End users who are remote (not inside the corporate network)
connect to one of the gateways in AWS or Azure. When you configure
the GlobalProtect portal client configuration, assign equal priority
to the gateways. With this configuration, the gateway to which users
connect depends on the SSL response time of each gateway measured
on the endpoint during the tunnel set-up time.
For example, a user in Australia would typically connect to the
AWS-Sydney Gateway. Once the user is connected to AWS-Sydney, GlobalProtect
client tunnels all traffic from the endpoint to the AWS-Sydney firewall
for inspection. GlobalProtect sends traffic to public internet sites
directly via the AWS-Sydney Gateway and tunnels traffic to corporate
resources through a site-to-site tunnel between the AWS-Sydney Gateway
and the Santa Clara Gateway, and then through an IPSec site-to-site
tunnel to the corporate headquarters. This architecture is designed
to reduce any latency the user may experience when accessing the
internet. If the AWS-Sydney Gateway (or any gateway closer to Sydney)
was unreachable, the GlobalProtect client would back-haul the internet
traffic to the firewall in the corporate headquarters and cause
Active directory servers reside inside the corporate network.
When remote end users authenticate, the GlobalProtect client sends
authentication requests through the site-to-site tunnel in AWS/Azure
to the Santa Clara Gateway. The gateway then forwards the request
through an IPSec site-to-site tunnel to the Active Directory Server
in corporate headquarters.
To reduce the time it takes for remote
user authentication and tunnel set up, consider replicating the
Active Directory Server and making it available in AWS.
End users inside the corporate network authenticate to the three
internal gateways immediately after they log in; The GlobalProtect
client sends the HIP report to these internal gateways. When users are
inside the office on the corporate network, they must meet the User-ID
and HIP requirements to access any resource at work.