Palo Alto Firewall- GlobalProtect (SSL VPN)

What is GlobalProtect (SSL VPN)?

GlobalProtect is Palo Alto’s remote access VPN solution that allows users to securely connect to an internal corporate network over the internet using SSL/TLS encryption.

Think of it like:
“A secure tunnel from your laptop/mobile to the company network.”

Why SSL VPN (GlobalProtect) is Needed
Without VPN?
Public WiFi = High risk
Data can be intercepted
Internal servers are not accessible

With GlobalProtect:
Encrypted tunnel
User authentication
Access control
Company security policies enforced

Real-World Example (Easy to Understand)
Scenario:
A company has:
Internal server: 10.10.X.X (HR portal)
Palo Alto Firewall public IP: 50.Y.Y.Y
Employee Akash working from home

🔹 Step 1: User Connects to GlobalProtect
Akash opens GlobalProtect client and connects to:
👉 abc.example.com
Firewall authenticates via:
Active Directory / LDAP
RADIUS
SAML (Azure AD, Okta)
Certificates

🔹 Step 2: Tunnel is Created
After login:
Akash gets VPN IP: 10.20.X.X
Encrypted SSL tunnel is established

🔹 Step 3: User Access Internal Server
Akash opens HR portal:
👉 http://10.10.X.X

Traffic flow:
Laptop (10.20.X.X)
↓ SSL Tunnel
Palo Alto Firewall
↓ Internal Network
HR Server (10.10.X.X)
Firewall policies control what Akash can access.

⚙️ Key Components of GlobalProtect
1️⃣ GlobalProtect Portal
First connection point
Handles authentication & client config
Example: abc.example.com

2️⃣ GlobalProtect Gateway
Actual VPN tunnel endpoint
Assigns IPs to users
Example: abc.example.com

3️⃣ GlobalProtect Client
Installed on Laptop/Mobile
Creates secure tunnel

🔑 Types of GlobalProtect VPN
✅ Client-Based VPN
User installs GP client
Used for employees

✅ Clientless VPN
Browser-based access
Used for vendors/partners

🔄 Split Tunnel vs Full Tunnel
🔹 Split Tunnel
Only corporate traffic goes via VPN
Internet traffic goes directly

🔹 Full Tunnel
All traffic goes via company firewall
Used for high-security environments

🛡️ Security Features
✔ Multi-Factor Authentication (MFA)
✔ HIP Checks (Device posture checks)
✔ User-ID based policies
✔ Zone-based security
✔ Threat Prevention (IPS, Antivirus, WildFire)

🎯 Typical Real Production Use Cases
Work From Home employees
Branch engineers accessing DC
Third-party vendors accessing specific servers
Secure admin access to routers/firewalls
Cloud access (AWS, Azure private networks)