Configure GlobalProtect SAML Authentication

This document contains instructions for configuring SAML authentication for Palo Alto Networks' GlobalProtect in brokering mode.

Infinipoint Configuration

1. Create a “Palo Alto GlobalProtect” Application in Infinipoint:

   1. Access → Applications, Click add and select “Add from catalog” , Select Palo Alto Global Protect

   2. Select your Identity provider

   3. Enter Application Name: GlobalProtect

   4. Origin URL: https://[REPLACE-WITH-GP-GATEWAY-IP]:443

      • The GlobalProtect Gateway IP can be fetched from the Firewall Management under:

        1. Network → GlobalProtect → Portals, Select Your Portal

        2. Then select Agent Tab → Select Your Configuration

        3. Then External Tab → Copy the IP Address from the selected Gateway

   5. Click to “Download the Metadata XML” (save for later)

   6. Click to “Download Certificate” (save for later)

   7. Click on “Save” to save the Application

GlobalProtect Configuration

1. Create a new “SAML Identity Provider” in the Firewall

   1. Device → Server Profiles → SAML Identity Provider

      1. Click to “Import”

         1. Profile Name: Infinipoint

         2. Identity Provider Metadata: [Click “Browse” and Select the Metadata XML that we saved from the Infinipoint Console]

         3. Uncheck “Sign SAML Message to IDP”

            • Example “SAML Identity Provider” Configuration:

              Open

              

               

2. Create on “Authentication Profile”

   1. Device → Authentication Profile, Click on “Add”

      1. Name: Infinipoint

      2. Type: SAML

      3. IdP Server Profile: [The SAML Identity Profile we have created]

      4. Certificate Profile: [The Infinipoint IdP Certificate we have downloaded]

      5. Username attribute: username

         • Example “Authentication Profile”

           Open

           

3. Assign the Infinipoint Authentication Profile to the GlobalProtect Portals and Gateways

   1. Network → GlobalProtect → Portals, Select [Your Portal]

      1. Select from GlobalProtect Portal Configuration →Authentication, Add or change to “Authentication Profile” based on your Infinipoint Profile

         • Example Client Authentication Config:

      2. Select from GlobalProtect Portal Configuration → Agent, [Select your agent configuration]

         1. Click on the “App” Tab

         2. Scroll the “App Configurations” to set “Use Default Browser for SAML Authentication” to “Yes”

            1. Example:

Configure GlobalProtect Continuous Checks with Infinipoint

This document contains instructions for configuring GlobalProtect continuous checks and HIP notification with Infinipoint.

It is recommended to set the Firewall HIP Check Interval to 60 seconds via the firewall CLI tool with the following commands:

TBD (instructions for setting Infinipoint’s “Compliance Triggers” and GP HIP check and notification)

HTML Template for HIP Notification