Make sure the Zone Type should be Layer 3 and Enable User Identification.Ĭreating a tunnel interface for GlobalProtect To create Security Zone, go to Network > Zones > Add. Although you can choose one of the pre-created zones, it is always recommended to create a new zone so that you have granular control over the GlobalProtect traffic. Like IPSec VPN, in GlobalProtect VPN, you need to create a zone for the tunnel interface. Just follow the steps and create a new Authentication profile.Ĭreating a zone for GlobalProtect VPN Traffic Access the Advanced tab, and add users to Allow List. Go to Device > Authentication Profile and click on Add. Now, you need to create an authentication profile for GP Users. Go to Device > Local User Database > Users and click on Add.Ĭreating Authentication Profile for GlobalProtect VPN If you are running LDAP in your environment, you can integrate GlobalProtect VPN with your LDAP Server.

GlobalProtect VPN needs to be authenticated during the VPN connection process. Select the certificate you just created and the minimum and maximum version of TLS.Ĭreating Local Users for GlobalProtect VPN Authentication So, Go to Device > Certificate Management > SSL/TLS Service Profile > Add. Now, you need to create an SSL/TLS profile that is used for portal configuration. Make sure you put your Public IP address on the Common Name field. Now, just fill the Certificate filed as per the reference Image. To generate a self-sign certificate, Go to Device > Certificate Management > Certificates > Device Certificates > Generate. So, you can generate your certificate on the Palo Alto firewall or you can use any certificate which is signed by any of the CA authority.

To configure the GlobalProtect VPN, you must need a valid root CA certificate. Generating a Self Sign Certificate for GlobalProtect You can skip any step if you have already knowledge related to a particular step. I am starting the configuration with basic steps. Steps need to configure GlobalProtect VPN A client on the Branch site can access corporate resources using the GlobalProtect VPN. Clients need to connect their GlobalProtect to this public IP address. 101.1.1.2) which is assigned on the Palo Alto Firewall interface. In this article, we will use a Public IP address (i.e. Video Guide to Configure GlobalProtect VPN on Palo Alto Networks Firewall.Verification of GlobalProtect Configuration and Accessing defined Routes from Client Machine.

Gateway Configuration for GlobalProtect.Creating a tunnel interface for GlobalProtect.Creating a zone for GlobalProtect VPN Traffic.Creating Authentication Profile for GlobalProtect VPN.Creating Local Users for GlobalProtect VPN Authentication.Generating a Self Sign Certificate for GlobalProtect.Steps need to configure GlobalProtect VPN.

Globalprotect saml