GlobalProtect
GlobalProtect for Internal HIP Checking and User-Based Access
Table of Contents
Expand All
|
Collapse All
GlobalProtect Docs
-
9.1 (EoL)
- 10.1 & Later
- 9.1 (EoL)
-
-
-
- Deploy App Settings in the Windows Registry
- Deploy App Settings from Msiexec
- Deploy Scripts Using the Windows Registry
- Deploy Scripts Using Msiexec
- SSO Wrapping for Third-Party Credential Providers on Windows Endpoints
- Enable SSO Wrapping for Third-Party Credentials with the Windows Registry
- Enable SSO Wrapping for Third-Party Credentials with the Windows Installer
-
- Mobile Device Management Overview
- Set Up the MDM Integration With GlobalProtect
- Qualified MDM Vendors
-
- Remote Access VPN (Authentication Profile)
- Remote Access VPN (Certificate Profile)
- Remote Access VPN with Two-Factor Authentication
- Always On VPN Configuration
- Remote Access VPN with Pre-Logon
- GlobalProtect Multiple Gateway Configuration
- GlobalProtect for Internal HIP Checking and User-Based Access
- Mixed Internal and External Gateway Configuration
- Captive Portal and Enforce GlobalProtect for Network Access
-
-
- End User Experience
- Management and Logging in Panorama
-
- View a Graphical Display of GlobalProtect User Activity in PAN-OS
- View All GlobalProtect Logs on a Dedicated Page in PAN-OS
- Event Descriptions for the GlobalProtect Logs in PAN-OS
- Filter GlobalProtect Logs for Gateway Latency in PAN-OS
- Restrict Access to GlobalProtect Logs in PAN-OS
- Forward GlobalProtect Logs to an External Service in PAN-OS
- Configure Custom Reports for GlobalProtect in PAN-OS
- Monitoring and High Availability
-
- About GlobalProtect Cipher Selection
- Cipher Exchange Between the GlobalProtect App and Gateway
-
- Reference: GlobalProtect App Cryptographic Functions
-
- Reference: TLS Ciphers Supported by GlobalProtect Apps on macOS Endpoints
- Reference: TLS Ciphers Supported by GlobalProtect Apps on Windows 10 Endpoints
- Reference: TLS Ciphers Supported by GlobalProtect Apps on Windows 7 Endpoints
- Reference: TLS Ciphers Supported by GlobalProtect Apps on Android 6.0.1 Endpoints
- Reference: TLS Ciphers Supported by GlobalProtect Apps on iOS 10.2.1 Endpoints
- Reference: TLS Ciphers Supported by GlobalProtect Apps on Chromebooks
- Ciphers Used to Set Up IPsec Tunnels
- SSL APIs
-
6.3
- 6.3
- 6.2
- 6.1
- 6.0
- 5.1
-
- Download and Install the GlobalProtect App for Windows
- Use Connect Before Logon
- Use Single Sign-On for Smart Card Authentication
- Use the GlobalProtect App for Windows
- Report an Issue From the GlobalProtect App for Windows
- Disconnect the GlobalProtect App for Windows
- Uninstall the GlobalProtect App for Windows
- Fix a Microsoft Installer Conflict
-
- Download and Install the GlobalProtect App for macOS
- Use the GlobalProtect App for macOS
- Report an Issue From the GlobalProtect App for macOS
- Disconnect the GlobalProtect App for macOS
- Uninstall the GlobalProtect App for macOS
- Remove the GlobalProtect Enforcer Kernel Extension
- Enable the GlobalProtect App for macOS to Use Client Certificates for Authentication
-
6.1
- 6.1
- 6.0
- 5.1
-
6.3
- 6.3
- 6.2
- 6.1
- 6.0
- 5.1
End-of-Life (EoL)
GlobalProtect for Internal HIP Checking and User-Based Access
When used in conjunction with User-ID and/or
HIP checks, an internal gateway provides a secure, accurate method
of identifying and controlling traffic by user and/or device state,
replacing other network access control (NAC) services. Internal
gateways are useful in sensitive environments that require authenticated
access to critical resources.
In a configuration with only
internal gateways, all endpoints must be configured with User-Logon
(Always On); On-Demand mode is not supported. It is also recommended that
you configure all client configurations to use single sign-on (SSO).
In addition, since internal hosts do not need to establish a tunnel
connection with the gateway, the IP address of the physical network
adapter on the endpoint is used.
In this quick config, the
internal gateways enforce group-based policies that allow users
in the Engineering group access to the internal source control and
bug databases and users in the Finance group access to the CRM applications.
All authenticated users have access to internal web resources. In
addition, HIP profiles configured on the gateway check each host
to ensure compliance with internal maintenance requirements, such
as whether the latest security patches are installed, whether disk
encryption is enabled, or whether the required software is installed.

Use
the following steps to configure a GlobalProtect internal gateway.
