Hardware reference guide

8 GlobalProtect Administrator’s Guide
Create Interfaces and Zones for GlobalProtect Set Up the GlobalProtect Infrastructure
Create Interfaces and Zones for GlobalProtect
You must configure the following interfaces and zones for your GlobalProtect infrastructure:
 GlobalProtect portal—Requires a Layer 3 or loopback interface for GlobalProtect clients to connect to. If
the portal and gateway are on the same firewall, they can use the same interface. The portal must be in a zone
that is accessible from outside your network, for example: untrust.
 GlobalProtect gateways—The interface and zone requirements for the gateway depend on whether you
are configuring an external gateway or an internal gateway as follows:
– External gateways—Requires a Layer 3 or loopback interface and a logical tunnel interface for the
client to connect to in order to establish a VPN tunnel. The Layer 3/loopback interface must be in an
external zone, such as untrust. The tunnel interface can either be in the same zone as the interface
connecting to your internal resources, for example trust, or, for added security and better visibility, you
can create a separate zone, such as corp-vpn. If you create a separate zone for your tunnel interface,
you will need to create security policies to enable traffic to flow between the VPN zone and the trust
zone.
– Internal gateways—Requires a Layer 3 or loopback interface in your trust zone. You can also create
a tunnel interface for access to your internal gateways, but this is not required.
For more information about portals and gateways, see About the GlobalProtect Components.
For tips on how to use a loopback interface to provide access to GlobalProtect on different ports
and addresses, refer to Can GlobalProtect Portal Page be Configured to be Accessed on any
Port?
Set Up Interfaces and Zones for GlobalProtect
Step 1 Configure a Layer 3 interface for each
portal and/or gateway you plan to deploy.
If the gateway and portal are on the
same firewall, you can use a single
interface for both.
As a best practice use static IP
addresses for the portal and
gateway.
1. Select
Network > Interfaces > Ethernet or Network >
Interfaces > Loopback
and then select the interface you want to
configure for GlobalProtect. In this example, we are configuring
ethernet1/1 as the portal interface.
2. (Ethernet only) Select
Layer3 from the Interface Type
drop-down.
3. On the
Config tab, select the zone to which the portal or
gateway interface belongs as follows:
• Place portals and external gateways in an untrust zone for
access by hosts outside your network, such as l3-untrust.
• Place internal gateways in an internal zone, such as l3-trust.
• If you have not yet created the zone, select
New Zone from
the
Security Zone drop-down. In the Zone dialog, define a
Name for the new zone and then click OK.
4. In the
Virtual Router drop-down, select default.
5. To assign an IP address to the interface, select the
IPv4 tab, click
Add in the IP section, and enter the IP address and network
mask to assign to the interface, for example 208.80.56.100/24.
6. To save the interface configuration, click
OK.