Set Up Access to the GlobalProtect Portal
- Add the portal.
- Select, and thenNetworkGlobalProtectPortalsAdda portal.
- Enter aNamefor the portal. The name cannot contain spaces.
- (Optional) Select the virtual system to which this portal belongs from theLocationfield.
- Specify network settings to enable the GlobalProtect app to communicate with the portal.If you have not yet created a network interface for the portal, see Create Interfaces and Zones for GlobalProtect. If you have not yet created an SSL/TLS service profile for the portal, see Deploy Server Certificates to the GlobalProtect Components.Do not attach an interface management profile that allows HTTP, HTTPS, Telnet, or SSH on the interface where you have configured a GlobalProtect portal or gateway because this enables access to your management interface from the internet. Follow the Best Practices for Securing Administrative Access to ensure that you are securing administrative access to your firewalls in a way that will prevent successful attacks.
- In the Network Settings area, select anInterface.
- Specify theIP Address TypeandIP addressfor the portal web service:
- IPv4 Only,IPv6 Only, orIPv4 and IPv6.UseIPv4 and IPv6if your network supports dual stack configurations, where IPv4 and IPv6 run at the same time.
- The IP address must be compatible with the IP address type. For example,172.16.1.0for IPv4 addresses or21DA:D3:0::2F3bfor IPv6 addresses. For dual stack configurations, enter both an IPv4 and IPv6 address.
- Select anSSL/TLS Service Profile.
- Select custom login and help pages or disable the login and help pages entirely. See Customize the GlobalProtect Portal Login, Welcome, and Help Pages for more details on creating a custom login page and help page.
- In the Appearance area, configure any of the following settings:
- Portal Login Pagefor user access to the portal, select thefactory-defaultlogin page,Importa custom login page, orDisableaccess to the login page.
- To set theApp Help Pageto provide assistance to users with the GlobalProtect app, select thefactory-defaulthelp page,Importa custom help page, or selectNoneto remove theHelpoption from theSettingsmenu of the GlobalProtect status panel.
- Specify how the portal authenticates users.
- Configure any of the following portal authentication settings:
- SSL/TLS Service Profilethat you configured for the portal.
- To authenticate users through a local user database or an external authentication service, such as LDAP, Kerberos, TACACS+, SAML, or RADIUS (including OTP), Define the GlobalProtect Client Authentication Configurations.
- To authenticate users based on a client certificate or a smart card/CAC, select the correspondingCertificate Profile. You must pre-deploy the client certificate or Deploy User-Specific Client Certificates for Authentication using the Simple Certificate Enrollment Protocol (SCEP).
If you allow users to authenticate to the portal using either user credentials OR a client certificate, select aCertificate Profilewith theUsername Fieldset toSubjectorSubject Alt.
- If you want to allow users to authenticate to the portal using either user credentials OR a client certificate, and you select an Authentication Profile for user authentication, theCertificate Profileis optional.
- If you want to allow users to authenticate to the portal using either user credentials OR a client certificate, and you do not select an Authentication Profile for user authentication, theCertificate Profileis required.
- Define the data that the GlobalProtect app collects from connecting endpoints after users successfully authenticate to the portal.The GlobalProtect app sends this data to the portal to match against the selection criteria that you define for each portal agent configuration. Based on this criteria, the portal delivers a specific agent configuration to the GlobalProtect apps that connect.
- SelectPortal Data Collection.
- Configure any of the following data collection settings:
- If you want the GlobalProtect app to collect machine certificates from connecting endpoints, select theCertificate Profilethat specifies the machines certificates that you want to collect.
- If you want the GlobalProtect app to collect custom host information from connecting endpoints, define the following registry or plist data in the Custom Checks area:
- To collect registry data from Windows endpoints, selectWindowsand thenAddtheRegistry Keyand correspondingRegistry Value.
- To collect plist data from Mac endpoints, selectMacand thenAddthePlistkey and correspondingKeyvalue.
- Save the portal configuration.
- ClickOKto save the settings.
- Committhe changes.
Define the GlobalProtect Client Authentication Configurations
Define the GlobalProtect Client Authentication Configurations Each GlobalProtect client authentication configuration specifies the settings that enable the user to authenticate with the GlobalProtect portal. You ...
Remote Access VPN with Pre-Logon
Remote Access VPN with Pre-Logon Pre-logon is a connect method that establishes a VPN tunnel before a user logs in. The purpose of pre-logon is ...
Mixed Authentication Method Support for Certificates or User Credentials
A single GlobalProtect portal or gateway can now support multiple combinations of authentication methods with user credentials and/or client certificates. ...
GlobalProtect Portals Portal Data Collection Tab
GlobalProtect Portals Portal Data Collection Tab Select Network GlobalProtect Portals Portal Data Collection to define the data that the GlobalProtect app collects from endpoints and ...
How Does the App Know Which Certificate to Supply?
How Does the App Know Which Certificate to Supply? When you configure GlobalProtect to use client certificates for authentication on macOS or Windows endpoints, GlobalProtect ...
Remote Access VPN with Two-Factor Authentication
Remote Access VPN with Two-Factor Authentication If you configure a GlobalProtect portal or gateway with an authentication profile and a certificate profile (which together can ...
Customize the GlobalProtect App
Customize the GlobalProtect App The portal agent configuration allows you to customize how your end users interact with the GlobalProtect apps installed on their endpoints. ...
Define the GlobalProtect Agent Configurations
Define the GlobalProtect Agent Configurations After a GlobalProtect user connects to the portal and is authenticated by the GlobalProtect portal, the portal sends the agent ...
Agent Configurations Based on the Endpoint’s Machine Certificate
Agent Configurations Based on the Endpoint’s Machine Certificate Use the following steps to push agent configurations to connecting endpoints based on the endpoint's machine certificate: ...