Reduce the chance that password spraying, exposed management services, stale software, or an overlong session turns an internet-facing GlobalProtect portal into an incident.
Test a free 200-entry sample. No signup is required.
The paths below use PAN-OS web-interface terminology. Labels were checked against PAN-OS 10.2, 11.1, and current documentation; verify them in the documentation for your installed release before committing.
| Item | Where (GUI) | Why | Priority |
|---|---|---|---|
| Install a supported, fixed PAN-OS release and current GlobalProtect app software | Device > Software; Device > GlobalProtect Client; Device > Dynamic Updates | Removes known portal and gateway vulnerabilities. Review release notes and the security-advisory matrix before upgrading. | Critical |
| Require MFA on portal and gateway authentication | Device > Authentication Profile; Network > GlobalProtect > Portals or Gateways > Authentication | A password alone should not grant remote access. GlobalProtect supports remote-user MFA integrations through SAML or RADIUS. | Critical |
| Require a client certificate plus user authentication where practical | Portal or Gateway > Authentication > Certificate Profile; set “Allow Authentication with User Credentials OR Client Certificate” to No | Requires possession of an approved endpoint certificate as well as valid user authentication. | High |
| Restrict who may authenticate | Device > Authentication Profile > Advanced > Allow List; Portal > Agent > Config Selection Criteria > User/User Group | Limits authentication and portal configurations to approved directory groups instead of every directory user. | High |
| Review authentication-override cookies | Portal > Agent > Authentication; Gateway > Agent > Client Settings > Authentication Override | A valid encrypted cookie can replace another credential or OTP prompt until it expires. | High |
| Set login and inactivity limits | Gateway > Agent > Connection Settings | Login Lifetime caps one gateway session. Inactivity Logout removes an inactive session. | High |
| Use a trusted server certificate and strong TLS | Device > Certificate Management > SSL/TLS Service Profile; assign it under Portal and Gateway > Authentication | A publicly trusted portal certificate avoids manual root deployment. Use the strongest TLS version supported by every required endpoint. | High |
| Remove unnecessary internet-facing services | Network > GlobalProtect > Portals > Clientless VPN; Network > Network Profiles > Interface Mgmt | Disable Clientless VPN if it is unused. Do not allow HTTP, HTTPS, Telnet, or SSH management on the portal or gateway interface. | High |
| Enable and tune brute-force signatures | Objects > Security Profiles > Vulnerability Protection; attach the profile to the GlobalProtect Security policy | Threat IDs 40017 and 40169 detect repeated authentication requests and failed GlobalProtect logons. Tune the parent signature before using Block IP. | High |
| Forward and alert on GlobalProtect events | Monitor > Logs > GlobalProtect; Monitor > Logs > System; Device > Log Settings | Central logs make repeated failures, unfamiliar source addresses, connection errors, and changes in normal login patterns easier to investigate. | High |
| Block known sources with an IPv4 EDL | Objects > External Dynamic Lists; deny Security policy above the GlobalProtect allow rule | Blocks known listed sources before authentication. Refresh hourly and check trusted user source networks before enforcement. | Additional layer |
Start at Device > Software and use Check Now. Review the release notes, upgrade path, compatibility requirements, and Palo Alto Networks security advisories before installation. Manage the app package under Device > GlobalProtect Client, and keep Applications and Threats content current under Device > Dynamic Updates.
CVE-2024-3400 is the clearest reason not to postpone portal patching. Palo Alto Networks describes it as an unauthenticated command-injection vulnerability that could provide root code execution. It applied to affected PAN-OS 10.2, 11.0, and 11.1 firewalls configured with a GlobalProtect portal, gateway, or both. The advisory tells customers to upgrade immediately to a fixed release.
CVE-2025-0114 affected certain older PAN-OS 10.1, 10.2, and 11.0 releases with an enabled GlobalProtect portal or gateway. Specially crafted traffic could make the service unavailable. The advisory lists no workaround, so upgrade to a fixed release from its version table. End-of-life releases were not evaluated and are presumed affected.
For remote-user authentication to GlobalProtect portals and gateways, Palo Alto Networks supports MFA vendors through SAML or RADIUS. This covers common deployments such as Microsoft Entra ID or Okta through SAML, and push or one-time-password services through RADIUS. MFA vendor API integrations (MFA server profiles) work only with Authentication Policy, not with GlobalProtect portal or gateway login.
Create the required server profile and then create an authentication profile under Device > Authentication Profile. Assign that profile under Network > GlobalProtect > Portals or Gateways > Authentication > Client Authentication. Apply MFA to both components if users authenticate to both.
