This time, we will create our VPN server certificate ( my-vpn) signed by our newly created root certificate authority ( my-vpn-ca).

In the same menu, click Generate again to open a new Generate Certificate window.

Populate it with the settings as shown in the screenshot below and click Generate to create the root certificate authority ( my-vpn-ca).

This will open the Generate Certificate window.

In the bottom of the Device Certificates tab, click on Generate.

In the left menu navigate to Certificate Management -> Certificates.

Create VPN Root Certificate Authority (CA) And VPN Certificateįirst, we need to create a Root Certificate Authority (CA) that we’ll use to issue certificates for our VPN configuration. If you need to know what your public IP address is, a quick Google search will tell you.

Once you’ve signed up and have a hostname pointing to your public IP, you’re all set. It’s left as an exercise for you the reader to determine which solution is best for you. There are a number of DDNS services, some of which are free.

A simple solution is to use a Dynamic DNS (DDNS) service that automatically updates a hostname (e.g., DNS A record) to resolve to your home network’s public IP address. For the purposes of establishing a GlobalProtect tunnel to our Palo Alto firewall, we need a way to guarantee the public IP address of our home network. Set Up Dynamic DNSĬhances are, your home internet’s public IP address is dynamically assigned by your internet service provider (ISP), meaning it may change from time to time as the lease expires.

Note: This guide was tested on and is intended for use with PAN-OS 9.1.x. It is not a one size fits all approach and you’re absolutely encouraged to modify the steps to meet your requirements. This how-to guide is designed to walk you through a GlobalProtect configuration appropriate for remotely accessing a home network, leveraging both a username/password and machine certificate for secure authentication. If you’ve never set up GlobalProtect, this guide will get you started with a basic configuration that you can tweak to your requirements. You can also securely access resources on your home network, such as a file server. At a high level, GlobalProtect establishes an encrypted secure tunnel between you and your Palo Alto firewall, providing you the same firewall protection even if you’re not physically at home. But what about when you’re away from home, is there a way to extend that protection to wherever you are?įortunately, Palo Alto has a great virtual private network (VPN) solution called GlobalProtect. So you’ve got your Palo Alto firewall successfully protecting your home network, blocking known malicious sites, and allowing system updates. This is part of the Palo Posts how-to guides for getting the most from your Palo Alto firewall on a home or small business network.

Globalprotect windows 10 issues