Global Protect some questions

[myasin]

Hi

I have PA-3050 Cluster and will configure SSL-VPN for remote users "without licenses installed", so I have a couple of questions on Global Protect;

1- How many users can connect through SSL-VPN on this device?

2- Can we connect SSL-VPN over mobile phones using the same configuration required for remote users (gateways and portal), or there is special settings for mobiles?

3- Can we distribute the agent manually or automatically to clients (rather than connecting to portal)?

4- Now and per to my understanding, once global protect configured the HTTPS access to PA external IP will be used for global-protect, so how can we access firewall remotely through HTTPS after global protect configuration?

Thanks

Myasin 

[kiwi · Accepted solution]

Hi @myasin,

Please check the comparison page to verify how many tunnels your specific model can handle :

https://www.paloaltonetworks.com/products/product-comparison.html?chosen=pa-3050

There are several ways to deploy the software in your network (directly from the portal, from a web server, transparently from the command line, using group policy rules).  Check out the following link for more details :

https://www.paloaltonetworks.com/documentation/62/globalprotect/globalprotect-admin-guide/set-up-the...

I strongly advise not to manage your firewall through the external IP but you can access as explained here :

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Access-the-WebGUI-when-GlobalProtect...

Cheers,

-Kiwi.

[BPry · Accepted solution]

@myasin,

1- The 3050 supports up to 2,000 SSL-VPN users on one PA-3050.

2- You would be able to if you were licensed, non-licensed units can not connect mobile phones or tablets via the GlobalProtect client.

3- You can distribute the GlobalProtect application however you like, very similar to AnyConnect in that regard.

4- How do you currently manage your firewall, hopefully not by connecting to the public IP address? Regardless with the right configuration even that would work, but usually you would configure mangement access on one of the interfaces interal to your network, or preforably on the management port. As long as you have allowed access via your GlobalProtect IP range you can access the firewall management while connected to GlobalProtect. From a security aspect I would highly recommend you review the policies however so that only those of you that rightfully need access to the management features can even get to the login page.  

[myasin]

Thank you both for your reply...

2- You would be able to if you were licensed, non-licensed units can not connect mobile phones or tablets via the GlobalProtect client.

(what type of license I need to use global protect over mobiles?

 And if I got the license, is there a need for special configuration for mobiles?)

3- You can distribute the GlobalProtect application however you like, very similar to AnyConnect in that regard.

(How I can get .exe and .msi copy of global-protect from portal?)

Thanks

Myasin

[kiwi]

Hi,

You can download the msi or pkg once you log into the portal using a web-browser.

Note that the portal does not distrubite the GlobalProtect app for use on mobile devices.  To get the app, end users must download it from the app hosting site for the device (App Store, Google Play, Chrome Web Store).

You can follow this guide to configure GlobalProtect on your firewall :

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-GlobalProtect/ta-p/5835...

As for licenses I recommend that you reach out to your local sales contact.

As per this DOC you'll be needing the Gateway Subscription :

https://www.paloaltonetworks.com/documentation/61/globalprotect/globalprotect-admin-guide/globalprot...

Cheers !

-Kiwi.