Set Up Access to the GlobalProtect Portal

1. Before you begin configuring the portal make sure you have:

   • Created the interfaces (and zones) for the firewall where you plan to configure the portal.
   • Set up the portal server certificate, gateway server certificate, SSL/TLS service profiles, and, optionally, any client certificates to deploy to end users to enable SSL/TLS connections for the GlobalProtect™ services.
   • Defined the authentication profiles and certificate profiles that the portal can use to authenticate GlobalProtect users.
   • Configured a GlobalProtect Gateway and understand Gateway Priority in a Multiple Gateway Configuration.
2. Add the portal.

   1. To add a new portal, do one of the following:

      • On Strata Cloud Manager (Prisma Access), select ConfigurationNGFW and Prisma AccessConfiguration ScopePrisma AccessGlobalProtectSetupGlobalProtect AppApp Settings and add portal configurations.
      • On Strata Cloud Manager (NGFW), select ConfigurationNGFW and Prisma AccessDeviceGlobalProtectPortals and GatewaysPortals and then Add Portal.
      • On Panorama, select NetworkGlobalProtectPortals. Select an existing portal configuration that you want to modify or Add a new one to deploy to the test users/group.
   2. Enter a Name for the portal.

      The gateway name cannot contain spaces and must be unique for each virtual system.
   3. (Optional) Select the virtual system to which this portal belongs from the Location field.
3. Specify network settings to enable the GlobalProtect app to communicate with the portal.

   If you have not yet created a network interface for the portal, see Create Interfaces and Zones for GlobalProtect. If you have not yet created an SSL/TLS service profile for the portal, see Deploy Server Certificates to the GlobalProtect Components.

   Do not attach an interface management profile that allows HTTP, HTTPS, Telnet, or SSH on the interface where you have configured a GlobalProtect portal or gateway because this enables access to your management interface from the internet. Follow the Adminstrative Access Best Practices to ensure that you are securing administrative access to your firewalls in a way that will prevent successful attacks.

   1. Select General.
   2. In the Network Settings area, select an Interface.
   3. Specify the IP Address Type and IP address for the portal web service:

      • The IP address type can be IPv4 Only, IPv6 Only, or IPv4 and IPv6. Use IPv4 and IPv6 if your network supports dual stack configurations, where IPv4 and IPv6 run at the same time.
      • The IP address must be compatible with the IP address type. For example, 172.16.1.0 for IPv4 addresses or 21DA:D3:0::2F3b for IPv6 addresses. For dual stack configurations, enter both an IPv4 and IPv6 address.
   4. Select an SSL/TLS Service Profile.
4. Select General and configure Decryption log settings.

   You can log successful and unsuccessful TLS/SSL handshakes and you can forward Decryption logs to Log Collectors, other storage devices, and to specific administrators.

   • By default, the firewall logs only unsuccessful TLS handshakes. It is a best practice to log successful handshakes as well so that you gain visibility into as much decrypted traffic as available resources permit (but don’t decrypt private or sensitive traffic; follow decryption best practices and decrypt as much traffic as you can).
   • If you have not already done so, create a Log Forwarding profile to forward Decryption logs and specify it in the Gateway configuration.
   • If you log successful TLS handshakes in addition to unsuccessful TLS handshakes, configure a larger log storage space quota for the Decryption log.
   • On Panorama, select DeviceSetupManagementLogging and Reporting SettingsLog Storage.
   • On Strata Cloud Manager (NGFW), select ConfigurationNGFW and Prisma AccessDeviceGlobalProtectPortals and GatewaysPortalsAdd PortalAdvanced SettingsLog Settings.

   The default quota (allocation) is one percent of the device’s log storage capacity for Decryption logs and one percent for the general decryption summary. There is no default allocation for hourly, daily, or weekly decryption summaries. Configure Decryption Logging provides more information about how to allocate firewall log space to Decryption logs.
5. Select custom login and help pages or disable the login and help pages entirely. See Customize the GlobalProtect Portal Login, Welcome, and Help Pages for more details on creating a custom login page and help page.

   Use one of the platform to configure the custom login and help pages:

   • On Strata Cloud Manager (Prisma Access), select ConfigurationNGFW and Prisma AccessConfiguration ScopePrisma AccessGlobalProtectSetupGlobalProtect AppResponse Pages.
   • On Strata Cloud Manager (NGFW), select ConfigurationNGFW and Prisma AccessConfiguration ScopeAll FirewallsDeviceGlobalProtectPortals and GatewaysPortalsAdd Portal. On the Add Portal page, under the Advanced Settings, select Appearance.
   • On Panorama, select DeviceResponse Pages.

