Home

Location

Documentation Home
Palo Alto Networks
Support
Live Community
Knowledge Base

Home
GlobalProtect
GlobalProtect Administrator's Guide
GlobalProtect Architecture
GlobalProtect Reference Architecture Features

Last Updated:

May 5, 2022

Current Version:

8.0 (EoL)

Version 10.1
Version 10.0
Version 9.1
Version 9.0 (EoL)
Version 8.1 (EoL)
Version 8.0 (EoL)
Version 7.1 (EoL)

End-of-Life (EoL)

Table of Contents

Search the Table of Contents

copyright

GlobalProtect Overview

About the GlobalProtect Components

What Client OS Versions are Supported with GlobalProtect?

About GlobalProtect Licenses

Get Started

Create Interfaces and Zones for GlobalProtect

Enable SSL Between GlobalProtect Components

About GlobalProtect Certificate Deployment

GlobalProtect Certificate Best Practices

Deploy Server Certificates to the GlobalProtect Components

Authentication

About GlobalProtect User Authentication

Supported GlobalProtect Authentication Methods

Local Authentication

External Authentication

Client Certificate Authentication

Two-Factor Authentication

Multi-Factor Authentication for Non-Browser-Based Applications

Single Sign-On

How Does the Agent or App Know What Credentials to Supply?

Cookie Authentication on the Portal or Gateway

Credential Forwarding to Some or All Gateways

How Does the Agent Know Which Certificate to Supply?

Set Up External Authentication

Set Up LDAP Authentication

Set Up SAML Authentication

Set Up Kerberos Authentication

Set Up RADIUS or TACACS+ Authentication

Set Up Client Certificate Authentication

Deploy Shared Client Certificates for Authentication

Deploy Machine Certificates for Authentication

Deploy User-Specific Client Certificates for Authentication

Set Up Two-Factor Authentication

Enable Two-Factor Authentication Using Certificate and Authentication Profiles

Enable Two-Factor Authentication Using One-Time Passwords (OTPs)