- Create
Interfaces and Zones for GlobalProtect.In this configuration, you must set up interfaces on each firewall hosting a portal and/or a gateway. Because this configuration uses internal gateways only, you must configure the portal and gateways on interfaces in the internal network.Use the default virtual router for all interface configurations to avoid creating inter-zone routing.On each firewall hosting a portal/gateway:
- Select an Ethernet port to host the portal/gateway, and then configure a Layer3 interface with an IP address in the l3-trust Security Zone (NetworkInterfacesEthernet).
- Enable User Identification on the l3-trust zone.
- If any of your end users will be accessing the GlobalProtect
app on their mobile devices, or if you plan on using HIP-enabled
security policy, purchase and install a GlobalProtect subscription
for each firewall hosting an internal gateway.After you purchase the GlobalProtect subscriptions and receive your activation code, install the GlobalProtect subscriptions on the firewalls hosting your gateways, as follows:
- Select DeviceLicenses.
- Select Activate feature using authorization code.
- When prompted, enter the Authorization Code, and then click OK.
- Verify that the license was activated successfully.
Contact your Palo Alto Networks Sales Engineer or Reseller if you do not have the required licenses. For more information on licensing, see About GlobalProtect Licenses. - Obtain server certificates for the GlobalProtect portal
and each GlobalProtect gateway.In order to connect to the portal for the first time, the endpoints must trust the root CA certificate used to issue the portal server certificate. You can either use a self-signed certificate on the portal and deploy the root CA certificate to the endpoints before the first portal connection, or obtain a server certificate for the portal from a trusted CA.You can use self-signed certificates on the gateways.The recommended workflow is as follows:
- On the firewall hosting the portal:
- On each firewall hosting an internal gateway, Deploy the self-signed server certificates.
- Define how you will authenticate users to the portal
and gateways.You can use any combination of certificate profiles and/or authentication profiles as necessary to ensure the security of your portal and gateways. Portals and individual gateways can also use different authentication schemes. See the following sections for step-by-step instructions:
- Set Up External Authentication (authentication profile)
- Set Up Client Certificate Authentication (certificate profile)
- Set Up Two-Factor Authentication (token- or OTP-based)
You must then reference the certificate profile and/or authentication profiles that you defined in the portal and gateway configurations. - Create the HIP profiles you need to enforce security
policies on gateway access.See Host Information for more information on HIP matching.
- Create
the HIP objects to filter the raw host data collected by the app. For
example, if you want to prevent users that are not up-to-date with
required patches from connecting, you might create a HIP object
to match on whether the patch management software is installed and
that all patches with a given severity are up-to-date.
- Create
the HIP profiles that you plan to use in your policies.For example, if you want to ensure that only Windows users with up-to-date patches can access your internal applications, you might attach the following HIP profile that will match hosts that do NOT have a missing patch:
- Create
the HIP objects to filter the raw host data collected by the app. For
example, if you want to prevent users that are not up-to-date with
required patches from connecting, you might create a HIP object
to match on whether the patch management software is installed and
that all patches with a given severity are up-to-date.
- Configure the internal gateways.Select NetworkGlobalProtectGateways, and then select an existing internal gateway or Add a new gateway. Configure the following gateway settings:
- Interface
- IP Address
- Server Certificate
- Authentication Profile and/or Configuration Profile
Note that it is not necessary to configure the client settings in the gateway configurations (unless you want to set up HIP notifications) because tunnel connections are not required. See Configure a GlobalProtect Gateway for step-by-step instructions on creating the gateway configurations. - Configure the GlobalProtect
Portals.Although all of the previous configurations can use the User-logon (Always On) or On-demand (Manual user initiated connection) connect methods, an internal gateway configuration must always be on, and therefore requires the User-logon (Always On) connect method.Select NetworkGlobalProtectPortals, and then select an existing portal or Add a new portal. Configure the portal as follows:
- Set
Up Access to the GlobalProtect Portal:Interface—ethernet1/2IP Address—10.31.34.13Server Certificate—GP-server-cert.pem issued by GoDaddy with CN=gp.acme.com
- Define
the GlobalProtect Client Authentication Configurations:Use single sign-on—enabledConnect Method—User-logon (Always On)Internal Gateway Address—california.acme.com, newyork.acme.comUser/User Group—any
- Commit the portal configuration.
- Set
Up Access to the GlobalProtect Portal:
- Deploy
the GlobalProtect App Software.Select DeviceGlobalProtect Client.In this example, use the procedure to Host App Updates on the Portal.
- Create the HIP-enabled and/or user/group-based security
rules on your gateway(s).Add the following security rules for this example:
- Select PoliciesSecurity, and click Add.
- On the Source tab, set the Source Zone to l3-trust.
- On the User tab, add the HIP
profile and user/group to match.
- Click Add in the HIP Profiles area, and select the MissingPatch HIP profile.
- Add the Source User group (Finance or Engineering depending on which rule you are creating).
- Click OK to save the rule.
- Commit the gateway configuration.