The PA-3020 in the co-location space (mentioned previously)
also doubles as a GlobalProtect gateway (the Santa Clara Gateway).
10 additional gateways are deployed in Amazon Web Services (AWS)
and the Microsoft Azure public cloud. The regions or POP locations
where these AWS and Azure gateways are deployed are based on the
distribution of employees across the globe.
Santa Clara Gateway—Employees and contractors can authenticate
to the Santa Clara Gateway (PA-3020 in the co-location space) using
2FA. This gateway requires users to provide their Active Directory
credentials and their OTP. Because this gateway protects sensitive
resources, it is configured as a manual-only gateway. As a result,
users do not connect to this gateway automatically and must manually
choose to connect to this gateway. For example, when users connect
to AWS-Norcal, which is not a manual-only gateway, some sensitive
internal resources are not accessible. The user must then manually
switch to and authenticate with the Santa Clara Gateway to access
In addition, the Santa Clara Gateway is
configured as a Large Scale VPN (LSVPN) tunnel termination point
for all satellite connections from gateways in AWS and Azure. The
Santa Clara Gateway is also configured to set up an Internet Protocol
Security (IPSec) tunnel to the IT firewall in corporate headquarters.
This is the tunnel that provides access to resources in the corporate headquarters.
Gateways in Amazon Web Services and Microsoft Azure—This
gateway requires 2FA: a client certificate and Active Directory
credentials. The GlobalProtect portal distributes the client certificate
that is required to authenticate with these gateways using the GlobalProtect SCEP
These gateways in the public cloud also act as GlobalProtect
satellites. They communicate with the GlobalProtect portal, download
the satellite configuration, and establish a site-to-site tunnel
with the Santa Clara Gateway. GlobalProtect satellites initially
authenticate using serial number, and subsequently authenticate
Gateways Inside Corporate Headquarters—Within the corporate
headquarters, three firewalls function as GlobalProtect gateways.
These are internal gateways and do not require endpoints to set
up a tunnel. Users authenticate to these gateways using their Active
Directory credentials. These internal gateways use GlobalProtect
to identify the User-ID and to collect Host Information Profile
(HIP) from the endpoints.
the end user experience as seamless as possible, you can configure
these internal gateways to authenticate users using certificates
provisioned by SCEP or using Kerberos service tickets.