For managed endpoints, add a Certificate Profile. Where both factors are required, set Allow Authentication with User Credentials OR Client Certificate to No. The portal or gateway then requires the client certificate and user authentication instead of accepting either one alone.
Under Device > Authentication Profile > Advanced > Allow List, select only the groups permitted to use GlobalProtect. Also review Portal > Agent > Config Selection Criteria > User/User Group and the equivalent gateway client-settings criteria. Remove obsolete group references and disable unused human or service identities in the identity provider under that provider's own account-management process.
Generate cookie for authentication override creates an encrypted, endpoint-specific cookie after authentication. Accept cookie for authentication override lets the portal or gateway authenticate the endpoint with that valid cookie. This reduces repeated prompts, but it also extends the value of a stolen endpoint session.
Palo Alto Networks' OTP guidance calls 24 hours typical for gateways and 15 days typical for portals. Those are examples, not requirements. Use the shortest period your access policy and user workflow can tolerate. The documented range is 1–72 hours, 1–365 days, or 1–52 weeks.
Use the same cookie encryption and decryption certificate where the portal and gateway must exchange cookies. On supported current releases, review the gateway's Connection Settings > Authentication Cookie Usage Restrictions. Restricting cookie use to the original source address or network can reduce reuse, but it may disrupt users whose public address changes.
Configure gateway timeouts under Network > GlobalProtect > Gateways > (gateway) > Agent > Connection Settings.
There is no single vendor-prescribed login lifetime for every deployment. Choose a value from your access policy. Use shorter sessions for privileged access and higher-risk users, then test reconnects, pre-logon, Always On, certificate renewal, and MFA prompts with a pilot group.
Palo Alto Networks recommends a portal server certificate from a well-known third-party CA. If you use a private CA, deploy its root certificate to every endpoint that runs the GlobalProtect app. The server certificate belongs in an SSL/TLS Service Profile, not in a CA-certificate slot.
Create the profile at Device > Certificate Management > SSL/TLS Service Profile, select the signed server certificate, and assign the profile to both the portal and gateway authentication settings. The certificate name must match the FQDN users connect to.
PAN-OS 11.1.0 added TLSv1.3 for GlobalProtect portals and gateways. The PAN-OS 11.1 release notes say that for the strongest security you set both the minimum and maximum version to TLSv1.3 in the SSL/TLS Service Profile. On older releases, or when some required endpoints cannot use TLSv1.3, keep the minimum at TLSv1.2. Test the complete endpoint population before removing TLSv1.2.
Do not attach an Interface Management profile that permits HTTP, HTTPS, Telnet, or SSH to the interface hosting an internet-facing GlobalProtect portal or gateway. GlobalProtect does not require those management services. Check Network > Network Profiles > Interface Mgmt and the profile assigned under Network > Interfaces.
If Clientless VPN is not used, clear the Clientless VPN setting under Network > GlobalProtect > Portals > (portal) > Clientless VPN > General after confirming no application depends on it. Palo Alto Networks warns that Clientless VPN does not preserve the normal browser Same Origin Policy between rewritten applications and recommends using it only for a single trusted application.
Avoid sharing the GlobalProtect portal FQDN with the PAN-OS web interface. Use a static portal or gateway address and keep administrative access on a separate trusted management path.
Threat ID 40017 counts GlobalProtect authentication requests whether they succeed or fail. Its child signature is 32256. Palo Alto Networks documents a default trigger of 10 requests from one source to one destination within 60 seconds, medium severity, and an Alert action.
Threat ID 40169 tracks failed GlobalProtect portal or gateway logons. Its child signature is 96010. Palo Alto Networks documents a default trigger of 60 failures within 5 seconds, medium severity, and an Alert action.
Use a Vulnerability Protection profile on the Security policy that permits traffic to GlobalProtect. Tune the parent-signature threshold against your own traffic before selecting Block IP. Shared NAT addresses can represent legitimate users, so an aggressive block duration can affect more than the device that generated a failure.
For complete signature and EDL configuration steps, use the Palo Alto GlobalProtect brute-force guide. That guide covers the deny rule and verification without duplicating the setup here.
PAN-OS 9.1 introduced the dedicated Monitor > Logs > GlobalProtect table and forwarding for GlobalProtect connection logs. These records include fields such as event ID, stage, authentication method, status, reason, public IP, user, portal, and gateway.
Also review Monitor > Logs > System. Palo Alto Networks notes that GlobalProtect authentication events are recorded in System logs. The separate Authentication log is primarily for events controlled by Authentication Policy rules, so it should not be your only GlobalProtect login view.
