topic Set up a test Internal Gateway for User-ID logging in GlobalProtect Discussions

Set up a test Internal Gateway for User-ID logging

R.Perez481389 — Mon, 13 Jul 2026 05:38:49 GMT

Hi everyone planning to set up an Internal Gateway so we can log User-ID and an internal host detection to automatically disable VPN when in the office. We are planning to set up an internal gateway strictly for a test OU to ensure that the changes we make won't disrupt the business. I set up a loopback address from a reservered dhcp(we use Palo as our dhcp server), and pretty much copied the settings from our External gateway bar the tunnel settings in the Internal Gateway.

Under config selection criteria, do we just add in the test ou?

Afterwards, under the Portal tab, should I make a new Agent? Or can i just add it to our existing agent(Which has the external gw) configuration and add in an internal host detection and the gateway that i created?

We only want to that specific OU to use the Internal Gateway for now just in case we make a mistake and there's internet issues. While people who are't in that OU won't be affected.

Re: Set up a test Internal Gateway for User-ID logging

reaper — Tue, 14 Jul 2026 02:40:58 GMT

If your portal config does not have an OU set, i'd go with a copy of the portal's agent config that contains the OU.

Place that new agent config at the top, and then configure the 'internal' tab with your internal host detection and internal gateway ip/fqdn. That way you can test it without impacting 'production' until you're ready to roll it out (else all your users will get the internal gateway config but will not be allowed to connect because of the OU on the gateway agent config)

on the internal gateway, disable the 'tunnel mode' option and then create a client settings config containing the OU

that'll do the trick

Re: Set up a test Internal Gateway for User-ID logging

R.Perez481389 — Tue, 14 Jul 2026 07:03:25 GMT

Hi Tom, thanks for the guide. To avoid a full split-brain DNS scenario and prevent our users from losing routing to our external Cloudflare records, would you recommend we just create a pinpoint Forward Lookup Zone for the exact FQDN (e.g., gp-internal.domain.com)? Do i even need fqdn for this setup? Or can I just input the loopback IP address for both Internal host detection and Internal Gateway?