Docs

Appearance

GlobalProtect Operations ​

Overview ​

GlobalProtect is the VPN solution for the CEO and CTO only. All other staff use Twingate. GlobalProtect is managed through Panorama and runs on the Azure Public Firewall.

Who uses it: CEO, CTO
What it provides: Full-tunnel VPN to the production network (same access as being on-premises)
Gateway: Managed by the Azure Public Firewall (via Panorama)
Certificate: Wildcard *.ciriusgroup.com — the same cert used for public-facing services

Do not provision new GlobalProtect users without Rory approval. Twingate is the standard remote access tool — GlobalProtect is maintained only for the CEO/CTO.

Architecture ​

GP Client (CEO/CTO laptop)
    │
    │ TLS — *.ciriusgroup.com wildcard cert
    ▼
GlobalProtect Gateway (Azure Public Firewall — PublicFW)
    │
    │ Decrypted traffic, inspected by Palo Alto policy
    ▼
Internal resources (vnet-identity, vnet-prod, etc.)

The GlobalProtect portal and gateway are hosted on the Azure Public Firewall. Portal authenticates users against Entra ID via SAML. After authentication, the gateway issues a VPN tunnel.

Checking Connection Status ​

Via Panorama ​

Panorama → Monitor → GlobalProtect → Connected Users

Shows all currently connected GlobalProtect clients: username, IP, tunnel start time, gateway name.

If a user says their GP is connected but they can't reach resources:

  1. Confirm they appear in the Connected Users list
  2. Check the tunnel IP assigned to their client
  3. Verify Palo Alto security policy allows traffic from GP tunnel zone to the destination

Via the GP Client (User-Side) ​

Have the user open the GlobalProtect client on their machine:

  • Connected shows the gateway IP and connection time
  • Statistics shows bytes sent/received (if 0 outbound, split tunneling or route issue)
  • Collect Logs generates a diagnostic bundle to send to Rory if needed

Adding a GlobalProtect User ​

New GP users require:

  1. A valid Entra ID account (ciriusgroup.com)
  2. Membership in the Entra group that is assigned to the GlobalProtect SAML app
  3. The GlobalProtect client installed on their machine

Checking Group Membership ​

The GlobalProtect SAML app in Entra restricts access to a specific Entra group. To view or add members:

Entra ID → Enterprise Applications → GlobalProtect (or Palo Alto GlobalProtect) → Users and groups → Add user/group

Or via PowerShell:

powershell
# Add user to the GP access group
Add-MgGroupMember -GroupId "<gp-group-id>" -DirectoryObjectId "<user-object-id>"

Distributing the Client ​

The GlobalProtect client installer is available from the GP portal. Users navigate to https://gateway-hostname.ciriusgroup.com in a browser and download the client from the portal page.

After install, the user enters the portal address and authenticates with their Entra credentials (MFA required via Conditional Access).

Removing a GlobalProtect User ​

Remove the user from the Entra group controlling GP app access:

Entra ID → Enterprise Applications → GlobalProtect → Users and groups → [user] → Remove

Active connections are not immediately terminated — the user's current session continues until the certificate or token expires. To immediately kill an active session:

Panorama → Monitor → GlobalProtect → Connected Users → [user] → Disconnect

Certificate Management ​

GlobalProtect uses the *.ciriusgroup.com wildcard certificate for TLS. The GP gateway and portal present this cert to connecting clients.

The cert is imported to Panorama as CiriusGroupWildcard2025 and bound to the ssl-tls-service-profile named GlobalProtect.

When the wildcard cert is renewed, it must be re-imported to Panorama and rebound. See Certificate Renewal Procedure for the full renewal steps.

To verify the cert currently in use: Panorama → Device → Certificate Management → Certificates → CiriusGroupWildcard2025 Check the expiry date. The cert_expiry_agent monitors this and alerts at 90 days.

Troubleshooting ​

User Can't Connect to the Portal ​

  1. Verify the portal address is correct (gateway-hostname.ciriusgroup.com)
  2. Check DNS resolves correctly: nslookup gateway-hostname.ciriusgroup.com
  3. Verify the Azure Public Firewall is running and the public IP is reachable
  4. Check Panorama: Monitor → Logs → System — any GlobalProtect portal errors?

Authentication Fails at the SAML Step ​

  1. Verify the user is in the GP Entra group
  2. Check Entra sign-in logs for the user — what CA policy or auth error occurred?
  3. Verify the SAML app in Entra is still configured correctly (SSO URL matches the GP portal)
  4. The GP SAML app in Entra should not have an expiring certificate — check it isn't using the same SAML cert as OneLogin (different integration)

Connected But Can't Reach Internal Resources ​

  1. Panorama → Monitor → Logs → Traffic — filter by the user's tunnel IP
  2. If traffic is hitting a deny rule, the security policy needs to be updated
  3. Check the GP gateway tunnel zone — traffic from it must be allowed by policy
  4. Verify the route table: the GP client should receive a route for the internal subnets via the tunnel (check Monitor → GlobalProtect → Connected Users → [user] → Routes)

Certificate Error in GP Client ​

"Gateway certificate is not trusted" or similar:

  1. The wildcard cert may have expired — check in Panorama
  2. The user's machine may be missing the cert chain — install the intermediate CA cert
  3. If recently renewed, the cert may not have been pushed to the gateway yet — push config from Panorama: Commit → Push to Devices → [PublicFW]

Pushing a GP Config Change ​

After any change to GlobalProtect configuration in Panorama (authentication profile, split tunneling, routing):

  1. Panorama → Commit → Commit and Push
  2. Select the Azure Public Firewall in the push scope
  3. Commit the changes
  4. Monitor the push — in Panorama → Tasks — ensure it completes successfully
  5. Test the GP connection from the CEO/CTO's machine

Do not push config during business hours if the CEO or CTO are actively connected — the push causes a brief interruption to active tunnels.

Document History ​

DateChangeAuthor
May 2026Initial draft — architecture, connection status, user add/remove, cert management, troubleshooting, config push. CEO/CTO-only scope documented.Rory

Internal use only — Cirius Group