IP Validation for GlobalProtect Public IP

[yancheen.wong]

Hi All,

We are currently attempting to complete GlobalSign IP address validation for our GlobalProtect public IP address.

GlobalSign's validation process requires access to a challenge file under:

/.well-known/pki-validation/

However, our understanding is that Palo Alto does not normally host files under this path.

In addition, HTTP validation via port 80 has not been successful, as requests are redirected to HTTPS (port 443).

Could you please advise the recommended approach for completing GlobalSign IP validation in a GlobalProtect environment?

Specifically:

• Is it possible to host or serve the validation file from the GlobalProtect portal/gateway?
• If not, what is the recommended approach to make the validation file accessible?
• Would a NAT or redirection to an internal web server be required?
• Is the SSL Decryption Opt-out feature relevant to this validation scenario?

Any guidance would be greatly appreciated.

Thank you.