Define the GlobalProtect Agent Configurations

1. Add one or more trusted root CA certificates to the portal agent configuration to enable the GlobalProtect app to verify the identity of the portal and gateways.

   The portal deploys the certificate in a certificate file which is read only by GlobalProtect.

   1. To add one or more trusted root CA certificates to the portal agent configuration, do one of the following:

      • On Strata Cloud Manager (Prisma Access), select ConfigurationNGFW and Prisma AccessConfiguration ScopePrisma AccessGlobalProtectSetupGlobalProtect AppGlobal App SettingsTrusted Certificate DistributionAdd Trusted Certificate Distribution.
      • On Strata Cloud Manager (NGFW), select ConfigurationNGFW and Prisma AccessDeviceGlobalProtectPortals and GatewaysPortals and then Add Portal. On the Add Portal page, select Advanced SettingsTrusted Certifictate Distribution and Add trusted certificate distribution.
      • On Panorama, select NetworkGlobalProtectPortals.
   2. Select the portal configuration to which you are adding the agent configuration, and then select the Agent tab.
   3. In the Trusted Root CA field, Add and select the CA certificate that was used to issue the gateway and/or portal server certificates.

      The web interface presents a list of CA certificates that are imported on the firewall serving as the GlobalProtect portal. The web interface also excludes end-entity certificates, sometimes referred to as leaf certificates, from the list of certificates you can select. You can also Import a new CA certificate.

      Use the following best practices when creating and adding certificates:

      • Use the same certificate issuer to issue certificates for all of your gateways.
      • Add the entire certificate chain (trusted root CA and intermediate CA certificates) to the portal agent configuration.
   4. (Optional) Deploy additional CA certificates for purposes other than GlobalProtect (for example, SSL forward proxy decryption).

      This option enables you to use the portal to deploy certificates to the endpoint and the agent to install them in the local root certificate store. This can be useful if you do not have another method for distributing these server certificates or prefer to use the portal for certificate distribution.

      For SSL forward proxy decryption, you specify the forward trust certificate that the firewall uses (on Windows and macOS endpoints only) to terminate the HTTPS connection, inspect the traffic for policy compliance, and re-establish the HTTPS connection to forward the encrypted traffic.

      1. Add the certificate as described in the previous step.
      2. Enable the option to Install in Local Root Certificate Store.
         The portal automatically sends the certificate when the user logs in to the portal and installs it in the endpoint's local store, thus eliminating the need for you to install the certificate manually.
2. Add an agent configuration.

   The agent configuration specifies the GlobalProtect configuration settings to deploy to the connecting apps. You must define at least one agent configuration. You can add up to 512 agent configuration entries for each portal.

   1. From your portal configuration (NetworkGlobalProtectPortals<portal-config>), Add a new agent configuration.
   2. Enter a Name to identify the configuration. If you plan on creating multiple configurations, make sure the name you define for each configuration is descriptive enough to distinguish them.
3. (Optional) Configure settings to specify how users with this configuration authenticate with the portal.

   If the gateway authenticates endpoints using a client certificate, you must select the source that distributes the certificate.

   Configure any of the following Authentication settings:

   • To enable users to authenticate with the portal using client certificates, select the Client Certificate source (SCEP, Local, or None) that distributes the certificate and its private key to an endpoint. If you use an internal CA to distribute certificates to endpoints, select None (default). To enable the portal to generate and send a machine certificate to the app for storage in the local certificate store and use the certificate for portal and gateway authentication, select SCEP and the associated SCEP profile. These certificates are device-specific and can only be used on the endpoint to which it was issued. To use the same certificate for all endpoints, select a certificate that is Local to the portal. With None, the portal does not push a certificate to the endpoint, but you can use can other ways to get a certificate to the endpoint.
     If you are using Strata Cloud Manager, do one of the following:
     • On Strata Cloud Manager (Prisma Access), select ConfigurationNGFW and Prisma AccessConfiguration ScopePrisma AccessGlobalProtectIdentity ServicesAuthenticationAuthentication ProfilesAdd Profile.
     • On Strata Cloud Manager (NGFW), select ConfigurationNGFW and Prisma AccessConfiguration ScopeAll FirewallsDeviceGlobalProtectProfilesGP Authentication ProfilesAdd Profile.
   • Specify whether to Save User Credentials. Select Yes to save the username and password (default), Save Username Only to save only the username, Only with User Fingerprint to save the user’s biometric (fingerprint) or, on iOS X endpoints only, face ID credentials, or No to never save credentials.
     When you set Save User Credentials to No, and if the portal and the gateway are configured to use the same authentication methods, the GlobalProtect app can authenticate to the gateway transparently using the credentials provided by the user to authenticate to the portal. The user is not required to re-enter their credentials to authenticate to the gateway.
     If you configure the portal or gateways to prompt for a dynamic password, such as a one-time password (OTP), the user must enter a new password at each login. In this case, the GlobalProtect app ignores the selection to save both the username and password, if specified, and saves only the username. For more information, see Enable Two-Factor Authentication Using One-Time Passwords (OTPs).
     If you select GlobalProtect to Save User Credentials Only with User Fingerprint, GlobalProtect can leverage the app’s operating system capabilities for validating the user before allowing authentication with GlobalProtect. End users must supply a fingerprint that matches a trusted fingerprint template on the endpoint to use a saved password for authentication to GlobalProtect portal and gateways. On iOS X, GlobalProtect also supports facial recognition with Face ID. GlobalProtect does not store the fingerprint or facial template used for authentication, but relies on the operating system scanning capabilities to determine the validity of a scan match.
4. If the GlobalProtect endpoint does not require tunnel connections when it is on the internal network, configure internal host detection.

   1. On Panorama, select NetworkGlobalProtectPortals<portal-config>AgentInternal.

      If you are using Strata Cloud Manager, do one of the following:

      • On Strata Cloud Manager (Prisma Access), select ConfigurationNGFW and Prisma AccessConfiguration ScopePrisma AccessGlobalProtectSetupGlobalProtect AppApp SettingsInternal Host Detection.
      • On Strata Cloud Manager (NGFW), select ConfigurationNGFW and Prisma AccessConfiguration ScopeAll FirewallsDeviceGlobalProtectAgent SettingsAdd Agent App SettingsInternal Host Detection.
   2. Enable Internal Host Detection(IPv4 or IPv6).
   3. Enter the IP Address of a host that can be reached from the internal network only. The IP address you specify must be compatible with the IP address type (IPv4 or IPv6). For example, 172.16.1.0 for IPv4 or 21DA:D3:0:2F3b for IPv6.
   4. Enter the DNS Hostname for the IP address you enter. Endpoints that try to connect to GlobalProtect attempt to do a reverse DNS lookup on the specified address. If the lookup fails, the endpoint determines that it is on the external network and then initiates a tunnel connection to a gateway on its list of external gateways.
   5. (Optional) Enter a source address pool for endpoints. When users connect, GlobalProtect recognizes the source address of the device. Only GlobalProtect apps with IP addresses that are included in the source IP address pool can authenticate with the gateway and send HIP reports.

      IPv4 subnet must be /30 or larger. Otherwise, a specific IP range must be specified. For example, 192.168.1.0/30 or 192.168.2.6-192.168.2.7
5. Set up access to a third-party mobile endpoint management system.

   This step is required if the mobile endpoints using this configuration will be managed by a third-party mobile endpoint management system. All endpoints initially connect to the portal and, if a third-party mobile endpoint management system is configured on the corresponding portal agent configuration, the endpoint is redirected to it for enrollment.

   1. Enter the IP address or FQDN of the endpoint check-in interface associated with your mobile endpoint management system. The value you enter here must exactly match the value of the server certificate associated with the endpoint check-in interface. You can specify an IPv6 or IPv4 address.
   2. Specify the Enrollment Port on which the mobile endpoint management system listens for enrollment requests. This value must match the value set on the mobile endpoint management system (default=443).
6. Specify the selection criteria for your portal agent configuration.

