Set Up GlobalProtect Mobile Users (Strata Cloud Manager)
Focus
Focus
Prisma Access

Cloud Management

Table of Contents


Set Up GlobalProtect Mobile Users (
Strata Cloud Manager
)

Set up a mobile users location in just a few steps in
Prisma Access (Managed by Strata Cloud Manager)
.
In just a few steps, here’s how to start onboarding GlobalProtect mobile users to
Prisma Access
.

  1. Enable GlobalProtect as a mobile user connection type
    Go to
    Manage
    Service Setup
    Mobile Users
    .
    If you're using Strata Cloud Manager, go to
    Workflows
    Prisma Access
    Setup
    Mobile Users
    .
    You can divide your mobile user license between GlobalProtect and Explicit Proxy connections; some users can connect through GlobalProtect and others through Explicit Proxy. With a
    GlobalProtect Connection
    , the GlobalProtect app installed on mobile user devices sends traffic to
    Prisma Access
    .
  2. Set up basic infrastructure settings
    Configure the infrastructure settings that are specific to GlobalProtect. There are a few required settings you’ll need to fill out initially, so that
    Prisma Access
    can provision your mobile user environment.
    • When you set up GlobalProtect for the first time, you’ll decide whether to enable
      Prisma Access
      IP Optimization. Choosing to enable IP Optimization requires GlobalProtect client version 6.1.4 or later, and does not support IPv6. Choose carefully, as you can’t change this setting later.
    • IP Optimization functionality is for new
      Prisma Access
      GlobalProtect deployments only. Existing GlobalProtect deployments, including new tenants you create from an existing multitenant deployment, are not eligible.
    • If you are migrating your GlobalProtect deployment to
      Prisma Access
      (away from using on-premises gateways and portals), ensure all users are running GlobalProtect app version 6.1.4 or above before enabling this functionality.
    Go to
    Manage
    Service Setup
    GlobalProtect
    Infrastructure
    Infrastructure Settings
    .
    If you're using Strata Cloud Manager, go to
    Workflows
    Prisma Access
    Setup
    GlobalProtect
    Infrastructure
    Infrastructure Settings
    .
    • Specify the
      Portal Name
      .
      • Default Domain
        —If you select this option, your portal hostname uses the default domain name:
        .gpcloudservice.com
        . In this case, simply enter a
        Portal Hostname
        to append to the default domain name.
        Prisma Access
        for Users will automatically create the necessary certificates and publish the hostname to public DNS servers.
      • Custom Domain
        —You can also customize the portal address if you want the domain in the portal hostname to match your company domain name (for example, myportal.mydomain.com).
    • Enter
      Client DNS
      resolution settings for your GlobalProtect deployment.
      • Select a region for the
        DNS Servers
        (
        Add Region
        ).
        Select
        Worldwide
        or a theater. If you specify multiple proxy settings with a mix of Worldwide and theater settings,
        Prisma Access
        uses the settings for the location group, then theater, then Worldwide.
        Prisma Access
        evaluates the rules from top to bottom in the list.
      • Choose whether or not you want
        Prisma Access
        to
        Resolve internal domains
        ; if you do,
        Add
        one or more
        Internal Domain Resolve Rules
        .
      • Enter a unique
        Name
        for the rule.
      • Select
        Prisma Access
        Default
        to use the default
        Prisma Access
        DNS server to resolve internal domains. you want your internal DNS server to only resolve the domains you specify, enter the domains to resolve in the
        Domain List
        . Specify an asterisk in front of the domain; for example, *.acme.com. You can specify a maximum of 1,024 domain entries.
      • If you have a
        Custom
        DNS server that can access your internal domains, specify the
        Primary DNS
        and
        Secondary DNS
        server IP addresses.
      • If you want your internal DNS server to only resolve the domains you specify, enter the domains to resolve in the
        Domain Lists
        . Specify an asterisk in front of the domain; for example, *.acme.com. You can specify a maximum of 1,024 domain entries.
      • Save
        your changes when finished.
    • Specify the DNS settings for
      Primary DNS for public domains
      and
      Secondary DNS for public domains
      .
      • Prisma Access
        Default
        —Use the default
        Prisma Access
        DNS server.
      • Internal DNS
        —Use the same server that you use to resolve internal domains.
      • Custom
        —If you have a DNS server that can access your public (external) domains, enter the Primary DNS server address in that field.
      • You can add a
        Client DNS Suffix List
        to specify the suffix that the client should use locally when an unqualified hostname is entered that it can't resolve, for example, acme.local. Don't enter a wildcard (*) character in front of the domain suffix (for example, acme.com). You can add multiple suffixes.
  3. Set up
    Advanced Settings
    .
    • (
      Optional
      ) Use
      Static Entries
      to resolve FQDNs to specific IP addresses.
      This functionality can be useful if you have guest internet services at your organization and you want your guests to safely use search engines, preventing them from searching for potentially inappropriate or offensive material that could be against company policy. To do so, enter a unique
      Name
      for the static entry rule, an
      FQDN
      , and the IP
      Address
      where the FQDN request should be directed.
    • If you want
      Prisma Access
      to proxy DNS requests, configure values for
      UDP Queries Retries
      (the
      Interval (Sec)
      to retry the query in seconds and the number of retry
      Attempts
      to perform.
  4. Choose the
    Prisma Access
    location to which your GlobalProtect users will connect
    Add the
    Prisma Access
    locations where you want to support GlobalProtect users. Go to
    Manage
    Service Setup
    GlobalProtect
    Infrastructure
    Prisma Access
    Locations
    .
    If you're using Strata Cloud Manager, go to
    Workflows
    Prisma Access
    Setup
    GlobalProtect
    Infrastructure
    Prisma Access
    Locations
    .
    The map displays the global regions where you can deploy
    Prisma Access
    for Users . In addition,
    Prisma Access
    provides multiple locations within each region to ensure that your users can connect to a location that provides a user experience tailored to the users’ locale. For the best performance,
    Select All
    . Alternatively, select the specific locations within each selected region where your users will need access. By limiting your deployment to a single region, you can have more granular control over your deployed regions and exclude regions required by your policy or industry regulations.
    For the best user experience, if you're limiting the number of locations, choose locations that are closest to your users or in the same country as your users. If a location isn't available in the country where your mobile users reside, choose a location that is closest to your users for the best performance.
  5. Authenticate GlobalProtect users
    Set up User Authentication so that only legitimate users have access to your services and applications. Go to
    Manage
    Service Setup
    GlobalProtect
    Infrastructure
    User Authentication
    .
    If you're using Strata Cloud Manager, go to
    Workflows
    Prisma Access
    Setup
    GlobalProtect
    Infrastructure
    User Authentication
    .
    To test your setup, you can add users who
    Prisma Access
    authenticates locally, or you can go straight to setting up enterprise-level authentication. Learn more on how to Enable Mobile Users to Authenticate to Prisma Access.
  6. Prisma Access
    enforces best practice security policy rules by default. These rules allow your users to securely browse to general internet sites. Users are:
    • Blocked from visiting known bad websites based on URL
    • Blocked from uploading or downloading files that are known to be malicious
    • Protected from unknown, never-before-seen threats
    • Protected from malware, spyware (command and control attacks), and vulnerabilities
    After going through the initial setup, you can review and update these default rules to meet your enterprise needs.
  7. Verify that the mobile user's location is active
    After you push your initial configuration to
    Prisma Access
    ,
    Prisma Access
    begins provisioning your GlobalProtect mobile user environment. This can take up to 15 minutes. When your mobile user locations are up and running, you’ll be able to verify them on the Mobile Users setup pages and within
    Prisma Access
    .
    You can also validate your setup by selecting
    Manage
    Prisma Access
    Prisma Access
    Setup
    Infrastructure
    and edit infrastructure settings to confirm a gateway is set up in each of the locations you provisioned.
    If you're using Strata Cloud Manager, go to
    Workflows
    Prisma Access
    Setup
    Prisma Access
    Infrastructure Settings
    .

