Palo Alto Networks Knowledgebase: When are the Global Protect Portal and Gateway Licenses Required?

When are the Global Protect Portal and Gateway Licenses Required?

Created On 08/05/19 19:21 PM - Last Updated 08/05/19 19:48 PM
GlobalProtect Gateway GlobalProtect Portal Licensing VPNs GlobalProtect Prisma Access


Listed below are scenarios when the GlobalProtect Portal and Gateway licenses are required:


  1. Global Protect Portal License


Prior to PAN-OS 7.0:

The GlobalProtect Portal license is required when:

  • Using HIP
  • Configuring multiple gateways
  • Configuring internal gateway

PAN-OS 7.0 and later:

  • GlobalProtect Portal license is not required.
  • Thus the GUI dashboard will show the license as being expired



  1. GlobalProtect Gateway License  

The GlobalProtect Gateway license is required when:

  • Using HIP
  • Using iOS or Android mobile application

The GlobalProtect Gateway License requirement remains same for PAN-OS version 7.0 and later.


High Availability deployment of the portal and gateway requires identical licenses to be installed on both the devices.




Additional Information

See Also

GlobalProtect Configuration Tech Note

GlobalProtect Configuration for the IPsec Client on Apple iOS Devices

GlobalProtect Configuration for the IPSec Client on Android Devices

For additional information on purchasing Global Protect Licenses, please contact your Reseller or Palo Alto Networks Sales Representative.

  • Print
  • Copy Link

Choose Language