Get Started

Ensure you have completed the following prerequisites:
Created interfaces and zones for each firewall hosting a portal and/or a gateway. For gateways that require tunnel connections, configure both the physical and virtual tunnel interfaces.
Set up the portal server certificate, gateway server certificate, SSL/TLS service profile, and optionally deploy any client certificates to enable SSL/TLS connections for GlobalProtect services.
Created the authentication profiles and certificate profiles that the portals and gateways can utilize to authenticate GlobalProtect users.
Established a fully qualified domain name (FQDN) alias for the interface where you plan to configure the gateway. For example, paloaltonetworks.com. Utilizing FQDN simplifies management as DNS resolves to the IP addresses automatically, eliminating the need for manual updates when IP addresses change.
Select
Manage
Configuration
NGFW and Prisma Access
Device Settings
GlobalProtect
.
Choose the Configuration Scope where you want to configure cloud-managed NGFWs to work as GlobalProtect.
Select
Global
to apply configuration settings across all your NGFWs. Alternatively, you can choose a specific folder or firewall from your
Folders
or a
Snippet
to apply configuration to a group of objects associated with a folder.
For example, you might create a folder named California and put 60 firewalls in it and then create another folder named Hawaii and put 15 firewalls in that. You then create a snippet called CA-HI and apply it to the California and Hawaii folders. When you want to import configuration settings only to firewalls in California, you set the scope as Folder and select the California folder. If you want to import the configuration settings to both California and Hawaii, set the scope as Snippet and select the CA-HI snippet.
Define the GlobalProtect Agent Settings.
Customize the
Agent App Settings
.
Explore all GlobalProtect agent app settings available to you.
Select

Agent Settings

Add Agent App Settings

.

Enter a

Name

for the agent app setting.

Define the

Match Criteria

to specify the users, devices, or systems that should receive the settings.

Specify the external gateways to which users with this configuration can connect. You can configure the firewall gateways as external gateways only; not as internal gateways.

Add

the

External Gateway

to which users can connect.

Enter a descriptive

Name

for the gateway. Ensure that the name matches the one defined during the gateway configuration to provide clarity for users regarding the gateway's location.

Select either the

FQDN

or

IP

address of the interface where the gateway is configured.

For
IP
address, choose the
Device
and
Gateway
configured on that device, along with the
IPv4
address of the interface, instead of manually entering them.

Add

one or more source regions for the gateway, or select

Any

to make the gateway available to all regions. GlobalProtect recognizes the region when users connect and restricts access to gateways configured for that region. The source region is considered first for gateway selection, followed by gateway priority.

Set the

Priority

of the gateway by clicking the field and selecting one of the following values:

If you have only one external gateway, leave the value set to
Highest
(the default).
If you have multiple external gateways, adjust the priority values (ranging from Highest to Lowest) to indicate a preference for the specific user group. For example, if you prefer that the user group connects to a local gateway, set the priority higher than that of more geographically distant gateways.
If you prefer applications not to automatically establish connections with the gateway, select
Manual only
. This setting is useful in testing environments.

Select

Manual

to allow users to manually switch to the gateway.

Save

your changes.
Customize the
Agent Tunnel Settings
.
Customize the settings for the VPN tunnel the GlobalProtect establishes to connect to the firewall. Explore all GlobalProtect agent tunnel settings available to you.
Select

Agent Settings

Add Agent Tunnel Settings

.

Enter a

Name

and define the

Match Criteria

to specify the users, devices, or systems that should receive the settings. For example, you could indicate that a tunnel settings rule applies to all instances of the GlobalProtect app in a specific region.

Exclude Traffic

to not send video streaming traffic from the listed applications to the firewall. Specify traffic to exclude from firewall policy inspection and enforcement based on application, domain, and route.
Define how the GlobalProtect portals and gateways authenticate users using
Profiles
.
Configure
GP Authentication Profiles
.
Explore all GlobalProtect agent tunnel settings available to you.
Select

Profiles

GP Authentication Profiles

Add Profile

. You can configure the GlobalProtect portal to authenticate users through a local user database or an external authentication service, such as LDAP, Kerberos, TACACS+, SAML, RADIUS (including OTP), or Cloud Identity Engine (CIE).

Enter a

Name

to identify the client authentication configuration.

Specify the endpoints to which you want to deploy this configuration. To apply this configuration to all endpoints, accept the default

OS

of

Any

.

To enable users to authenticate to the portal or gateway using their user credentials, select or add an

Authentication Profile

.
Configure
Portal Agent Profiles
.
Select

Profiles

Portal Agent Profiles

Add Profile

Enter a portal agent profile

Name

.

Select the agent app setting you created in step 3 and

Save

the portal agent profile.
Configure
Gateway Agent Profiles
.
Select

Profiles

Gateway Agent Profiles

Add Profile

.

Enter a gateway agent profile

Name

.

Select the agent tunnel setting you created in step 3step 3 and

Save

the gateway agent profile.
Attach the profiles created to the GlobalProtect
Portals and Gateways
.
Attach the authentication profile to a portal.
Select

Portals and Gateways

Portals

Add Portal

.

Name

the portal.

Specify the network settings such as interface and IP address type to enable the GlobalProtect app to communicate with the portal.

Specify how the portal authenticates users by adding the SSL/TLS Service Profile and certificate profile that you configured for the portal.

Save

the portal configuration.
Attach the authentication profile to a gateway.
Select

Portals and Gateways

Gateways

Add Gateway

.

Name

the gateway.

Specify the network settings such as interface and IP address type that enables endpoints to connect to the gateway.

Specify how the gateway authenticates users by adding the SSL/TLS Service Profile and certificate profile that you configured for the gateway.

Save

the gateway configuration.
Push Config
Push
to push configuration changes to your NGFWs.