Remote Access VPN with GlobalProtect

Remote Access VPN is a technology that allows a user outside the office to connect securely to their company’s private network over the public internet. Think of the public internet as a busy city street. Without a VPN, any data you send is like shouting your credit card number across that street — everyone can hear it. A VPN wraps your data in a secure, encrypted envelope so that only the intended recipient can open it. GlobalProtect is Palo Alto Networks’ specific implementation of this technology.

At the heart of GlobalProtect are two main components: the portal and the gateway. The GlobalProtect Portal is the first point of contact for a remote user. When you install the GlobalProtect app on your laptop and open it, the app reaches out to the portal. The portal acts like a receptionist. It authenticates you (verifies who you are, usually with a username and password), and then it tells your app which GlobalProtect Gateway to connect to. The GlobalProtect Gateway is the actual tunnel endpoint. It sits on the edge of your network, usually on a Palo Alto Networks firewall. Once the app connects to the gateway, the gateway creates an encrypted tunnel back to the user’s device. All the user’s traffic that is destined for the corporate network is then sent through this tunnel, encrypted, to the gateway, which decrypts it and forwards it to the internal resources.

Why do we need two separate things (portal and gateway)? Because it allows flexibility. You might have multiple gateways in different offices around the world. The portal can direct a user in London to the London gateway for the fastest connection, while a user in Sydney connects to the Sydney gateway. This split also improves security: the portal only handles the initial handshake, while the gateway handles the heavy lifting of encrypting and decrypting traffic.

When a user connects, several things happen in order. First, the GlobalProtect app on the device sends a request to the portal’s IP address (which is usually a public address, so reachable from anywhere). The portal presents a certificate — a digital ID card — to prove it is legitimate. The app checks that certificate against a trusted authority (like a company’s internal certificate authority or a public one like DigiCert). If the certificate is valid, the user is asked for their credentials (username and password, sometimes plus a second factor like a code from a phone app). The portal verifies these against the corporate directory (often Microsoft Entra ID or an LDAP server). Once verified, the portal sends the app a configuration file that includes the gateway addresses. The app then initiates a new connection directly to the gateway, again using certificate validation and credentials. The gateway assigns an IP address to the user’s device from a pool of internal IP addresses. This makes the remote device look like it is actually inside the corporate network. The tunnel is now established using IPSec (Internet Protocol Security) or SSL/TLS (Secure Sockets Layer / Transport Layer Security).

What does this replace? Before widespread VPNs, companies either used expensive leased lines (dedicated physical cables) to connect remote offices, or they relied on dial-up modems where users would literally call a phone number to connect. Neither was scalable for many remote workers. Modern VPNs like GlobalProtect replaced those old methods with a software-based, on-demand connection that works over any internet connection.

Key terms to understand in this topic include:

There are also different modes of operation. In tunnel mode, all the user’s traffic (including internet-bound traffic) can be sent through the tunnel and inspected by the firewall. This is useful if you want to enforce security policies on all traffic, even when the user is at home. In split-tunnel mode, only traffic destined for the corporate network goes through the tunnel; all other traffic goes directly to the internet. Split-tunnel saves bandwidth but reduces the firewall’s ability to inspect non-corporate traffic.

An IT administrator at a mid-sized company called ‘Acme Corp’ is setting up GlobalProtect for 500 remote employees. Many of these employees work from home, from coffee shops, or while travelling. The administrator needs to ensure that these employees can access internal applications like the company’s accounting software (which runs on a server in the office) and the internal wiki, without exposing those applications to the public internet.

Step by step, the administrator does the following. First, they configure a GlobalProtect portal on the Palo Alto Networks firewall at headquarters. They create a portal configuration that specifies the authentication method — in this case, using Microsoft Entra ID as the identity provider. They enable certificate authentication so that the portal can validate the client devices. Next, they configure a GlobalProtect gateway on the same firewall (or a separate one). The gateway is assigned an IP address pool (e.g., 10.10.100.1 to 10.10.100.255) which will be handed out to remote users. They also set up routing rules so that traffic coming from the gateway destined for the internal network is allowed through the firewall.

Then the administrator creates security policies on the firewall. One policy allows traffic from the gateway to the accounting server on port 443 (HTTPS). Another policy blocks all other traffic from the gateway to the rest of the internal network, preventing a compromised remote device from doing damage. They also enable logging on these policies so they can see who connected and when.

On the employee side, the administrator distributes a GlobalProtect installer via the company’s software management tool. The first time an employee opens the app, they type in the portal address (e.g., vpn.acmecorp.com). The app downloads its configuration from the portal. The employee enters their Microsoft Entra ID username and password, and approves a multi-factor authentication prompt on their phone. The app then connects to the gateway. The employee can now open the company’s internal wiki by typing its internal URL into their browser.

Common troubleshooting steps the administrator performs include:

The administrator also regularly updates the GlobalProtect app and the firewall software to patch vulnerabilities. They monitor the number of concurrent connections and may add more gateways in different geographic regions to reduce latency.