8.2 GlobalProtect Portals, Gateways, and Authentication Methods (SAML, MFA)

8.2 GlobalProtect Portals, Gateways, and Authentication Methods (SAML, MFA)

Quick Answer: Palo Alto Networks GlobalProtect provides enterprise remote access by splitting functionality between GlobalProtect Portals and GlobalProtect Gateways. The Portal authenticates client endpoints, manages client software packages, and delivers security configurations. The Gateway terminates encrypted IPsec/SSL tunnels, enforces security policy, and collects host telemetry. Modern deployments integrate SAML 2.0 and Multi-Factor Authentication (MFA) via Entra ID or Okta, and support Always-On VPN with Pre-Logon capabilities to secure endpoints regardless of network location.

As hybrid work environments expand, securing remote endpoints and providing seamless connectivity to corporate resources is a critical responsibility of next-generation firewalls. Palo Alto Networks GlobalProtect delivers secure remote access, mobile security, and Zero Trust endpoint protection. Unlike legacy client-to-site VPNs that operate as isolated network entry points, GlobalProtect embeds remote access directly into the PAN-OS security architecture, applying full Threat Prevention, App-ID, User-ID, and Host Information Profile (HIP) checks to every remote connection.

---

GlobalProtect Architecture: Portals vs. Gateways

GlobalProtect separates administrative management from data plane tunnel termination through two primary software roles:

GlobalProtect Portal

The Portal serves as the central management and configuration hub for remote endpoints. When a GlobalProtect client app attempts to connect, it first reaches out to the Portal URL/FQDN.

• Client Configuration Delivery: The Portal authenticates the user and delivers a customized XML configuration containing gateway lists, connection rules, split-tunneling policies, certificate requirements, and app behavior settings.
• Software Distribution: The Portal hosts and distributes GlobalProtect app installation packages for Windows (.msi), macOS (.pkg), Linux, iOS, and Android. It can automatically prompt end users to upgrade client software when a new version is published.
• Server Certificate Validation: The Portal presents an X.509 server certificate (issued by a trusted public or enterprise CA) to prove its identity to the client app before delivering configuration payloads.
• Dynamic Gateway Selection: The Portal provides the client app with a prioritized list of external and internal Gateways. The client app performs latency probes (measuring response time and workload) to dynamically connect to the optimal Gateway.

GlobalProtect Gateway

The Gateway handles tunnel termination, traffic encryption, and security policy enforcement. Gateways reside on interfaces assigned to dedicated remote access security zones (e.g., GP-Remote-Zone).

• Tunnel Termination: Supports both IPsec (ESP) for high-performance transport and SSL/TLS as an automatic fallback if network firewalls or ISPs block IPsec traffic (UDP 500 / UDP 4500).
• Virtual Interfaces and IP Pools: Each Gateway is bound to a virtual tunnel interface (e.g., tunnel.1). Upon connection, the Gateway assigns an IPv4 or IPv6 address to the remote endpoint from a configured IP Netpool.
• Security Policy Enforcement: Traffic exiting the tunnel.1 interface into the firewall data plane is subjected to standard PAN-OS Security Policy rules, Antivirus, Vulnerability Protection, WildFire, and App-ID inspection.

---

Split Tunneling Configurations

To optimize bandwidth and reduce latency, GlobalProtect supports granular Split Tunneling policies. Administrators can configure split tunneling based on multiple criteria:

---

Authentication Profiles, SAML 2.0, and MFA Integration

GlobalProtect supports flexible authentication architectures, allowing organizations to leverage modern cloud Identity Providers (IdPs) and enforce Multi-Factor Authentication (MFA).

SAML 2.0 Integration

Security Assertion Markup Language (SAML 2.0) is the gold standard for GlobalProtect authentication. Integrating with cloud IdPs such as Microsoft Entra ID, Okta, Ping Identity, or Google Workspace delivers single sign-on (SSO) and centralized identity management.

• Embedded Browser Support: The GlobalProtect app utilizes an embedded browser or system browser to display the IdP's native login page, supporting Passwordless authentication, FIDO2 WebAuthn keys, and custom branding.
• Single Sign-On (SSO): Users authenticate once with their corporate cloud credentials, receiving a SAML assertion that grants access to both the Portal and Gateway without repetitive password prompts.

Multi-Factor Authentication (MFA)

PAN-OS supports MFA enforcement through multiple authentication workflows:

• Cloud IdP Native MFA: Managed directly within the SAML workflow (e.g., Entra ID Conditional Access triggering Microsoft Authenticator push notifications).
• RADIUS Challenge/Response: Integrating with legacy MFA solutions (such as RSA SecurID or Duo Authentication Proxy) via RADIUS vendor-specific attributes (VSAs).
• PAN-OS Native MFA Profiles: Linking an Authentication Profile to an MFA Vendor object (Duo, Okta, PingID) to trigger out-of-band push authentication during step-up security events.

---

Always-On vs. On-Demand VPN Modes and Internal Host Detection

GlobalProtect offers customizable connection methods depending on endpoint ownership and compliance requirements:

Connection Modes

• On-Demand Mode: The user manually initiates the VPN connection by clicking "Connect" in the GlobalProtect app. Ideal for unmanaged endpoints, contractors, or BYOD scenarios.
• Always-On Mode: The GlobalProtect app automatically establishes a tunnel whenever an internet connection is detected. End users cannot disconnect or disable the app, ensuring all remote traffic is inspected by corporate security policies.

Pre-Logon vs. User-Logon

In an Always-On deployment, securing the endpoint before user login is critical:

1. Pre-Logon Mode: Before a user logs into Windows or macOS, the GlobalProtect app uses a Machine Certificate (issued to the device by corporate PKI) to establish a secure tunnel to the Gateway. This grants the computer network access to execute domain logon scripts, process Active Directory Group Policies (GPO), and receive software updates.
2. User-Logon Transition: As soon as the user logs in, GlobalProtect seamlessly transitions the tunnel from Pre-Logon (machine certificate) to User-Logon (user credentials/SAML), applying the individual user's specific security policies without dropping network connectivity.

Internal Host Detection (IHD)

To prevent corporate laptops connected directly to the internal office LAN from establishing unnecessary, redundant VPN tunnels back to the firewall, GlobalProtect uses Internal Host Detection (IHD).

• When an endpoint connects to a network, the GlobalProtect client performs a DNS lookup probe (resolving a specific internal domain name) or an HTTP/HTTPS probe to an internal IP address hosted by an internal detection server.
• If the probe succeeds (proving the endpoint is physically inside the corporate network), GlobalProtect suppresses tunnel creation and switches to "Internal" status. If the probe fails, GlobalProtect immediately initiates a tunnel connection to an external Gateway.