Palo Alto Networks Certified Network Security Engineer (PCNSE)Plan and DesignMedium
A company is designing a GlobalProtect deployment for its remote workforce. Users will connect from various locations with potentially unreliable internet connections. The design requires that users can always reach internal resources, even if a single GlobalProtect Gateway becomes unavailable. Which GlobalProtect component should be designed with redundancy to ensure continuous connectivity?
- ALog Collector
- BGlobalProtect Gateway
- CGlobalProtect Portal
- DUser-ID Agent
Show answer & explanationAnswer & explanation
Correct answer: B. GlobalProtect Gateway
The GlobalProtect Gateway is the component that handles user authentication, tunnel establishment, and security policy enforcement for remote users. Redundancy at the Gateway level ensures that if one gateway fails, users can still connect through another available gateway.
Why the other options are wrong
- A. A Log Collector stores logs but its availability does not directly impact a remote user's ability to establish a GlobalProtect VPN connection.
- C. The GlobalProtect Portal provides initial configuration and gateway lists but does not handle the actual VPN tunnel or data forwarding.
- D. The User-ID Agent maps IP addresses to usernames, but its failure does not directly prevent GlobalProtect users from connecting to the VPN.
GlobalProtect Gateway Redundancy
Implementing multiple GlobalProtect Gateways to provide high availability and load balancing for remote user VPN connections, ensuring continuous access to internal resources.
- Ensures continuous connectivity for remote users.
- Supports load balancing across multiple gateways.
- Requires configuration of multiple gateways in the Portal.
Memory trick: The Gateway is the gatekeeper to your network; make sure you have more than one!