9.1 GlobalProtect Remote Access Architecture & Gateways

9.1 GlobalProtect Remote Access Architecture & Gateways

Architectural Components: Portals vs. Gateways

Palo Alto Networks GlobalProtect delivers an enterprise-grade secure access architecture built on a fundamental structural separation between the GlobalProtect Portal and the GlobalProtect Gateway. Rather than combining client configuration, user authentication, tunnel termination, and traffic inspection into an undifferentiated service, PAN-OS assigns distinct operational boundaries to each component.

                                +--------------------------+
                                |   GlobalProtect Portal   |
                                |  - Client Authentication |
                                |  - Config Distribution   |
                                |  - Gateway Priority List |
                                |  - Software Upgrades     |
                                +--------------------------+
                                       ^            ^
            1. Initial Contact & Config|            |1. Re-check / Refresh
                                       |            |
+-----------------------+     2. Connect (IPsec/SSL)+-----------------------+
|  Remote Mobile User   |-------------------------->|   External Gateway    |
|  (GlobalProtect App)  |                           |  - Tunnel Termination |
+-----------------------+                           |  - Virtual IP Pool    |
                                                    |  - Policy Enforcement |
                                                    +-----------------------+
                                                                |
+-----------------------+     2. Posture / User-ID  +-----------------------+
|   Internal LAN Host   |-------------------------->|   Internal Gateway    |
|  (GlobalProtect App)  |      (No Encrypted Tunnel)|  - User-ID Mapping    |
+-----------------------+                           |  - HIP Report Intake  |
                                                    |  - Zero Tunnel O/H    |
                                                    +-----------------------+

The GlobalProtect Portal

The GlobalProtect Portal serves as the centralized configuration management and initial contact point for all endpoints running the GlobalProtect application. Operating over HTTPS (TCP port 443), the Portal performs several mandatory functions:

• Client Authentication: Authenticates the endpoint or user upon initial connection before releasing any operational parameters.
• Client Configuration Distribution: Delivers the Portal Client Configuration profile to the GlobalProtect app. This configuration specifies agent operational behavior, connection methods, login prompts, timeout thresholds, app customization settings, and trusted network detection parameters.
• Gateway Provisioning & Priority Lists: Provides the client with a prioritized list of External and Internal Gateways, complete with FQDNs or public/private IP addresses, regional weights, and failover metrics.
• Enterprise PKI Certificate Deployment: Distributes trusted Root CA and Intermediate CA certificates to the client's local certificate store, ensuring the endpoint can validate gateway SSL/TLS server certificates without trust errors.
• Client Software Hosting & Upgrades: Hosts new releases of the GlobalProtect client software packages (Windows .msi, macOS .pkg, Linux .tgz) and dictates software upgrade policies across enterprise endpoints.

The GlobalProtect Gateway

The GlobalProtect Gateway serves as the security enforcement point and tunnel termination engine. Gateways can reside on physical hardware firewalls (PA-Series), virtual appliances (VM-Series), or Prisma Access cloud nodes:

• Tunnel Termination: Negotiates and establishes secure, encrypted tunnels with remote endpoints. It prioritizes IPsec (IKEv2/ESP on UDP 500 and UDP 4500) for wire-speed performance, hardware cryptographic acceleration, and low latency. If intermediate firewalls or NAT devices block UDP 4500, the client transparently falls back to SSL VPN (TLS on TCP port 443).
• Virtual Network Adapter Management & IP Assignment: Allocates a virtual IPv4 and/or IPv6 address to the endpoint's virtual network adapter from a locally defined IP Pool. It pushes primary and secondary DNS server addresses, internal DNS search domains, and WINS configurations.
• User-ID Mapping Integration: Immediately registers an IP-to-User mapping in the firewall's User-ID database, linking the authenticated username to the allocated virtual IP address for the duration of the session.
• Host Information Profile (HIP) Report Ingestion: Receives, decrypts, and parses endpoint telemetry reports submitted by the GlobalProtect application, evaluating the data against security posture profiles.
• Layer 7 Security Inspection: Enforces the complete suite of PAN-OS security services—App-ID, Content-ID, Advanced Threat Prevention, Advanced URL Filtering, and SSL Decryption—on all traffic emerging from the tunnel interface (tunnel.x).

Exam Trap Alert: The GlobalProtect Portal never terminates VPN data tunnels, never assigns virtual IP addresses to client interfaces, and never inspects transit data traffic. A Portal merely provides configuration and direction. In contrast, the Gateway terminates data tunnels and enforces security policies, but cannot distribute client software packages or portal client configuration files. Although an administrator can configure both Portal and Gateway functions on the exact same physical firewall interface, their logical responsibilities remain strictly separate.

