Palo Alto Global Protect Remote Access VPN
GlobalProtect Remote Access VPN is a secure network solution by Palo Alto that enables users to connect to a private network from a remote location over the internet.
Network Topology
Here’s the connection topology, where PC on the internet will become the VPN client to connect to the inside network
Configuring Global Protect Portal
Setting up VPN Users
For VPN Users, here we’ll use locally stored users, On Device » Local User Database, add new
Then on User Groups, add new and include the user
Configuring Authentication Profile
On Device » Authentication Profile, add new
add the newly created group
Configuring Certificate
On Device » Certificate, generate new certificate
Then sign the CSR on the CA Server
Then import the certificate right back
Configuring SSL/TLS Service Profile
On Device » SSL/TLS Service Profile, add new, select the newly created certificate
Configuring Global Protect Portal
On Network » Global Protect » Portals, add new
select the Outside Interface
select the SSL Service Profile and Authentication Profile made earlier
And that should do it. Commit the changes
Accessing the Global Protect Portal
Now accessing the outside IP, we should be greeted with the Global Protect Portal
Configuring Global Protect Gateway
Creating a Tunnel Interface
On Network » Interfaces » Tunnel, add new
Creating a Zone
On Network » Zones, add new VPN Zone, attach it to Tunnel Interface and enable User ID ACL
Make sure to have a policy allowing traffic from VPN Zone
Configuring the Gateway
On Network » Global Protect » Gateways, add new
Give it a name and attach to the outside interface
select the SSL Service Profile and Authentication Profile made earlier
On Agent, enable Tunnel Mode and select the tunnel interface
On here, just allow any
Define the IP Pool for the VPN Clients
On Split Tunnel, include the inside network that will be accessible from VPN
Configuring Agent on Global Protect Portal
On Network » Global Protect » Portals, select the Portal and open the Agents
Select add
On Authentication, Give it a name
On External, fill in the outside IP Address
Back on Agent, add the Trusted Root CA and fill in the override key
That should be all. Commit the changes.
Connecting VPN from Client PC
Now on the client pc, on Global Protect, enter the VPN gateway
Enter username and password
And we should be connected!
On Troubleshooting » Advanced, we can see the inside routes being advertised here
And pinging the inside network shows that the connection is up and running
Back to Palo Alto, on Monitor » Global Protect, we can see the VPN activities
And peeking at the traffic, we can also see the traffic coming from Zone VPN to Inside
