|
GlobalProtect Gateway Client Setting or Network Configuration |
Description |
|
Authentication
|
|
Name
|
Enter a name to identify the client settings configuration (up to 31 characters). The name is case-sensitive and must be unique. Use only letters, numbers, spaces, hyphens, and underscores.
|
|
Authentication Override
|
Enable the gateway to use secure, device-specific, encrypted cookies to authenticate the user after the user first authenticates using the authentication scheme specified by the authentication or certificate profile.
Generate cookie for authentication override
—During the lifetime of the cookie, the agent presents this cookie each time the user authenticates with the gateway.
Cookie Lifetime
—Specify the hours, days, or weeks that the cookie is valid. The typical lifetime is 24 hours. The ranges are 1–72 hours, 1–52 weeks, or 1–365 days. After the cookie expires, the user must enter login credentials and the gateway subsequently encrypts a new cookie to send to user device.
Accept cookie for authentication override
—Select this option to configure the gateway to accept authentication using the encrypted cookie. When the agent presents the cookie, the gateway validates that the cookie was encrypted by the gateway before authenticating the user.
Certificate to Encrypt/Decrypt Cookie
—Select the certificate the gateway uses to use when encrypting and decrypting the cookie.
Ensure that the gateway and portal both use the same certificate to encrypt and decrypt cookies.
|
|
User/User Group tab
|
Specify the user or user group and client operating system to which this agent configuration applies.
|
|
User/User Group
|
Add
a specific user or user group to which this configuration applies.
You must configure group mapping (
Device > User Identification > Group Mapping Settings) before you can select users and groups.
You can also create configurations that are deployed to agents or apps in
pre-logon
mode (before the user logs in to the endpoint) or configurations to deploy to
any
user.
|
|
OS
|
To deploy configurations based on the operating system running on the endpoint,
Add
an OS (
Android,
Chrome,
iOS,
Mac,
Windows, or
WindowsUWP). Alternatively, you can leave this value set to
Any
so that configuration deployment is based only on the user or user group and not on the operating system of the endpoint.
|
|
Network Settings tab
|
|
Retrieve Framed-IP-Address attribute from authentication server
|
Select this option to enable the GlobalProtect gateway to assign fixed IP addresses by use of an external authentication server. When this option is enabled, the GlobalProtect gateway allocates the IP address for connecting to devices by using the Framed-IP-Address attribute from the authentication server.
|
|
Authentication Server IP Pool
|
Add
a subnet or range of IP addresses to assign to remote users. When the tunnel is established, the GlobalProtect gateway allocates the IP address in this range to connecting devices using the Framed-IP-Address attribute from the authentication server.
You can enable and configure
Authentication Server IP Pool
only if you enable
Retrieve Framed-IP-Address attribute from authentication server.
The authentication server IP pool must be large enough to support all concurrent connections. IP address assignment is fixed and is retained after the user disconnects. Configure multiple ranges from different subnets to allow the system to offer clients an IP address that does not conflict with other interfaces on the client.
The servers and routers in the networks must route the traffic for this IP pool to the firewall. For example, for the 192.168.0.0/16 network, a remote user can receive the address 192.168.0.10.
|
|
IP Pool
|
Add
a range of IP addresses to assign to remote users. When the tunnel is established, an interface is created on the remote user’s computer with an address in this range.
To avoid conflicts, the IP pool must be large enough to support all concurrent connections. The gateway maintains an index of clients and IP addresses so that the client automatically receives the same IP address the next time it connects. Configuring multiple ranges from different subnets allows the system to offer clients an IP address that does not conflict with other interfaces on the client.
The servers and routers in the networks must route the traffic for this IP pool to the firewall. For example, for the 192.168.0.0/16 network, a remote user may be assigned the address 192.168.0.10.
|
|
No direct access to local network
|
Select this option to disable split tunneling, including direct access to local networks on Windows and Mac OS endpoints. This function prevents a user from sending traffic to proxies or local resources, such as a home printer. When the tunnel is established, all traffic is routed through the tunnel and is subject to policy enforcement by the firewall.
|
|
Access Route
|
Add
routes that the gateway pushes to the remote users’ endpoint and thereby determine what the users’ endpoint can send through the VPN connection. For example, you can set up split tunneling to allow remote users to access the Internet without going through the VPN tunnel.
If you don’t add a route, every request is routed through the tunnel (no split tunneling). In this case, each Internet request passes through the firewall and then out to the network. This method can prevent the possibility of an external party accessing of the user’s endpoint and gaining access to the internal network (with the user’s endpoint acting as a bridge).
|
in the 
After you save the gateway configuration, you cannot change the 
You can format HIP notification messages in rich HTML, which allows you to include links to external web sites and resources. Click hyperlink ( 
) in the rich text settings toolbar to add links.
The IP pool must be large enough to support all concurrent connections. IP address assignment is dynamic and not retained after the satellite disconnects. Configuring multiple ranges from different subnets will allow the system to offer satellites an IP address that does not conflict with other interfaces on the satellites.