---

External vs. Internal Gateways: Remote Access vs. Campus Zero Trust

PAN-OS allows Gateways to be deployed in two fundamentally different modes: External Gateways and Internal Gateways.

| Architectural Attribute | External Gateway | Internal Gateway | | :--- | :--- | :--- | | | Network Placement | Perimeter / Public Internet Edge | Campus Core / Internal LAN Segment | | Primary Target Clients | Remote workers, mobile laptops, traveling users | On-premises enterprise desktops, corporate laptops on Wi-Fi | | Tunnel Establishment | Yes (Point-to-Point IPsec or SSL tunnel) | No (Zero tunnel encapsulation) | | Virtual IP Allocation | Yes (Assigns IP from configured IP Pool) | No (Client retains local DHCP/LAN IP address) | | Virtual Adapter Required| Yes (PAN GlobalProtect Virtual Adapter) | No (Physical Ethernet/Wi-Fi interface used) | | Encryption Overhead | Yes (ESP / TLS cryptographic encapsulation) | No (Zero performance or MTU packet penalty) | | Primary Objective | Secure remote access, perimeter traversal, full traffic inspection | Continuous User-ID tracking and HIP endpoint posture verification | | Policy Enforcement | Transit Security Policy on tunnel.x zone | Transit Security Policy on internal LAN/VLAN zones |

Internal Gateway Mechanics

Traditional network architectures lose User-ID mapping accuracy and posture visibility when mobile laptops enter corporate office buildings and connect directly to internal access layer switches or corporate Wi-Fi. An Internal Gateway solves this problem without the overhead of routing local LAN traffic through an encrypted VPN tunnel:

1. When an employee opens their laptop at an office desk, the GlobalProtect app evaluates Trusted Network Detection (TND).
2. TND verifies an internal DNS server IP and attempts to resolve a configured host record (or verifies a reverse DNS PTR lookup). Upon successful resolution, the app recognizes it is residing on the trusted internal corporate network.
3. The app establishes a lightweight HTTPS control connection to the Internal Gateway.
4. The Internal Gateway authenticates the user, generates a fresh User-ID mapping linking the user to their local physical DHCP IP address, and collects a complete Host Information Profile (HIP) report.
5. The internal firewall can now enforce granular zero-trust security policies (e.g., preventing any LAN host from accessing development servers unless CrowdStrike EDR is operational and active) without subjecting internal LAN traffic to MTU fragmentation, encapsulation overhead, or gateway bottlenecks.

---

Authentication Profiles & Identity Integration

GlobalProtect supports flexible, enterprise-grade authentication frameworks to ensure that both the device and the human user are robustly verified.

Supported Authentication Profiles

• SAML 2.0 (Identity Provider Single Sign-On): The modern industry standard. Integrates directly with enterprise IdPs such as Microsoft Entra ID (Azure AD), Okta, PingFederate, and Google Workspace. The user authenticates against the corporate IdP portal via an embedded browser or default system browser, completing phishing-resistant FIDO2/WebAuthn or multi-factor authentication (MFA) challenges before the IdP issues a signed SAML assertion to the Portal or Gateway.
• RADIUS: Authenticates against RADIUS servers (e.g., Cisco ISE, Microsoft NPS, FreeRADIUS) using PAP, CHAP, or MS-CHAPv2. Frequently utilized for legacy one-time password (OTP) hardware tokens.
• TACACS+: Authenticates administrative and remote user access via TACACS+ protocols.
• Local Database: Fallback authentication using user accounts stored directly in the PAN-OS internal configuration database.
• Client Certificates (PKI / Mutual TLS): Validates a digital X.509 certificate installed on the endpoint against an Enterprise Root/Intermediate CA loaded into the firewall's Certificate Profile. This verifies device identity and corporate asset ownership without requiring user credentials.

Dual-Factor Authentication Workflow (Certificate + SAML)

A best-practice enterprise deployment combines machine-level PKI certificates with user-level SAML authentication:

1. Step 1 (Machine Verification): During the initial TLS handshake with the Portal or Gateway, the firewall requests a client certificate. The GlobalProtect app presents the corporate-issued machine certificate. The firewall validates the certificate's cryptographic signature, validity dates, and Certificate Revocation List (CRL) or OCSP status. Untrusted personal devices are rejected at this stage.
2. Step 2 (User Authentication): Once device trust is established, the firewall redirects the user to the corporate SAML 2.0 IdP for credential input, biometric verification, and conditional access MFA.

Authentication Cookies

To eliminate repetitive credential and MFA prompts whenever mobile workers roam between Wi-Fi networks or wake laptops from sleep, PAN-OS supports Authentication Cookies:

• Upon successful authentication, the Portal or Gateway issues an encrypted, digitally signed cookie with a configurable lifetime (e.g., 24 hours).
• The cookie is encrypted using a unique cookie encryption key generated on the firewall. Subsequent connection attempts present this cookie to bypass full re-authentication.

