Global Protect Integration with Azure SAML w/ Multiple Gateways

[DJ_1924]

I'm trying to setup an integration with 2 firewalls at different locations.  The portal and 1 gateway reside on 1 of the firewalls, and i've used this:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g0000008U48CAE

to get that going successfully.  The 2nd firewall, which has a certificate w/ a different FQDN, doesn't allow users to connect.  My thinking was I needed to create a 2nd enterprise application using the 2nd FQDN or is that not necessarily?

[TeemuH]

Yeah sounds like the second enterprise application is exactly what you need since you are going to have a different SAML configuration for the other FQDN

[Claw4609]

Hello,

What error are you getting when users are trying to connect? You are able to use the same SAML Azure App for multiple GlobalProtect gateways, you just need to add the additional gateways under the Basic SAML configuration urls settings in the Azure app. And have the SAML metadata imported on the gateway firewall. 

[zGomez]

Like Claw is saying you just need to add your additonal gateways in your Azure Entra Global Protec single sign on settings.

Identifier (Entity ID)

And the 

Reply URL (Assertion Consumer Service URL)

Should contain you gateway url's.

Example config for prisma access mobile user gateways can be found on : (your's is similar but then for your own gateways)

Configure Mobile Users without Cloud Identity Engine (paloaltonetworks.com).