Configure GlobalProtect With Public IP adresse

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Configure GlobalProtect With Public IP adresse

L2 Linker



1-i have the router adsl with the public ip adresse : ex (WAN interface) ==> this is a Public/fixe IP adresse.

2-i have a paloAlto firwall, is connected by its wan interface ( to the local interface of the router adsl (


3-i follow this course to configure the GlobalProtect ( ==> this toturial is for configuring the (paloalto wan interface) as a portal and getway globalportal, it woking for me at this point.


Now what i need to know, is where i can configure the (WAN interface of adsl router) for the (globalprotect portal) and (globalprotect getway).


Cos my need, is to get access to my (local network) from (my home), and to do this, i must use my public adresse ip, then how i can configure it in the globalprotect plz ??


Thanks very much for help !!


L7 Applicator

Depending on your adsl router you ether need to setup NAT or port forwarding.


if it’s a basic adsl router then go for port forwarding to on port tcp 443.


on the palo alto your untrusted default gateway needs to be


your adsl documentation will advise on how to configure this.


your globalprotect tunnel will then run over ssl. If you want to use GP over ipsec or x-auth then you will need to add further port forwarding as above for udp 500 and udp 4501. But ssl 443 will work ok. 

Thank you very much for your replay brother!

ok let's say the  adresse of the portal is

if i configure the port forwarding to on port tcp 443

1-can i access the portal from the external by ?

2-also in the (globalprotect agent) in client machine, all i need, is to put the the in globalprotect agent ?


i asked this question cos i have a delay of 2hours before begin the configuring the adsl router


thanks a lot brother

1-can i access the portal from the external by ?

2-also in the (globalprotect agent) in client machine, all i need, is to put the the in globalprotect agent ?


Yes to both but you will of course experience certificate warnings.

And on the PA portal configuration you will need to change the gateway to 

Hello brother MickBall.

i get this msg error in the first picture, plz see in the second picture and tell me wich certificate i must run it on globalprotct portal/getway



first of all you are getting a 404 error on browser.

did you try https://41.137.99.xx/global-protect/getsoftwarepage.esp.


get this working first to make sure port forwarding is working correctly.

yes i did , but also doesn't work, i think i must run the certificate created for the 41.137.99.xx in glbalprotect portal/getway ??

forget about the certificate for now.


your port forwarding is not working correctly.


you will be able to connect to the web portal with a bad or no certificate if you accept the warning.




 get the browser working first, then worry about the certificate later.

Miclball, yes you are right, it was a port forwording problem, also a ceritificate problem, i configured the port forwording, and i run the adsl wan interface certificate on globalprotect Portal&getway (cos it gave a certificate error).

Now i can connect to my local network from the external, but i can't get access to the ressources.

exemple i cant ping to or



ok this could be for several reasons.


do you have a route on the PA to those networks you are trying to ping.

do you have a security policy that allows traffic from GP zone to internal networks zone.

do you have a route back from your pinged networks to your PA


maybe some more but just start with the above


thank you very brother you are the best 😘

it's working now

anyway i'll test some other config and lab if i need some help i'll contact you bro


Thanks a lot Mick

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!