   The portal uses the selection criteria that you specify to determine which configuration to deliver to the GlobalProtect apps that connect. Therefore, if you have multiple configurations, you must make sure to order them properly. As soon as the portal finds a match, it delivers the configuration. Therefore, more specific configurations must precede more general ones. See step 12 for instructions on ordering the list of agent configurations.

   Select Config Selection Criteria and then configure any of the following options:

   • To specify the user, user group, and/or operating system to which this configuration applies, on Panorama, select User/User Group and then configure any of the following options:
     If you are using Strata Cloud Manager, do one of the following:

     1. On Strata Cloud Manager (Prisma Access), select ConfigurationNGFW and Prisma AccessConfiguration ScopePrisma AccessGlobalProtectIdentity ServicesLocal Users & Groups.
     2. On Strata Cloud Manager (NGFW), select ConfigurationNGFW and Prisma AccessIdentity ServicesLocal Users & Groups.
   • To deliver this configuration to apps running on a specific operating system, Add and select the OS (Android, Chrome, iOS, Linux, Mac, Windows, or WindowsUWP) to which this configuration applies. Set the OS to Any to deploy the configuration to all operating systems.
   • To restrict this configuration to a specific user and/or group, Add and then select the User/User Group you want to receive this configuration. Repeat this step for each user/group you want to add. To restrict the configuration to users who have not yet logged in to their endpoints, select pre-logon from the User/User Group drop-down. To deploy the configuration to any user regardless of login status (both pre-logon and logged in users), select any from the User/User Group drop-down.
     Before you can restrict the configuration to specific groups, you must map users to groups as described in Enable Group Mapping.
   • To deliver this configuration to apps based on specific device attributes, select Device Checks and then configure any of the following options:
     • To deliver this configuration based on the presence of the endpoint serial number in the Active Directory or Azure AD, select an option from the Machine account exists with device serial number drop-down. If you set this option to Yes, the agent configuration applies only to endpoints with a serial number that exists (managed endpoints). If you set this option to No, the agent configuration applies only to endpoints for which a serial number does not exist (unmanaged endpoints). If you set this option to None, the configuration is not delivered to apps based on the presence of the endpoint serial number.
     • To deliver this configuration based on the endpoint’s machine certificate, select a Certificate Profile to match against the machine certificate installed on the endpoint.
     Device checks are supported on Windows and Mac operating systems.
   • To deliver this configuration to apps based on custom host information, select Custom Checks, do one of the following:
     On Strata Cloud Manager (NGFW):

     1. On Strata Cloud Manager (NGFW), select ConfigurationNGFW and Prisma AccessConfiguration ScopeAll FirewallsDeviceGlobalProtectAgent SettingsAdd Agent App Settings.
     2. On the Add Agent App Settings page, select HIP Data CollectionShow Advanced OptionsCustom Checks and edit the Custom Checks.
     3. Click Add to add the Windows (Registry Key), Mac (Plist), or Linux (Process List).
     On Strata Cloud Manager (Prisma Access):

     1. Select ConfigurationNGFW and Prisma AccessConfiguration ScopePrisma AccessMobile Users ContainerGlobalProtectSetupGlobalProtect AppApp Settings <default>.
     2. On the Default page, select HIP Data CollectionShow Advanced OptionsCustom Checks and edit the Custom Checks.
     3. Click Add to add the Windows (Registry Key), Mac (Plist), or Linux (Process List).
     On Panorama, enable Custom Checks and then define any of the following registry and plist data:
     • To verify whether Windows endpoints have a specific registry key, use the following steps:
       1. Add a new registry key (Custom ChecksRegistry Key).
       2. When prompted, enter the Registry Key to match.
       3. (Optional) To deliver this configuration only if the endpoint does not have the specified registry key or key value, select Key does not exist or match the specified value data.
       4. (Optional) To deliver this configuration based on specific registry values, Add the Registry Value and corresponding Value Data. To deliver this configuration only endpoints that do not have the specified Registry Value or Value Data, select Negate.
     • To verify whether macOS endpoints have a specific entry in the plist, use the following steps:
       1. Add a new plist (Custom ChecksPlist).
       2. When prompted, enter the Plist name.
       3. (Optional) To deliver this configuration only if the endpoint does not have the specified plist, select Plist does not exist.
       4. (Optional) To deliver this configuration based on specific key-value pairs within the plist, click Add and then enter the Key and corresponding Value. To match only endpoints that do not have the specified key or value, select Negate.
7. Specify the external gateways to which users with this configuration can connect.

