topic Re: IP Validation for GlobalProtect Public IP in GlobalProtect Discussions

IP Validation for GlobalProtect Public IP

yancheen.wong — Mon, 03 Aug 2026 01:57:13 GMT

Hi All,

We are currently attempting to complete GlobalSign IP address validation for our GlobalProtect public IP address.

GlobalSign's validation process requires access to a challenge file under:

/.well-known/pki-validation/

However, our understanding is that Palo Alto does not normally host files under this path.

In addition, HTTP validation via port 80 has not been successful, as requests are redirected to HTTPS (port 443).

Could you please advise the recommended approach for completing GlobalSign IP validation in a GlobalProtect environment?

Specifically:

Is it possible to host or serve the validation file from the GlobalProtect portal/gateway?
If not, what is the recommended approach to make the validation file accessible?
Would a NAT or redirection to an internal web server be required?
Is the SSL Decryption Opt-out feature relevant to this validation scenario?

Any guidance would be greatly appreciated.

Thank you.

Re: IP Validation for GlobalProtect Public IP

Raido_Rattameister — Tue, 04 Aug 2026 17:28:45 GMT

GlobalProtect port 80 redirects to 443 and is not needed for GlobalProtect VPN agent so you can safely DNAT port 80 to internal web server where you can host required file.

Re: IP Validation for GlobalProtect Public IP

yancheen.wong — Wed, 05 Aug 2026 00:23:04 GMT

Hi, thanks for the reply! Is there any guide or article available that explains how to disable redirects from port 80 to 443?

Re: IP Validation for GlobalProtect Public IP

Raido_Rattameister — Wed, 05 Aug 2026 09:26:48 GMT

Nothing to disable.

Just DNAT public IP port 80 to internal web server IP and redirect is bypassed.