Create the syslog destination under Device > Server Profiles > Syslog. Configure GlobalProtect and System forwarding under Device > Log Settings. Forward Threat and Traffic logs through the applicable Log Forwarding profile and Security policy.
Alert on repeated failures from one address, the same username across many source addresses, unfamiliar countries or networks, unexpected certificate failures, disabled or deleted portal settings, and sudden changes in normal connection volume. Correlate identity-provider MFA and account events in the same SIEM. See how to detect VPN password spraying for investigation patterns.
After the native controls are in place, an External Dynamic List can block known sources before they reach authentication. ThreatListPro covers 5.4M+ IPv4 addresses and is checked for new attackers every 6 hours. Its source is real attacks on live production Palo Alto GlobalProtect VPN portals in the US.
The subscription URL is plain text with one IPv4 address or CIDR per line. Single addresses are written as /32:
https://api.threatlistpro.com/v1/YOUR_API_KEY/blocklist.txt
Configure the PAN-OS EDL to refresh Hourly. Palo Alto Networks supports an hourly retrieval interval, and requesting the feed more frequently provides no benefit when it is checked for new attackers every 6 hours. The list uses a few thousand entries, but check the capacity for your firewall model at Palo Alto EDL limits by model.
Place the source-EDL deny rule above the GlobalProtect allow rule. First compare the list with successful users' source addresses and allow-list trusted networks. Follow the tested procedure in the GlobalProtect blocklist setup guide.
| Control | Stolen password | Repeated failures from one IP | Known listed source before login | New IP's first attempt |
|---|---|---|---|---|
| MFA | Limits account access | Requests still arrive | Does not block by IP | Still arrives |
| Client certificate plus user authentication | Requires approved certificate | Requests still arrive | Does not block by IP | Still arrives |
| Threat ID 40169 with Block IP | Does not validate password ownership | Blocks after the tuned threshold | Only after local failures | Still arrives |
| Authentication-profile allow list | Excludes unauthorized groups | Requests still reach authentication | Does not block by IP | Still arrives |
| ThreatListPro IPv4 EDL | Does not protect an unlisted valid login | Blocks if the source is listed | Blocks known listed sources | Still arrives if unlisted |
Keep PAN-OS, GlobalProtect app software, and threat content on supported releases; require MFA; restrict authentication profiles to authorized groups; use trusted server certificates; limit cookie and session lifetimes; remove unused portal features; protect the login service with Vulnerability Protection; and forward GlobalProtect and system logs to your SIEM.
For GlobalProtect portal and gateway authentication, Palo Alto Networks supports MFA vendors through SAML or RADIUS. A SAML identity provider can provide methods such as Microsoft Authenticator or Okta Verify. A RADIUS service can provide push, token, or one-time-password challenges. Configure the authentication profile on both the portal and gateway where authentication is required.
Use the shortest lifetime that meets your access policy. Palo Alto Networks describes 24 hours as typical for a gateway and 15 days as typical for a portal in its OTP guidance. A valid authentication-override cookie can bypass another credential or OTP prompt, so do not treat a long cookie lifetime as harmless convenience.
Palo Alto Networks defines Login Lifetime as the maximum length of one gateway login session but does not prescribe one universal value in current web help. Set it from your access policy, make privileged access shorter, and test reconnect behavior. Inactivity Logout defaults to 180 minutes in current PAN-OS web help.
Patch the firewall, require MFA, add client-certificate authentication where managed endpoints support it, use a publicly trusted portal certificate, restrict the authentication-profile allow list, disable Clientless VPN when unused, and never enable HTTP, HTTPS, Telnet, or SSH in an Interface Management profile attached to the internet-facing GlobalProtect interface.
No. An IP block list blocks known listed sources before they reach the login service. It cannot block a new IP's first attempt, an unlisted residential proxy, IPv6 sources (the list is IPv4 only), or misuse of a valid stolen session. Keep MFA, patching, certificate authentication, account controls, and monitoring in place.
Palo Alto Networks documentation and security advisories used for this checklist.
ThreatListPro covers 5.4M+ IPv4 addresses from real attacks on live production Palo Alto GlobalProtect VPN portals in the US. It is checked for new attackers every 6 hours.
Start Free Trial — $9.99/mo Monthly includes a 14-day free trial with no card needed. Yearly is $100. Enterprise is $49.99/mo. Paid plans include a 14-day money-back guarantee. Or test 200 entries first: free, no signup.ThreatListPro provides a standard IP blocklist feed for firewalls that support external lists.