Is this the best course of action if the user’s personal system is the one that is going to be connecting in.Ħ. Of course, this means that any system connecting to the GlobalProtect will need to have that internal CA installed as a certificate authority on your client’s machine ahead of time. If you are using your own internal certificate authority, then using that for your GlobalProtect client is an option to save some money instead of getting the certificate signed by an external CA. What certificate signing authority will the GlobalProtect client’s certificate be signed with? Will an external CSR be used, like GoDaddy or NameCheap, or will an internal certificate authority be used? If you’re granting them access to the entire server’s subnet, are there certain servers that you don’t want the users accessing remotely? Are there other resources that the users just don’t need access to from home - printers, etc.? If so, don’t allow access to those resources.ĥ. Look at the resources in the zone that you’re granting them access to. While granting access to a zone is very simple and easiest in most cases, sometimes you don’t need the users to have access to the ENTIRE zone. What resources will the VPN users need access to beyond just the zones? Will they need access to the entire zone, a subset of the zone, etc.?

Granting more access than is strictly necessary will open you up to security risks that are better left secured.Ĥ. If they don’t need it now and might need it later, grant it later. I’m a fan of the concept of least authority, meaning I’ll only give access to what is absolutely necessary. You can never secure an environment unless you know where users will and will not need access to. What zone(s) will the VPN users need access to? While you could use an already existing zone and subnet, setting up VPN users on their own zone and subnet makes the security of the users much simpler to manage as well as allowing you to be more granular in your security.ģ. What zone will the users be connecting to?Īgain, using a dedicated zone for VPN users is best as well. Trying to use a subnet configured in an already existing zone will be problematic at best.Ģ. In my experience, I’ve found it’s easiest to use a dedicated subnet for your users when setting up VPN access.

What subnet will the users be using when they connect in with the VPN client? Here are the questions I use when setting up VPN access:ġ.

There are a series of questions that you’ll need to consider when performing this action. Setting up VPN access isn’t something you can simply jump into. This article will review how to set up the client for your usage. This means you’ll need VPN access and, in the parlance of Palo Alto Networks, you’ll also need to set up the GlobalProtect VPN client. You’ve just begun using Palo Alto Networks technology and have found that your users need to access work resources remotely.

Globalprotect windows 10 issues