End User Experience

End users who are remote (not inside the corporate network) connect to one of the gateways in AWS or Azure. When you configure the GlobalProtect portal client configuration, assign equal priority to the gateways. With this configuration, the gateway to which users connect depends on the SSL response time of each gateway measured on the endpoint during the tunnel set-up time.
For example, a user in Australia would typically connect to the AWS-Sydney Gateway. Once the user is connected to AWS-Sydney, GlobalProtect client tunnels all traffic from the endpoint to the AWS-Sydney firewall for inspection. GlobalProtect sends traffic to public internet sites directly via the AWS-Sydney Gateway and tunnels traffic to corporate resources through a site-to-site tunnel between the AWS-Sydney Gateway and the Santa Clara Gateway, and then through an IPSec site-to-site tunnel to the corporate headquarters. This architecture is designed to reduce any latency the user may experience when accessing the internet. If the AWS-Sydney Gateway (or any gateway closer to Sydney) was unreachable, the GlobalProtect client would back-haul the internet traffic to the firewall in the corporate headquarters and cause latency issues.
Active directory servers reside inside the corporate network. When remote end users authenticate, the GlobalProtect client sends authentication requests through the site-to-site tunnel in AWS/Azure to the Santa Clara Gateway. The gateway then forwards the request through an IPSec site-to-site tunnel to the Active Directory Server in corporate headquarters.
To reduce the time it takes for remote user authentication and tunnel set up, consider replicating the Active Directory Server and making it available in AWS.
End users inside the corporate network authenticate to the three internal gateways immediately after they log in; The GlobalProtect client sends the HIP report to these internal gateways. When users are inside the office on the corporate network, they must meet the User-ID and HIP requirements to access any resource at work.

Related Documentation