1. Home
    2. GlobalProtect
    3. GlobalProtect™ Administrator's Guide
    4. GlobalProtect Portals
    5. Set Up Access to the GlobalProtect Portal
    End-of-Life (EoL)

    Set Up Access to the GlobalProtect Portal

    After you have completed the Prerequisite Tasks for Configuring the GlobalProtect Portal, configure the GlobalProtect portal as follows:
    1. Add the portal.
      1. Select
        Network
        GlobalProtect
        Portals
        , and then
        Add
         a portal.
      2. Enter a
        Name
         for the portal.
        The gateway name cannot contain spaces and must be unique for each virtual system.
      3. (
        Optional
        ) Select the virtual system to which this portal belongs from the
        Location
         field.
    2. Specify network settings to enable the GlobalProtect app to communicate with the portal.
      If you have not yet created a network interface for the portal, see Create Interfaces and Zones for GlobalProtect. If you have not yet created an SSL/TLS service profile for the portal, see Deploy Server Certificates to the GlobalProtect Components.
      Do not attach an interface management profile that allows HTTP, HTTPS, Telnet, or SSH on the interface where you have configured a GlobalProtect portal or gateway because this enables access to your management interface from the internet. Follow the Best Practices for Securing Administrative Access to ensure that you are securing administrative access to your firewalls in a way that will prevent successful attacks.
      1. Select
        General
        .
      2. In the Network Settings area, select an
        Interface
        .
      3. Specify the
        IP Address Type
         and
        IP address
         for the portal web service:
        • The IP address type can be
          IPv4 Only
          ,
          IPv6 Only
          , or
          IPv4 and IPv6.
           Use
          IPv4 and IPv6
           if your network supports dual stack configurations, where IPv4 and IPv6 run at the same time.
        • The IP address must be compatible with the IP address type. For example,
          172.16.1.0
           for IPv4 addresses or
          21DA:D3:0::2F3b
           for IPv6 addresses. For dual stack configurations, enter both an IPv4 and IPv6 address.
      4. Select an
        SSL/TLS Service Profile
        .
    3. Select custom login and help pages or disable the login and help pages entirely. See Customize the GlobalProtect Portal Login, Welcome, and Help Pages for more details on creating a custom login page and help page.
      1. Select
        General
        .
      2. In the Appearance area, configure any of the following settings:
        • To set the
          Portal Login Page
           for user access to the portal, select the
          factory-default
           login page,
          Import
           a custom login page, or
          Disable
           access to the login page.
        • To set the
          App Help Page
           to provide assistance to users with the GlobalProtect app, select the
          factory-default
           help page,
          Import
           a custom help page, or select
          None
           to remove the
          Help
           option from the
          Settings
           menu of the GlobalProtect status panel.
    4. Specify how the portal authenticates users.
      1. Select
        Authentication
        .
      2. Configure any of the following portal authentication settings:
        If you have not yet created a server certificate for the portal and issued gateway certificates, see Deploy Server Certificates to the GlobalProtect Components.
        • To secure communication between the portal and the GlobalProtect app, select the
          SSL/TLS Service Profile
           that you configured for the portal.
        • To authenticate users through a local user database or an external authentication service, such as LDAP, Kerberos, TACACS+, SAML, or RADIUS (including OTP), Define the GlobalProtect Client Authentication Configurations
          .
        • To authenticate users based on a client certificate or a smart card/CAC, select the corresponding
          Certificate Profile
          . You must pre-deploy the client certificate or Deploy User-Specific Client Certificates for Authentication using the Simple Certificate Enrollment Protocol (SCEP).
          • If you want to require users to authenticate to the portal using both user credentials AND a client certificate, both a
            Certificate Profile
             and Authentication Profile are required.
          • If you want to allow users to authenticate to the portal using either user credentials OR a client certificate, and you select an Authentication Profile for user authentication, the
            Certificate Profile
             is optional.
          • If you want to allow users to authenticate to the portal using either user credentials OR a client certificate, and you do not select an Authentication Profile for user authentication, the
            Certificate Profile
             is required.
          • If you do not configure any Authentication Profile that matches a specific OS, the
            Certificate Profile
             is required.
          If you allow users to authenticate to the portal using either user credentials OR a client certificate, select a
          Certificate Profile
           with the
          Username Field
           set to
          Subject
           or
          Subject Alt
          .
    5. Define the data that the GlobalProtect app collects from connecting endpoints after users successfully authenticate to the portal.
      The GlobalProtect app sends this data to the portal to match against the selection criteria that you define for each portal agent configuration. Based on this criteria, the portal delivers a specific agent configuration to the GlobalProtect apps that connect.
      1. Select
        Portal Data Collection
        .
      2. Configure any of the following data collection settings:
        • If you want the GlobalProtect app to collect machine certificates from connecting endpoints, select the
          Certificate Profile
           that specifies the machines certificates that you want to collect.
        • If you want the GlobalProtect app to collect custom host information from connecting endpoints, define the following registry or plist data in the Custom Checks area:
          • To collect registry data from Windows endpoints, select
            Windows
             and then
            Add
             the
            Registry Key
             and corresponding
            Registry Value
            .
          • To collect plist data from Mac endpoints, select
            Mac
             and then
            Add
             the
            Plist
             key and corresponding
            Key
             value.
    6. Save the portal configuration.
      1. Click
        OK
         to save the settings.
      2. Commit
         the changes.

    Recommended For You

    Recommended Videos

    Recommended videos not found.

    © 2022 Palo Alto Networks, Inc. All rights reserved.