Create Interfaces and Zones for GlobalProtect
You must configure the following interfaces and zones for your GlobalProtect infrastructure:
- GlobalProtect portal—Requires a Layer 3 or loopback interface for the GlobalProtect clients’ connection. If the portal and gateway are on the same firewall, they can use the same interface. The portal must be in a zone that is accessible from outside your network, for example: DMZ.
- GlobalProtect gateways—The interface and zone requirements for the gateway depend on whether the gateway you are configuring is external or internal, as follows:
- External gateways—Requires a Layer 3 or loopback interface and a logical tunnel interface for the client to establish a VPN tunnel. The Layer 3/loopback interface must be in an external zone, such as DMZ. A tunnel interface can be in the same zone as the interface connecting to your internal resources (for example trust). For added security and better visibility, you can create a separate zone, such as corp-vpn. If you create a separate zone for your tunnel interface, you must create security policies that enable traffic to flow between the VPN zone and the trust zone.
- Internal gateways—Requires a Layer 3 or loopback interface in your trust zone. You can also create a tunnel interface for access to your internal gateways, but this is not required.
For tips on how to use a loopback interface to provide access to GlobalProtect on different ports and addresses, refer to Can GlobalProtect Portal Page be Configured tobeAccessed on any Port?
For more information about portals and gateways, see About the GlobalProtect Components.
- Configure a Layer 3 interface for each portal
and/or gateway you plan to deploy.If the gateway and portal are on the same firewall, you can use a single interface for both.As a best practice use static IP addresses for the portal and gateway.Do not attach an interface management profile that allows HTTP, HTTPS, Telnet, or SSH on the interface where you have configured a GlobalProtect portal or gateway because this enables access to your management interface from the Internet. Follow the Best Practices for Securing Administrative Access to ensure that you are securing administrative access to your firewalls in a way that will prevent successful attacks.
- Select NetworkInterfacesEthernet or NetworkInterfacesLoopback and then select the interface you want to configure for GlobalProtect. In this example, we are configuring ethernet1/1 as the portal interface.
- (Ethernet only) Select Layer3 from the Interface Type drop-down.
- On the Config tab, select the
zone to which the portal or gateway interface belongs as follows:
- Place portals and external gateways in an untrust zone for access by hosts outside your network, such as l3-untrust.
- Place internal gateways in an internal zone, such as l3-trust.
- If you have not yet created the zone, select New Zone from the Security Zone drop-down. In the Zone dialog, define a Name for the new zone and then click OK.
- In the Virtual Router drop-down, select default.
- To assign an IP address to the interface, select the IPv4 tab, click Add in the IP section, and enter the IP address and network mask to assign to the interface, for example 184.108.40.206/24.
- To save the interface configuration, click OK.
- On the
firewall(s) hosting GlobalProtect gateway(s), configure the logical
tunnel interface that will terminate VPN tunnels established by
the GlobalProtect agents.IP addresses are not required on the tunnel interface unless you require dynamic routing. In addition, assigning an IP address to the tunnel interface can be useful for troubleshooting connectivity issues.Be sure to enable User-ID in the zone where the VPN tunnels terminate.
- Select NetworkInterfacesTunnel and click Add.
- In the Interface Name field, specify a numeric suffix, such as .2.
- On the Config tab, expand the Security
Zone drop-down to define the zone as follows:
- To use your trust zone as the termination point for the tunnel, select the zone from the drop-down.
- (Recommended) To create a separate zone for VPN tunnel termination, click New Zone. In the Zone dialog, define a Name for new zone (for example, corp-vpn), select the Enable User Identification check box, and then click OK.
- In the Virtual Router drop-down, select None.
- (Optional) If you want to assign an IP address to the tunnel interface, select the IPv4 tab, click Add in the IP section, and enter the IP address and network mask to assign to the interface, for example 10.31.32.1/32.
- To save the interface configuration, click OK.
- If you created a separate zone for tunnel termination
of VPN connections, create a security policy to enable traffic flow
between the VPN zone and your trust zone.For example, the following policy rule enables traffic between the corp-vpn zone and the l3-trust zone.
- Save the configuration.
Create Interfaces and Zones for the LSVPN
Create Interfaces and Zones for the LSVPN You must configure the following interfaces and zones for your LSVPN infrastructure: GlobalProtect portal —Requires a Layer 3 ...
Remote Access VPN (Authentication Profile)
Remote Access VPN (Authentication Profile) In the Figure: GlobalProtect VPN for Remote Access , the GlobalProtect portal and gateway are configured on ethernet1/2, so this ...
Mixed Internal and External Gateway Configuration
Mixed Internal and External Gateway Configuration In a GlobalProtect mixed internal and external gateway configuration, you configure separate gateways for VPN access and for access ...
GlobalProtect Multiple Gateway Configuration
GlobalProtect Multiple Gateway Configuration In GlobalProtect Multiple Gateway Topology , a second external gateway has been added to the configuration. Multiple gateways are supported in ...
Remote Access VPN (Certificate Profile)
Remote Access VPN (Certificate Profile) With certificate authentication, the client must present a valid client certificate that identifies the user to the GlobalProtect portal or ...
Site-to-Site VPN with Static and Dynamic Routing
Site-to-Site VPN with Static and Dynamic Routing In this example, one site uses static routes and the other site uses OSPF. When the routing protocol ...
Prepare the Satellite to Join the LSVPN
Prepare the Satellite to Join the LSVPN To participate in the LSVPN, the satellites require a minimal amount of configuration. Because the required configuration is ...
Basic LSVPN Configuration with Static Routing
Basic LSVPN Configuration with Static Routing This quick config shows the fastest way to get up and running with LSVPN. In this example, a single ...
Pre-logon then On-Demand Connect Method
Pre-logon then On-Demand Connect Method This feature requires Content Release version 590-3397 or later. You can now configure a new hybrid connect method called pre-logon ...