GlobalProtect

https://docs.paloaltonetworks.com/globalprotect
Admin
GlobalProtect is a Palo Alto Networks VPN solution that secures mobile and remote workforces using...
Tokens:17,582
Snippets:292
Trust Score:10
Update:3 months ago
Show doc for...
Tokens:
Raw
### Enable FIPS-CC Mode via MSI Installer

Source: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/certifications/enable-and-verify-fips-cc-mode/enable-fips-cc-mode-using-the-windows-registry

Use the msiexec command to enable FIPS-CC mode during the GlobalProtect installation process.

```bash
msiexec /i GlobalProtect64.msi ENABLEFIPSCCMODE=YES
```

--------------------------------

### Deploy GlobalProtect with Intelligent Portal via Command Line

Source: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-portals/configure-intelligent-portal

Use the msiexec command during a fresh installation to define the portal country map.

```bash
msiexec.exe /i "GlobalProtect64.msi" PORTALCOUNTRYMAP="portal1_address(country1_code);portal_2_address(country2_code"
```

```bash
msiexec.exe /i "GlobalProtect64.msi" PORTALCOUNTRYMAP="xxx.com(US);yyy.com(CN)"
```

--------------------------------

### Predeploy PIV-profile via Windows Installer

Source: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-user-authentication/set-up-two-factor-authentication/enable-two-factor-authentication-using-smart-cards/enhancements-for-authentication-using-smart-cards-authentication-fallback

Use this command-line syntax to set the PIVPROFILE registry value during the GlobalProtect MSI installation.

```bash
msiexec.exe / globalprotect64.msi /i PIVPROFILE=yes
```

--------------------------------

### Configure Intelligent Portal via Windows Registry

Source: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-portals/configure-intelligent-portal

Add these keys to the Windows Registry to enable intelligent portal features on existing installations.

```batch
REG ADD "HKLM\Software\Palo Alto Networks\GlobalProtect\Settings" /v portal-country-map /t REG_SZ /d portal_1(country1_code);portal_2(country2_code)
```

```batch
REG ADD "HKLM\Software\Palo Alto Networks\GlobalProtect\Settings" /v intelligent-portal /t REG_SZ /d yes
```

```batch
REG ADD "HKLM\Software\Palo Alto Networks\GlobalProtect\Settings" /v intelligent-portal-service /t REG_SZ /d "geoip.gpcloudservice.com/getIPLocation"
```

--------------------------------

### Bypass SSO Hub Page via Registry Key

Source: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-user-authentication/embedded-web-view-with-cie-for-force-authentication

Use this msiexec command during installation to pre-deploy the CASSKIPHUBPAGE registry key, allowing users to bypass the SSO hub page on Windows endpoints.

```Shell
msiexec.exe /i globalprotect64.msi CASSKIPHUBPAGE=yes
```

--------------------------------

### Configure Custom SAML Port via CLI

Source: https://docs.paloaltonetworks.com/globalprotect/administration/globalprotect-user-authentication/set-up-external-authentication/set-up-saml-authentication/saml-authentication-for-globalprotect-portals-on-non-standard-ports

Use these commands to set the custom port on the firewall and verify the configuration.

```bash
set global-protect saml-custom-port <1-65535>
```

```bash
show gp-broker panos-config
```

--------------------------------

### Configure Intelligent Portal via macOS Plist

Source: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-portals/configure-intelligent-portal

Add these keys to the GlobalProtect settings plist file on macOS.

```xml
<key>intelligent-portal</key>
<string>yes</string>
<key>portal-country-map</key>
<string>portal1_address(country1_code);portal2_address(country2_code)</string>
<key>intelligent-portal-service</key>
<string>geoip.gpcloudservice.com/getIPLocation</string>
```

--------------------------------

### Configure FIPS-CC Mode in pangps.xml

Source: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/certifications/enable-and-verify-fips-cc-mode/enable-fips-cc-mode-on-linux-endpoints-redhat

Add the enable-fips-cc-mode setting to the GlobalProtect pre-deployment configuration file located at /opt/paloaltonetworks/globalprotect.

```xml
<?xml version="x.x" encoding="UTF-8"?><GlobalProtect>
         <Settings>
			    <enable-fips-cc-mode>yes</enable-fips-cc-mode>
 	               <disable-globalprotect>0</disable-globalprotect>
         </Settings>
```

--------------------------------

### Predeploy Custom Authentication Keys

Source: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-user-authentication/set-up-two-factor-authentication/enable-two-factor-authentication-using-smart-cards/enhancements-for-authentication-using-smart-cards-authentication-fallback

Use these keys to define the custom strings for PIV and non-PIV authentication profiles in the GlobalProtect plist.

```xml
<key>PIVString</key>
<key>noPIVString</key>
```

--------------------------------

### Enable Embedded Browser for CIE Authentication

Source: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-user-authentication/embedded-web-view-with-cie-for-force-authentication

Execute this command in the CLI to enable the embedded browser feature for Cloud Identity Engine authentication.

```CLI
set global-protect embedded-browser-cas enable
```

--------------------------------

### Restart GlobalProtect Services

Source: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/certifications/enable-and-verify-fips-cc-mode/enable-fips-cc-mode-using-the-macos-property-list

Use these terminal commands to unload and reload the GlobalProtect launch agents to initialize FIPS-CC mode.

```bash
username>$ launchctl unload -S Aqua
/Library/LaunchAgents/com.paloaltonetworks.gp.pangpa.plist     
username>$ launchctl unload -S Aqua
/Library/LaunchAgents/com.paloaltonetworks.gp.pangps.plist
username>$ launchctl load -S Aqua 
/Library/LaunchAgents/com.paloaltonetworks.gp.pangps.plist
username>$ launchctl load -S Aqua
/Library/LaunchAgents/com.paloaltonetworks.gp.pangpa.plist
```

--------------------------------

### Enable FIPS-CC Mode in Property List

Source: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/certifications/enable-and-verify-fips-cc-mode/enable-fips-cc-mode-using-the-macos-property-list

Add this key-value pair to the GlobalProtect Settings dictionary in the plist file to enable FIPS-CC mode.

```xml
<key>enable-fips-cc-mode</key>
<string>yes</string>
```
Tokens:
Raw