSA certificate used to encrypt and decrypt the cookie. You must use the same certificate on the portal and gateway.As a best practice, configure the RSA certificate to use the strongest digest algorithm that your network supports.The portal and gateway use the RSA encrypt padding scheme PKCS#1 V1.5 to generate the cookie (using the public certificate key) and to decrypt the cookie (using the private certificate key).
- (Tunnel Mode only—Optional) Configure client level IP pools used to assign IPv4 or IPv6 addresses to the virtual network adapters on the endpoints that connect to the gateway.You must only either the client level () or the gateway level (NetworkGlobalProtectGateways<gateway-config>GlobalProtect Gateway ConfigurationAgentClient Settings<client-setting>ConfigsIP Pools).NetworkGlobalProtectGateways<gateway-config>GlobalProtect Gateway ConfigurationAgentClient IP PoolIP pools and split tunnel settings are not required for internal gateway configurations in non-tunnel mode because apps use the network settings assigned to the physical network adapter.Using address objects when configuring gateway IP address pools is not supported.
- On the GlobalProtect Gateway Configuration dialog, select.AgentClient Settings
- Select an existing client settings configuration orAdda new one.
- Configure any of the followingIP Poolssettings:
- To specify the authentication server IP address pool for endpoints that require static IP addresses, enable the option toRetrieve Framed-IP-Address attribute from authentication serverand thenAddthe subnet or IP address range to theAuthentication Server IP Pool. When the tunnel is established, an interface is created on the remote user’s computer with an address in the subnet or IP range that matches the Framed-IP attribute of the authentication server.The authentication server IP address pool must be large enough to support all concurrent connections. IP address assignment is static and retained even after the user disconnects.
- To specify theIP Poolused to assign IPv4 or IPv6 addresses to the endpoints that connect to the gateway,Addthe IP address subnet/range. You can add IPv4 or IPv6 subnets or ranges, or a combination of the two.To ensure proper routing back to the gateway, you must use a different range of IP addresses from those assigned to existing IP pools on the gateway (if applicable) and to the endpoints that are physically connected to your LAN. We recommend that you use a private IP addressing scheme.
- ClickOKto save the IP pool configuration.
- (Tunnel Mode only—Optional) Disable the split tunnel to ensure that all traffic(including local subnet traffic) goes through the VPN tunnel for inspection and policy enforcement.
- (Tunnel Mode only—Optional) Configure DNS settings for a client settings configuration.If you configure at least one DNS server or DNS suffix in the client settings configuration (), the gateway sends the configuration for both the DNS server and DNS suffix to the endpoint. This occurs even when you configure global (gateway level) DNS servers and DNS suffixes.NetworkGlobalProtectGateways<gateway-config>AgentClient Settings<client-settings-config>Network ServicesIf you do not configure any DNS servers or DNS suffixes in the client settings configuration, the gateway sends the global DNS servers and DNS suffixes to the endpoint, if configured ().NetworkGlobalProtectGateways<gateway-config>AgentNetwork Services
- In the GlobalProtect Gateway Configuration dialog, select.AgentClient Settings
- Select an existing client settings configuration orAdda new one.
- Configure any of the followingNetwork Servicessettings:
- Specify the IP address of theDNS Serverto which the GlobalProtect app with this client settings configuration sends DNS queries. You can add up to 10 DNS servers by separating each IP address with a comma.
- Specify theDNS Suffixthat the endpoint should use locally when encountering an unqualified hostname, which the endpoint cannot resolve.
- (Tunnel Mode Only) Arrange the gateway agent configurations so that the proper configuration is deployed to each GlobalProtect app.When an app connects, the gateway compares the source information in the packet against the agent configurations you defined (). As with security rule evaluation, the gateway looks for a match starting from the top of the list. When it finds a match, it delivers the corresponding configuration to the app.AgentClient Settings
- To move a gateway configuration up in the list of configurations, select the configuration andMove Up.
- To move a gateway configuration down in the list of configurations, select the configuration andMove Down.
- (Tunnel Mode Only—Optional) Configure the global IP address pools used to assign IPv4 or IPv6 addresses to the virtual network adapters on all endpoints that connect to the gateway.This option enables you to simplify the configuration by defining IP pools at the gateway level instead of defining IP pools for each client setting in the gateway configuration.You must configure IP pools only at either the gateway level () or the client level (NetworkGlobalProtectGateways<gateway-config>AgentClient IP Pool).NetworkGlobalProtectGateways<gateway-config>AgentClient Settings<client-setting>IP PoolsUsing address objects when configuring gateway IP address pools is not supported.
- In the GlobalProtect Gateway Configuration dialog, select.AgentClient IP Pool
- Addthe IP address subnet or range used to assign IPv4 or IPv6 addresses to all endpoints that connect to the gateway. You can add IPv4 or IPv6 subnets or ranges, or a combination of the two.To ensure proper routing back to the gateway, you must use a different range of IP addresses from those assigned to existing IP pools on the gateway (if applicable) and to the endpoints that are physically connected to your LAN. We recommend that you use a private IP addressing scheme.
- (Tunnel Mode Only) Specify the network configuration settings for the endpoint.Network settings are not required for internal gateway configurations in non-tunnel mode because the GlobalProtect app uses the network settings assigned to the physical network adapter.In the GlobalProtect Gateway Configuration dialog, selectand then configure any of the following network configuration settings:AgentNetwork Services
- If the firewall has an interface that is configured as a DHCP client, set theInheritance Sourceto that interface so the GlobalProtect app is assigned the same settings as the DHCP client. You can also enable the option toInherit DNS Suffixesfrom the inheritance source.