   Consider the following best practices when you configure the gateways:

   • If you are adding both internal and external gateways to the same configuration, make sure you enable Internal Host Detection (step 4).
   • To learn more about how the GlobalProtect app determines the gateway to which it should connect, see Gateway Priority in a Multiple Gateway Configuration.

   1. Add internal or external gateway, do one of the following:

      • On Strata Cloud Manager (Prisma Access), select ConfigurationNGFW and Prisma AccessConfiguration ScopePrisma AccessGlobalProtectSetupGlobalProtect AppApp SettingsGatewaysExternal Gateway.
      • On Strata Cloud Manager (NGFW), select ConfigurationNGFW and Prisma AccessConfiguration ScopeAll FirewallsDeviceGlobalProtectAgent SettingsAdd Agent App SettingsGatewaysExternal Gateway.
      • On Panorama, select NetworkGlobalProtectPortals<portal-config>AgentExternal.
   2. Add the External Gateways to which users can connect.
   3. Enter a descriptive Name for the gateway. The name you enter here should match the name you defined when you configured the gateway and should be descriptive enough for users to know the location of the gateway to which they are connected.
   4. Enter the FQDN or IP address of the interface where the gateway is configured in the Address field. You can configure an IPv4 or IPv6 address. The address you specify must exactly match the Common Name (CN) in the gateway server certificate.
   5. Add one or more Source Regions for the gateway, or select Any to make the gateway available to all regions. When users connect, GlobalProtect recognizes the region and only allows users to connect to gateways that are configured for that region. For gateway selection, source region is considered first, then gateway priority.
   6. Set the Priority of the gateway by clicking the field and selecting one of the following values:

      • If you have only one external gateway, you can leave the value set to Highest (the default).
      • If you have multiple external gateways, you can modify the priority values (ranging from Highest to Lowest) to indicate a preference for the specific user group to which this configuration applies. For example, if you prefer that the user group connects to a local gateway you would set the priority higher than that of more geographically distant gateways. The priority value is then used to weight the agent’s gateway selection algorithm.
      • If you do not want apps to automatically establish connections with the gateway, select Manual only. This setting is useful in testing environments.
   7. Select the Manual check box to allow users to manually switch to the gateway.
8. Specify the internal gateways to which users with this configuration can connect.

   Make sure you do not use on-demand as the connect method if your configuration includes internal gateways.

   1. Add internal or external gateway, do one of the following:

      • On Strata Cloud Manager (Prisma Access), select ConfigurationNGFW and Prisma AccessConfiguration ScopePrisma AccessGlobalProtectSetupGlobalProtect AppApp SettingsGatewaysInternal Gateway.
      • On Strata Cloud Manager (NGFW), select ConfigurationNGFW and Prisma AccessConfiguration ScopeAll FirewallsDeviceGlobalProtectAgent SettingsAdd Agent App SettingsGateways. Enable Internal Gateway and specify gateway details.
      • On Panorama, select NetworkGlobalProtectPortals<portal-config>AgentInternal.
   2. Add the Internal Gateways to which users can connect.
   3. Enter a descriptive Name for the gateway. The name you enter here should match the name you defined when you configured the gateway and should be descriptive enough for users to know the location of the gateway they are connected to.
   4. Enter the FQDN or IP address of the interface where the gateway is configured in the Address field. You can configure an IPv4 or IPv6 address. The address you specify must exactly match the Common Name (CN) in the gateway server certificate.
   5. (Optional) Add one or more Source Addresses to the gateway configuration. The source address can be an IP subnet, range, or predefined address. GlobalProtect supports both IPv6 and IPv4 addresses. When users connect, GlobalProtect recognizes the source address of the endpoint and only allows users to connect to gateways that are configured for that address.
   6. Click OK to save your changes.
   7. (Optional) Add a DHCP Option 43 Code to the gateway configuration. You can include one or more sub-option codes associated with the vendor-specific information (Option 43) that the DHCP server has been configured to offer the client. For example, you might have a sub-option code 100 that is associated with an IP address of 192.168.3.1.

