When are the Global Protect Portal and Gateway Licenses Required?

When are the Global Protect Portal and Gateway Licenses Required?

Created On 09/25/18 17:30 PM - Last Modified 12/21/22 17:59 PM


Information regarding GlobalProtect (GP) licenses.


  • Palo Alto Firewalls
  • GlobalProtect License
Note: Starting from PAN-OS 7.0, The Global Protect Portal License is no longer required and has been discontinued. The GlobalProtect Gateway license is required for the more advanced features of GlobalProtect.


If you want to use GlobalProtect to provide a secure remote access or virtual private network (VPN) solution via single or multiple internal/external gateways, you do not need any GlobalProtect licenses. However, to use some of the more advanced features (such as HIP checks and associated content updates, support for the GlobalProtect mobile app, or IPv6 support) you must purchase an annual GlobalProtect subscription.

This license must be installed on each firewall running a gateway(s) that :
  • Performs HIP checks
  • Supports the GlobalProtect app for mobile endpoints running iOS, Android, Chrome OS, and Windows 10UWP.
  • Supports the GlobalProtect app for Linux endpoints
  • Supports the GlobalProtect app for IoT endpoints
  • Supports IPv6 connections for external gateways.
  • Split tunnel traffic based on the destination domain, application process name, DNS, or HTTP/HTTPS video streaming application.
  • Enforce GlobalProtect connections with FQDN exclusions.
  • Identification of managed devices using the endpoint serial number on gateways
  • Internet of things (IoT) devices.
  • Clientless VPN (For GlobalProtect Clientless VPN, you must also install a GlobalProtect subscription on the firewall that hosts the Clientless VPN from the GlobalProtect portal. You also need the GlobalProtect Clientless VPN dynamic updates to use this feature.)

Please visit the GlobalProtect Admin guide for ALL of the detailed information on licensing and how to install the licenses properly.
GlobalProtect Administrator's Guide - About GlobalProtect Licenses

High Availability deployment of the portal and gateway requires identical licenses to be installed on both devices.




Additional Information

Please contact your authorized reseller or Palo Alto Networks Sales Representative for purchasing licenses.
To identify an authorized reseller in your region, please fill in the brief form.

  • Print
  • Copy Link


Choose Language