   1. Select General.
   2. In the Appearance area, configure any of the following settings:

      • To set the Portal Login Page for user access to the portal, select the factory-default login page, Import a custom login page, or Disable access to the login page.
      • To set the App Help Page to provide assistance to users with the GlobalProtect app, select the factory-default help page, Import a custom help page, or select None to remove the Help option from the Settings menu of the GlobalProtect status panel.
6. Specify how the portal authenticates users.

   • On Strata Cloud Manager (Prisma Access), select ConfigurationNGFW and Prisma AccessConfiguration ScopePrisma AccessGlobalProtectIdentity ServicesAuthenticationAuthentication ProfilesAdd Profile.
   • On Strata Cloud Manager (NGFW), select ConfigurationNGFW and Prisma AccessConfiguration ScopeAll FirewallsDeviceGlobalProtectProfilesGP Authentication ProfilesAdd Profile.

   1. On Panoram, select Authentication.
   2. Configure any of the following portal authentication settings:

      If you have not yet created a server certificate for the portal and issued gateway certificates, see Deploy Server Certificates to the GlobalProtect Components.

      • To secure communication between the portal and the GlobalProtect app, select the SSL/TLS Service Profile that you configured for the portal.
      • To authenticate users through a local user database or an external authentication service, such as LDAP, Kerberos, TACACS+, SAML, or RADIUS (including OTP), Define the GlobalProtect Client Authentication Configurations.
      • To authenticate users based on a client certificate or a smart card/CAC, select the corresponding Certificate Profile. You must pre-deploy the client certificate or Deploy User-Specific Client Certificates for Authentication using the Simple Certificate Enrollment Protocol (SCEP).
        • If you want to require users to authenticate to the portal using both user credentials AND a client certificate, both a Certificate Profile and Authentication Profile are required.
        • If you want to allow users to authenticate to the portal using either user credentials OR a client certificate, and you select an Authentication Profile for user authentication, the Certificate Profile is optional.
        • If you want to allow users to authenticate to the portal using either user credentials OR a client certificate, and you do not select an Authentication Profile for user authentication, the Certificate Profile is required.
        • If you do not configure any Authentication Profile that matches a specific OS, the Certificate Profile is required.
        If you allow users to authenticate to the portal using either user credentials OR a client certificate, select a Certificate Profile with the Username Field set to Subject or Subject Alt.
7. Define the data that the GlobalProtect app collects from connecting endpoints after users successfully authenticate to the portal.

   The GlobalProtect app sends this data to the portal to match against the selection criteria that you define for each portal agent configuration. Based on this criteria, the portal delivers a specific agent configuration to the GlobalProtect apps that connect.

   1. Select Portal Data Collection.
   2. Configure any of the following data collection settings:

      • If you want the GlobalProtect app to collect machine certificates from connecting endpoints, select the Certificate Profile that specifies the machines certificates that you want to collect.
      • If you want the GlobalProtect app to collect custom host information from connecting endpoints, define the following registry, plist, or process list data in the Custom Checks area:
        • To collect registry data from Windows endpoints, select Windows and then Add the Registry Key and corresponding Registry Value.
        • To collect plist data from macOS endpoints, select Mac and then Add the Plist key and corresponding Key value.

      If you are using Strata Cloud Manager (NGFW) to collect custom host information from endpoints, then:

      1. On Strata Cloud Manager (NGFW), select ConfigurationNGFW and Prisma AccessConfiguration ScopeAll FirewallsDeviceGlobalProtectAgent SettingsAdd Agent App Settings.
      2. On the Add Agent App Settings page, under HIP Data CollectionShow Advanced OptionsCustom Checks and then edit the Custom Checks.
      3. Click Add to add the Windows (Registry Key), Mac (Plist), or Linux (Process List).

      If you are using Strata Cloud Manager (Prisma Access) to collect custom host information from endpoints, then:

      1. On Strata Cloud Manager (Prisma Access), select ConfigurationNGFW and Prisma AccessConfiguration ScopePrisma AccessMobile Users ContainerGlobalProtectSetupGlobalProtect AppApp Settings <default>.
      2. On the Default page, select HIP Data CollectionShow Advanced OptionsCustom Checks and then edit the Custom Checks.
      3. Click Add to add the Windows (Registry Key), Mac (Plist), or Linux (Process List).
8. Save the portal configuration.

   1. Click OK to save the settings.
   2. Commit the changes.