Looking for documentation on how to set up an internal GP gateway for User-ID

[inSync-MarkValpreda]

This is a PA environment I have inherited and I don't have a PA background, most everything was already set up....I just maintain security rules, NAT, etc....basic stuff. 

Been having quite a time with our Macs and User-ID through Active Directory and using the App-ID Agent on a server. After a few cases and frustrated users, think we need to pivot to an internal GP gateway for user ID. 

I don't know if I should take my existing GP portal that is set on a loopback address to include internal detection, or set up a new one with my LAN interface? Do I need to set my GP DNS name internally to point to an IP on my PA-1410? How do I make this seamless to the users so they don't have to log into GP client on their machine? 

In looking at some links on here as well as through other searches, I didn't find anything that really jumped out at me that matches what we are trying to accomplish. I'm hoping that someone can nudge me in the right direction.

[JayGolf]

Hi @inSync-MarkValpreda ,

You typically do not need a separate portal. The existing portal can provide the GP client config, including internal host detection and the internal gateway. The internal gateway can be on an internal interface or loopback, as long as the FQDN resolves internally to that firewall IP and the gateway certificate matches the name users connect to.

To make this seamless, configure the GP app for User-Logon / Always On so the client can automatically detect whether it is internal or external and connect accordingly. For User-ID only, the internal gateway can be configured without tunneling user traffic.

I would recommend reviewing these docs first:

GlobalProtect for Internal HIP Checking and User-Based Access

Global Protect Internal Host Detection & Internal Gateways - Packetswitch

Hope this helps! and please let us know how it goes or if anything comes up.