GlobalProtect — Customize the Portal Address

Prisma Access
requires only the minimal settings to provision your mobile user's environment so that you can test it. If you would prefer to use your company domain in the portal address, you can change the address after the initial environment setup.
By default,
Prisma Access
uses the gpcloudservice.com domain to set up the
Prisma Access
portal address that your mobile users will need to connect to for secure access to the internet and your HQ and data centers. You must use this default domain when you initially set up and test your environment. If you want to customize the domain name after the initial setup to use your company domain, you can go back and edit the environment settings so that the portal address your users connect to contains your own company domain (for example, prisma-access.acme.com).
The *.gpcloudservice.com domain is associated with the Palo Alto Networks application.
To configure
Prisma Access
to use your own domain, you must:
  • Obtain certificates for the service.
  • Create a DNS CNAME entry on your DNS servers that maps the default portal address using the default domain to the custom portal address that uses your company domain. You need to do this because
    Prisma Access
    publishes the portal address you set up to public domain servers during initial provisioning.
  1. Select
    Manage
    Mobile Users
    Mobile Users Setup
    and edit
    Infrastructure Settings
    .
    If you're using Strata Cloud Manager, go to
    Workflows
    Prisma Access
    Setup
    GlobalProtect
    Infrastructure
    and edit
    Infrastructure Settings
    .
    In Strata Cloud Manager, Network Redundancy is enabled by default between portals or gateways and service connections, ensuring redundant connectivity for mobile users to accessible services and applications.
  2. Set the Portal Name Type to
    Custom Domain
    .
  3. Enter the
    Portal Hostname
    you want to use.
  4. Add the
    Portal DNS CNAME
    to which to map your DNS server entries.
  5. Import
    the
    Certificate
    you provisioned for your custom domain portal address.
    1. Select the certificate
      Format
      for the certificate you're importing:
      • Encrypted Private Key and Certificate (PKCS12)
        —The key and certificate are in a single container (Certificate File). Click
        Choose File
        and browse to the PKCS12 file to import.
      • Base64 Encoded Certificate (PEM)
        —If you select this option, you must import the
        Key File
        separately from the certificate. To import the PEM certificate and Key File, click
        Choose File
        .
    2. Enter the
      Passphrase
      to encrypt the key and
      Confirm Passphrase
      and then click
      Save
      .
  6. If you have not already done so, configure your DNS servers to point to the
    Prisma Access
    DNS CNAME you defined.
  7. Save
    the environment setup and
    Push Config
    to
    Prisma Access
    .
    Make sure to select both
    Explicit Proxy
    and
    GlobalProtect
    configuration scopes.


Recommended For You