How to Configure GlobalProtect Portal Page to be Accessed on any Port
364657
Created On 09/25/18 17:30 PM - Last Modified 10/28/26 11:52 AM
Objective
To Configure GlobalProtect Portal Page to be Accessed on any Port.
For instance in this article, the service port TCP-7000 on the outside IP address 10.10.20.21 (Untrust Interface) will be translated to 10.10.20.45 (loopback) on service port TCP-443.
Environment
- Next-Generation Firewalls (NGFW)
- Supported PAN-OS
- GlobalProtect Portal
Procedure
Although it is not possible to change the port GlobalProtect uses, it is possible to use another port with the help of a loopback IP address and security rules.
Steps:
- Create a loopback on the Untrust zone
- Make sure the Untrust interface can reach the loopback.
- Assign the loopback as the portal address and the gateway address.
- In the GlobalProtect Portal > Agent > External tab, set the external gateway to address (10.10.20.21:7000 for example)
- Security policy must match the original destination IP address and original destination port, but use the post-NAT destination zone.
- Create a Destination NAT rule with service:7000 to 10.10.20.21 (Untrust Interface) translating to 10.10.20.45 (loopback) on service:443
- Create a Security policy rule with the destination address as the Untrust interface and services as 7000 and 443
- With this configuration, you will be able to access the Globalprotect portal page on outside IP address port 7000 https://10.10.20.21:7000 which will translate to https://10.10.20.45:443. Download and install the GlobalProtect client software.
- Use the credentials in the username & password fields. In the portal field, use the IP as 10.10.20.21:7000 as shown.