---

Connection Methods: User-Logon, Always-On & Pre-Logon

The Portal Client Configuration dictates how and when the GlobalProtect client initiates connectivity.

Deep-Dive: Pre-Logon Architecture

In corporate Windows environments, remote laptops face a bootstrap paradox: if a remote worker changes their Active Directory password, or if a newly imaged machine is shipped to a remote employee's home, the machine cannot reach internal Active Directory Domain Controllers (DCs) to authenticate the user, run logon scripts, or apply Group Policy Objects (GPOs) because the VPN is not yet connected.

Pre-Logon resolves this issue:

1. The operating system boots to the Windows logon screen.
2. The GlobalProtect system service starts in the background and initiates a connection to the Portal and Gateway using the machine's local computer certificate (Pre-Logon).
3. The Gateway authenticates the computer certificate and assigns the machine a virtual IP, establishing a secure IPsec tunnel under a system identity (e.g., host/laptop-104.corp.local).
4. The machine now has full network connectivity to corporate Domain Controllers, Kerberos Key Distribution Centers (KDCs), WSUS patch servers, and SCCM/Intune management engines.
5. The employee enters their domain credentials at the Windows login screen. Windows validates the credentials directly against the corporate DC across the pre-logon tunnel.
6. Tunnel Transition: Upon successful desktop logon, GlobalProtect transitions from the Pre-Logon tunnel to a User-Logon tunnel. It re-authenticates using the user's credentials or SAML token, updates the User-ID mapping to the actual user name, and applies the user's specific security policies.

+-----------------------------------------------------------------------------------+
|                             PRE-LOGON WORKFLOW                                    |
|                                                                                   |
| 1. OS Boot (Login Screen)  --> Connects using Machine Certificate                 |
| 2. Gateway Authentication --> Establishes Tunnel under 'host/laptop-104' identity |
| 3. Domain Connectivity    --> Windows connects to Domain Controller over VPN      |
| 4. User Enters Password   --> DC validates credentials over active tunnel         |
| 5. Desktop Initialization --> GlobalProtect renegotiates tunnel with User Identity|
| 6. User-ID Updated        --> Firewall binds Virtual IP to 'corp\jsmith'           |
+-----------------------------------------------------------------------------------+

---

Client Software Upgrades & Gateway Selection Priority

Client Software Upgrade Settings

Administrators control GlobalProtect app upgrades directly within the Portal configuration (Network > GlobalProtect > Portals > Agent > Client Apps):

• Transparent: The portal silently downloads the new client installer package in the background and upgrades the application without user notification or interaction.
• Prompt: When an upgrade is available, the GlobalProtect app displays a dialog notifying the user of the new version, offering them the option to initiate the upgrade now or postpone.
• Allow Manually: Users can initiate an upgrade manually by selecting 'Check for Updates' from the GlobalProtect system tray menu, but the app does not proactively prompt.
• Disabled: Endpoints are strictly blocked from upgrading via the Portal. Used in tightly managed environments where enterprise software deployment systems (SCCM, Tanium, Jamf) manage binary versions.

Gateway Selection Priority & Latency Probes

When the Portal provides the client configuration, it includes a list of available Gateways with assigned priorities (ranging from Priority 1 to Priority 10, where Priority 1 is highest):

1. Simultaneous Probing: The GlobalProtect app sends concurrent HTTPS SSL probes to all gateways configured at the highest priority level (e.g., all Priority 1 gateways).
2. Latency Calculation: The app calculates the round-trip network latency (SSL handshake response time) for each responsive gateway.
3. Optimal Selection: The app selects and connects to the Priority 1 gateway exhibiting the lowest latency. If all Priority 1 gateways fail to respond or exceed timeout thresholds, the app falls back to probing Priority 2 gateways.
4. Source Region Weighting: Administrators can configure source region rules (e.g., assigning European users Priority 1 for Frankfurt/London gateways and Priority 2 for New York gateways), ensuring geographic optimization while maintaining disaster recovery redundancy.

---

Essential CLI Verification Commands

# Display real-time active GlobalProtect Gateway users, tunnel IPs, and cipher suites
admin@PA-3410> show globalprotect-gateway current-users gateway GP-GW-External

# Inspect detailed connection statistics, assigned IP, and virtual interface for a user
admin@PA-3410> show globalprotect-gateway current-users user corp\jsmith

# View GlobalProtect Portal operational state and agent configurations
admin@PA-3410> show globalprotect-portal running-config

# Display active User-ID mappings derived from GlobalProtect
admin@PA-3410> show user ip-user-mapping all type GP