The PA-3020 in the co-location space (mentioned previously)
also doubles as a GlobalProtect gateway (the Santa Clara Gateway).
10 additional gateways are deployed in Amazon Web Services (AWS)
and the Microsoft Azure public cloud. The regions or POP locations
where these AWS and Azure gateways are deployed are based on the
distribution of employees across the globe.
Santa Clara Gateway—Employees and contractors can
authenticate to the Santa Clara Gateway (PA-3020 in the co-location
space) using 2FA. This gateway requires users to provide their Active
Directory credentials and their OTP. Because this gateway protects
sensitive resources, it is configured as a manual-only gateway.
As a result, users do not connect to this gateway automatically
and must manually choose to connect to this gateway. For example,
when users connect to AWS-Norcal, which is not a manual-only gateway,
some sensitive internal resources are not accessible. The user must then
manually switch to and authenticate with the Santa Clara Gateway
to access these resources.
In addition, the Santa Clara Gateway
is configured as a Large Scale VPN (LSVPN) tunnel termination point
for all satellite connections from gateways in AWS and Azure. The
Santa Clara Gateway is also configured to set up an Internet Protocol
Security (IPSec) tunnel to the IT firewall in corporate headquarters.
This is the tunnel that provides access to resources in the corporate headquarters.
Gateways in Amazon Web Services and Microsoft Azure—This
gateway requires 2FA: a client certificate and Active Directory credentials.
The GlobalProtect portal distributes the client certificate that
is required to authenticate with these gateways using the GlobalProtect
SCEP feature.
These gateways in the public cloud also act
as GlobalProtect satellites. They communicate with the GlobalProtect
portal, download the satellite configuration, and establish a site-to-site
tunnel with the Santa Clara Gateway. GlobalProtect satellites initially
authenticate using serial numbers, and subsequently authenticate
using certificates.
Gateways Inside Corporate Headquarters—Within the corporate
headquarters, three firewalls function as GlobalProtect gateways. These
are internal gateways that do not require endpoints to set up a
tunnel. Users authenticate to these gateways using their Active
Directory credentials. These internal gateways use GlobalProtect
to identify the User-ID and to collect the Host Information Profile
(HIP) from the endpoints.
To make the end
user experience as seamless as possible, you can configure these
internal gateways to authenticate users with certificates provisioned
by SCEP or with Kerberos service tickets.
