IP Validation for GlobalProtect Public IP

[yancheen.wong]

Hi All,

We are currently attempting to complete GlobalSign IP address validation for our GlobalProtect public IP address.

GlobalSign's validation process requires access to a challenge file under:

/.well-known/pki-validation/

However, our understanding is that Palo Alto does not normally host files under this path.

In addition, HTTP validation via port 80 has not been successful, as requests are redirected to HTTPS (port 443).

Could you please advise the recommended approach for completing GlobalSign IP validation in a GlobalProtect environment?

Specifically:

• Is it possible to host or serve the validation file from the GlobalProtect portal/gateway?
• If not, what is the recommended approach to make the validation file accessible?
• Would a NAT or redirection to an internal web server be required?
• Is the SSL Decryption Opt-out feature relevant to this validation scenario?

Any guidance would be greatly appreciated.

Thank you.

[Raido_Rattameister]

GlobalProtect port 80 redirects to 443 and is not needed for GlobalProtect VPN agent so you can safely DNAT port 80 to internal web server where you can host required file.

[yancheen.wong]

Hi, thanks for the reply! Is there any guide or article available that explains how to disable redirects from port 80 to 443? 

[Raido_Rattameister]

Nothing to disable.

Just DNAT public IP port 80 to internal web server IP and redirect is bypassed.