Enable Two-Factor Authentication Using Smart Cards

Set Up Authentication for strongSwan Ubuntu and CentOS Clients

Enable Authentication Using a Certificate Profile

Enable Authentication Using an Authentication Profile

Enable Authentication Using Two-Factor Authentication

Configure GlobalProtect to Facilitate Multi-Factor Authentication Notifications

Enable Delivery of GlobalProtect Client VSAs to a RADIUS Server

Enable Group Mapping

GlobalProtect Gateways

GlobalProtect Gateways Overview

GlobalProtect Gateway Concepts

Types of Gateways

Gateway Priority in a Multiple Gateway Configuration

GlobalProtect MIB Support

Prerequisite Tasks for Configuring the GlobalProtect Gateway

Configure a GlobalProtect Gateway

GlobalProtect Portals

GlobalProtect Portal Overview

Prerequisite Tasks for Configuring the GlobalProtect Portal

Set Up Access to the GlobalProtect Portal

Define the GlobalProtect Client Authentication Configurations

Define the GlobalProtect Agent Configurations

Customize the GlobalProtect Agent

Customize the GlobalProtect Portal Login, Welcome, and Help Pages

GlobalProtect Clients

Deploy the GlobalProtect Client Software

Deploy the GlobalProtect Agent Software

Host Agent Updates on the Portal

Host Agent Updates on a Web Server

Test the Agent Installation

Download and Install the GlobalProtect Mobile App

Download and Install the GlobalProtect App for Chrome OS

Install the GlobalProtect App from the Chrome Web Store

Deploy the GlobalProtect App Using the Chromebook Management Console

Test the GlobalProtect app for Chrome OS

Deploy Agent Settings Transparently

Customizable Agent Settings

Agent Display Options

User Behavior Options

Agent Behavior Options

Script Deployment Options

Deploy Agent Settings to Windows Clients

Deploy Agent Settings in the Windows Registry

Deploy Agent Settings from Msiexec

Deploy Scripts Using the Windows Registry

Windows OS Batch Script Examples

Deploy Scripts Using Msiexec

SSO Wrapping for Third-Party Credential Providers on Windows Clients

Enable SSO Wrapping for Third-Party Credentials with the Windows Registry

Enable SSO Wrapping for Third-Party Credentials with the Windows Installer

Deploy Agent Settings to Mac Clients

Deploy Agent Settings in the Mac Plist

Deploy Scripts Using the Mac Plist

Mac OS Script Examples

GlobalProtect Clientless VPN

Clientless VPN Overview

Supported Technologies

Configure Clientless VPN

Troubleshoot Clientless VPN

Mobile Endpoint Management

Mobile Endpoint Management Overview

Set Up a Mobile Endpoint Management System

Manage the GlobalProtect App Using AirWatch

Deploy the GlobalProtect Mobile App Using AirWatch

Configure the GlobalProtect App for iOS Using AirWatch

Configure a Device-Level VPN Configuration for iOS Devices Using AirWatch

Configure a Per-App VPN Configuration for iOS Devices Using AirWatch

Configure the GlobalProtect App for Android Using AirWatch

Configure a Device-Level VPN Configuration for Android Devices Using AirWatch

Configure a Per-App VPN Configuration for Android Devices Using AirWatch

Enable App Scan Integration with WildFire

Configure the GlobalProtect App for Windows 10 UWP Using AirWatch

Manage the GlobalProtect App Using a Third-Party MDM

Configure the GlobalProtect App for iOS

Example: GlobalProtect iOS App Device-Level VPN Configuration

Example: GlobalProtect iOS App App-Level VPN Configuration

Configure the GlobalProtect App for Android

Example: Set VPN Configuration

Example: Remove VPN Configuration

Host Information

About Host Information

What Data Does the GlobalProtect Agent Collect?

How Does the Gateway Use the Host Information to Enforce Policy?

How Do Users Know if Their Systems are Compliant?

How Do I Get Visibility into the State of the End Clients?

Configure HIP-Based Policy Enforcement

Collect Application and Process Data From Clients

Block Device Access

Configure Windows User-ID Agent to Collect Host Information

MDM Integration Overview

Information Collected

System Requirements

Configure GlobalProtect to Retrieve Host Information

Troubleshoot the MDM Integration Service

GlobalProtect Quick Configs

Remote Access VPN (Authentication Profile)

Remote Access VPN (Certificate Profile)

Remote Access VPN with Two-Factor Authentication

Always On VPN Configuration

Remote Access VPN with Pre-Logon

GlobalProtect Multiple Gateway Configuration

GlobalProtect for Internal HIP Checking and User-Based Access

Mixed Internal and External Gateway Configuration

GlobalProtect Architecture

GlobalProtect Reference Architecture Topology

GlobalProtect Portal

GlobalProtect Gateways

GlobalProtect Reference Architecture Features

End User Experience

Management and Logging

Monitoring and High Availability

GlobalProtect Reference Architecture Configurations

Gateway Configuration

Portal Configuration

Policy Configurations

GlobalProtect Cryptography

About GlobalProtect Cipher Selection

Cipher Exchange Between the GlobalProtect Agent and Gateway

GlobalProtect Cryptography References

Reference: GlobalProtect Agent Cryptographic Functions

TLS Cipher Suites Supported by GlobalProtect Agents

Reference: TLS Ciphers Supported by GlobalProtect Agents on Mac Endpoints

Reference: TLS Ciphers Supported by GlobalProtect Agents on Windows 7 Endpoints

Reference: TLS Ciphers Supported by GlobalProtect Agents on Android 6.0.1 Endpoints

Reference: TLS Ciphers Supported by GlobalProtect Agents on iOS 10.2.1 Endpoints

Reference: TLS Ciphers Supported by GlobalProtect Agents on Chromebooks

Ciphers Used to Set Up IPSec Tunnels

SSL APIs

copyright
GlobalProtect Overview
Get Started
- Create Interfaces and Zones for GlobalProtect
- Enable SSL Between GlobalProtect Components
Authentication
GlobalProtect Gateways
GlobalProtect Portals
GlobalProtect Clients
- Deploy the GlobalProtect Client Software
- Deploy Agent Settings Transparently
GlobalProtect Clientless VPN
Mobile Endpoint Management
Host Information
GlobalProtect Quick Configs
GlobalProtect Architecture
GlobalProtect Cryptography

Document:GlobalProtect Administrator's Guide

GlobalProtect Reference Architecture Features

Last Updated:

May 5, 2022

Current Version:

8.0 (EoL)

Version 10.1
Version 10.0
Version 9.1
Version 9.0 (EoL)
Version 8.1 (EoL)
Version 8.0 (EoL)
Version 7.1 (EoL)

End-of-Life (EoL)

GlobalProtect Reference Architecture Features

End User Experience

Management and Logging

Monitoring and High Availability

Recommended For You

Recommended Videos

Recommended videos not found.

© 2022 Palo Alto Networks, Inc. All rights reserved.