geoblock on palo alto

The FW needs to see the IP before geoblock can be applied 

under monitor > logs > GlobalProtect

( stage eq 'login' ) and ( status eq 'success' )

Also

Network > Gateways, click on the "Remote Users" link on the right

There is also the option to create the NAT for the GP IP only for the geo locations allowed

Have a general security rules with geoblock to/from any deny

Have a security rule to allow access to the GP IP only from the approved countries

Set the countries up in the GP config (portal / gateway)

Config the geoblock on any 2FA you might be using for 2FA as well as another line of defence

Enable the palo EDL blocks and dynamic threats etc, strict IPS

***

GP allow initial connections IP connections 

can geoblock here IE (but be careful about your S2S VPNs, maybe make a rule to all S2S peer IPs) 

outside > OUTSIDE 

D:x.x.x.x (GP public IP)

UDP 500

UDP 4500

UDP 4501

GP allow IE users

outside to outside

D:x.x.x.x (GP public IP)

apps

ike

ipsec-esp

ipsec-espudp

panos-global-protect

ssl

web-browsing

Block everything else

outside to outside

D:x.x.x.x (GP public IP)

any any deny

palo alto mtu

 https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-new-features/new-features-released-in-gp-app/configurable-maximum-transmission-unit-for-globalprotect-connections

You get prompted twice for GlobalProtect with MFA/2FA on palo alto firewall

The usual fix is to put

portal auth > AD 

gateway auth > MFA server

However we found with some OTP/fob code users it wasn't working well

Fix was 

Upgrade GP to preferred release (6.2.3 a time of writing)

Enable the authentication cookie settings on GP

Portal > Agent - Generate cookie for auth override

Choose the same cert you use for the GP 

Gateway > Agent > Client Settings > clock settings > Authenticaiton Override tab

tick Accept cookie for auth override

Choose the same cert you used in portal

Push policy

Watch out for any AD changes may take 15 mins to update on the palo so if you move a user into another group for testing it might not work for 15 minutes

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004MACCA2&lang=en_US%E2%80%A9&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

issue importing or renewing cert on palo alto firewall

Replacing/renew an existing wildcard cert

You need the .pfx cert with private key bundle

cert password

name the new cert "cert_name_of_existing_cert" or something new "cert_may_2026"

In palo select the cert

click import

choose pkcs12, choose the .pfx file

enter the password

import and commit

Don't forget update the SSL profile (a bit below certs) with the new cert 

Test the GP web interface

When trying to import a cert with the private key bundled you get an error:

Import of certificate and private-key CERT-NAME failed. private key doesn't exist for csr.

Importing the signed cert with the same name as the CSR doesn't work. Panorama adds cert_ to the front of the name

You need to port cert_ in front for example if cert is called CERT-NAME you put cert_CERT-NAME

CSR import

Import the CA bundle if not done already

If you make duplicates will have to delete on CLI

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000kHyVCAU&lang=en_US%E2%80%A9

tick your pending CSR

click import 

give the same name as your csr request 

select the pem file

PEM file format

ok

commit

Importing SAML cert

Create new cert and make it active 

Delete old/inactive cert

Wait a few minutes for cloud to do its thing

Download the .xml files

In palo delete old certs and commit

Going into SAML IDP provider

Import 

Untick validate checkbox

This will import the cert and create a saml profile

User your new saml profile in your auth sequence 

Test connection to GP etc

install wildcard cert on palo alto firewall

Global protect portal and gateway should be setup

Get customer to get DNS record created eg globalprotect.domain.com

Point the record at the global portect portal IP (Network -> Global Protect -> Portals)

Download the wildcard cert and root/chain cert from the cert vendor (.crt format). The windows .p7b format is no good. The chain bundle cert usually publicly available. The wildcard will need to be downloaded via a login may need to get it from the customer.

Install wildcard cert on palo alto firewall

Global protect portal and gateway should be setup

Get customer to get DNS record created eg globalprotect.domain.com

Point the record at the global portect portal IP (Network -> Global Protect -> Portals)

Download the wildcard cert and root/chain cert from the cert vendor (.crt format). The windows .p7b format is no good. The chain bundle cert usually publicly available. The wildcard will need to be downloaded via a login may need to get it from the customer. Example vendor chain location:

https://certs.godaddy.com/repository

Import vendor root/chain cert bundle

Device -> certificate management -> certificates 

Click import 

Give name eg "vendor-ca-root-chain-bundle"

Select the bundle file "bundle-g2.crt"

Leave everything else and click ok

Import wildcard cert

This can be imported in a few methods (.crt) (.pfx) if its PFX you will need to include the password

Certs should look like this

 

Create SSL/TLS profile

Device -> Certificate Management -> SSL/TLS Service Profile

Name "SSL-TLS-PROFILE"

Min version: TLSv1.2

Max version: Max

Attach SSL/TLS profile to global protect portal and GW

Network -> GlobalProtect -> Portals 

Click the GP_Portal

Authentication tab 

Under server authenticaiton / SSL/TLS service profile

Select your "SSL-TLS-PROFILE" from the drop down

Configure the URL used for portal/gateway in the portal

Network -> GlobalProtect -> Portals

Click the GP_Portal

Agent 

Add the CA root and chain cert (optional to tick install in root cert store)

 

Now click on GP_Agent_Config -> External

You will need a DNS -> pub IP record setup with the external DNS vendor

Fill in the DNS name for the Gateway

 

Add the SSL-TLS profile to the gateway as well

Network -> GlobalProtect -> Gateways

Click the GP_Gateway

Authentication tab

Under server authenticaiton / SSL/TLS service profile

Select your "SSL-TLS-PROFILE" from the drop down

Change IP to URL

Go Portal - GP settings - Agent - Agent config - External

Change external gateway IP to URL

Testing

Do not forget to commit your changes

You may need to restart the GP client

Test web browse to https://globalprotect.domain.com

Test connecting the GP client to globalprotect.domain.com