      When a user connects, the GlobalProtect portal sends the list of option codes in the portal configuration to the GlobalProtect app, and the app selects gateways indicated by these options.

      When both the source address and DHCP options are configured, the list of available gateways presented to the endpoint is based on the combination (union) of the two configurations.

      DHCP options are supported on Windows and macOS endpoints only. DHCP options cannot be used to select gateways that use IPv6 addressing.
   8. (Optional) On Panorama, select Internal Host Detection to allow the GlobalProtect app to determine if it is inside the enterprise network. When a user attempts to log in, the app performs a reverse DNS lookup of the internal Hostname to the specified IP Address.

      If you are using Strata Cloud Manager, do one of the following:

      • On Strata Cloud Manager (Prisma Access), select ConfigurationNGFW and Prisma AccessConfiguration ScopePrisma AccessGlobalProtectSetupGlobalProtect AppApp SettingsInternal Host Detection.
      • On Strata Cloud Manager (NGFW), select ConfigurationNGFW and Prisma AccessConfiguration ScopeAll FirewallsDeviceGlobalProtectAgent SettingsAdd Agent App SettingsInternal Host Detection.

      The host serves as a reference point that is reachable if the endpoint is inside the enterprise network. If the app finds the host, the endpoint is inside the network and the app connects to an internal gateway; if the app fails to find the internal host, the endpoint is outside the network and the app connects to one of the external gateways.

      You can configure IPv4 or IPv6 addressing for Internal Host Detection. The IP address you specify must be compatible with the IP address type. For example, 172.16.1.0 for IPv4 or 21DA:D3:0:2F3b for IPv6.
9. Customize the GlobalProtect app behavior for users with this configuration.

   Modify the App settings as desired. For more details about each option, see Customize the GlobalProtect App.
10. (Optional) Define any custom host information profile (HIP) data that you want the app to collect and/or exclude from collection.

    This step applies only if you plan on using the HIP feature, there is information you want to collect that cannot be collected using the standard HIP objects, or if there is HIP information that you are not interested in collecting. See Host Information for details on setting up and using the HIP feature.

    See Collect Application and Process Data From Endpoints for additional information on collecting custom HIP data.

    1. Select HIP Data Collection.
    2. Enable the GlobalProtect app to Collect HIP Data.
    3. Specify the Max Wait Time (sec) that the app should search for HIP data before submitting the available data (range is 10-60 seconds; default is 20 seconds).
    4. Select the Certificate Profile that the GlobalProtect portal uses to match the machine certificate send by the GlobalProtect app.
    5. Select Exclude Categories to exclude specific categories and/or vendors, applications, or versions within a category. For more details, see Configure HIP-Based Policy Enforcement.
    6. Select Custom Checks to define any custom data you want to collect from hosts running this agent configuration.
11. Save the agent configuration.

    Click OK to save the agent configuration.
12. Arrange the agent configurations so that the proper configuration is deployed to each app.

    When an app connects, the portal compares the source information in the packet against the agent configurations you have defined. As with security rule evaluation, the portal looks for a match starting from the top of the list. When it finds a match, it delivers the corresponding configuration to the app.

    • To move an agent configuration up on the list of configurations, select the configuration and click Move Up.
    • To move an agent configuration down on the list of configurations, select the configuration and click Move Down.
13. Save the portal configuration.

    1. Click OK to save the portal configuration.
    2. Commit the changes.