- Manually assign thePrimary DNSserver,Secondary DNSserver,Primary WINSserver,Secondary WINSserver, andDNS Suffix. You can enter multiple DNS suffixes (up to 100) by separating each suffix with a comma.TheDNS Suffixcannot contain any non-ASCII characters.
- (Optional) Modify the default timeout settings for endpoints.In the GlobalProtect Gateway Configuration dialog, selectand then configure the following in the Timeout Configuration area:AgentConnection Settings
- Modify the endpoint session timeout settings for Login Lifetime and Inactivity Logout.Starting from GlobalProtect 6.2 version, you can extend the login lifetime session of the GlobalProtect app before it expires so that users can avoid abrupt app session logout. You can configure the Extend GlobalProtect User Session feature through the Customize the GlobalProtect Appapp settings on the GlobalProtect portal.The app displays end-user notification on session expiry as per the notification settings on the gateway. These notifications inform the end users in advance when their app sessions are about to expire due to the expiry of the login lifetime. With the introduction of Extend GlobalProtect User Session feature, the expiry notification pop-up provides the option to extend the duration of user session so that users are not logged out of their session abruptly.
- Set and schedule the display of end-user notifications about GlobalProtect session logout for login lifetime, inactivity logout, and administrator initiated logout.
- (Optional) Modify the default expiration notifcation and create custom messages for login lifetime expiration, inactivity logout, and administrator logout that you want to display to users when their user sessions are about to expire.
- (Optional) Configure automatic restoration of SSL VPN tunnels.If the GlobalProtect connection is lost due to network instability or a change in the endpoint state, you can allow or prevent the GlobalProtect app from automatically reestablishing the VPN tunnel for specific gateways by configuring automatic restoration of SSL VPN tunnels.
- In the GlobalProtect Gateway Configuration dialog, select.AgentConnection Settings
- Configure one of the following options for Authentication Cookie Usage Restrictions:
- To prevent the GlobalProtect app from automatically reestablishing the VPN tunnel for this gateway,Disable Automatic Restoration of SSL VPN.
- To allow the GlobalProtect app to automatically reestablish the VPN tunnel for this gateway, disable (clear) the option toDisable Automatic Restoration of SSL VPN(default).
- (Optional) Configure source IP address enforcement for authentication cookies.You can configure the GlobalProtect portal or gateway to accept cookies from endpoints only when the IP address of the endpoint matches the original source IP addresses for which the cookie was issued or when the IP address of the endpoint matches a specific network IP address range. You can define the network IP address range using a CIDR subnet mask, such as /24 or /32. For example, if an authentication cookie was originally issued to an endpoint with a public source IP address of 201.109.11.10, and the subnet mask of the network IP address range is set to /24, the authentication cookie is subsequently valid on endpoints with public source IP addresses within the 201.109.11.0/24 network IP address range.
- In the GlobalProtect Gateway Configuration dialog, select.AgentConnection Settings
- In the Authentication Cookie Usage Restrictions section,Restrict Authentication Cookie Usage (for Automatic Restoration of VPN tunnel or Authentication Override)and then configure one of the following conditions:
- If you selectThe original Source IP for which the authentication cookie was issued, the authentication cookie is valid only if the public source IP address of the endpoint that is attempting to use the cookie is the same public source IP address of the endpoint to which the cookie was originally issued.
- If you selectThe original Source IP network range, the authentication cookie is valid only if the public source IP address of the endpoint attempting to use the cookie is within the designated network IP address range. Enter aSource IPv4 NetmaskorSource IPv6 Netmaskto define the subnet mask of the network IP address range for which the authentication cookie is valid (for example,32or128).
- (Tunnel Mode Only) Exclude HTTP/HTTPS video streaming traffic from the VPN tunnel.
- (Optional) Define the notification messages that end users see when a security rule with a host information profile (HIP) is enforced.This step applies only if you created host information profiles and added them to your security policies. See Host Information for details on configuring the HIP feature and information about creating HIP notification messages.
- On the GlobalProtect Gateway Configuration dialog, select.AgentHIP Notification
- Select an existing HIP notification configuration orAdda new one.
- Configure the following settings:
- Select theHost Informationobject or profile to which this message applies.
- Depending on whether you want to display the message when the corresponding HIP profile is matched in policy or when the profile is not matched, selectMatch MessageorNot Match Messageand thenEnablenotifications. You can create messages for both a match and a non-match instance based on the objects on which you are matching and what your objectives are for the policy. For theMatch Message, you can also enable the option toInclude Mobile App Listto indicate what applications can trigger the HIP match.
- Select whether you want to display the message as aSystem Tray Balloonor as aPop Up Message.
- Enter and format the text of your message (Template) and then clickOK.
- Repeat these steps for each message you want to define.
- Save the gateway configuration.
- ClickOKto save the settings.
- Committhe changes.
- (Optional) To configure the GlobalProtect app to display a label that identifies the location of this gateway when end users are connected, specify the physical location of the firewall on which you configured this gateway.When end users experience unusual behavior, such as poor network performance, they can provide this location information to their support or Help Desk professionals to assist with troubleshooting. They can also use this location information to determine their proximity to the gateway. Based on their proximity, they can evaluate whether they need to switch to a closer gateway.If you do not specify a gateway location, the GlobalProtect app displays an empty location field.
- In the CLI—Use the following CLI command to specify the physical location of the firewall on which you configured the gateway:<username@hostname>set deviceconfig setting global-protect location<location>
- In the XML API—Use the following XML API to specify the physical location of the firewall on which you configured the gateway:
- devices—name of the firewall on which you configured the gateway
- location—location of the firewall on which you configured the gateway
curl -k -F file=@filename.txt-g 'https://<firewall>/api/?key=<apikey>&type=config&action=set&xpath=/config/devices/entry[@name='<device-name>']/deviceconfig/setting/global-protect&element=<location>location-string</location>'