Palo Alto Networks Certified Network Security Engineer (PCNSE)Deploy and ConfigureHard
A network administrator is configuring a Palo Alto Networks firewall for a new branch office. The branch needs to use a full mesh VPN topology with other branch offices, but the public IP addresses of some branches are dynamic. Which GlobalProtect component is specifically designed to handle dynamic IP addresses for VPN tunnels?
- AGlobalProtect Gateway
- BExternal Gateway
- CGlobalProtect Portal
- DSatellite Gateway
Show answer & explanationAnswer & explanation
Correct answer: D. Satellite Gateway
The GlobalProtect Satellite Gateway is specifically designed for site-to-site VPN connectivity where one or both endpoints have dynamic IP addresses. Satellites register with a GlobalProtect Portal, allowing them to establish VPN tunnels to other GlobalProtect devices (including other Satellites or Gateways) even without a static public IP.
Why the other options are wrong
- A. The GlobalProtect Gateway terminates client VPN connections and can also be used for static site-to-site VPNs, but not primarily for dynamic IP scenarios in a full mesh.
- B. External Gateway is a general term and not a specific Palo Alto Networks GlobalProtect component for this purpose.
- C. The GlobalProtect Portal authenticates users and provides client configurations, but doesn't directly handle dynamic IPs for site-to-site VPNs.
GlobalProtect Satellite Gateway
A GlobalProtect Satellite Gateway is a Palo Alto Networks firewall deployed at a remote site with a dynamic public IP address, which registers with a GlobalProtect Portal to enable site-to-site VPN connectivity with other GlobalProtect devices.
- Enables site-to-site VPN for dynamic IP branches.
- Registers with a GlobalProtect Portal.
- Part of a GlobalProtect full mesh or hub-and-spoke VPN solution.
Memory trick: The 'Satellite' finds its Portal 'home' so other branches can find it.