GlobalProtect VPN and Remote Access Flashcards

What GlobalProtect component can be deployed in the DMZ to allow external client connections?

Answer: External Gateway

An External Gateway is deployed in the DMZ or with a public IP to accept encrypted VPN connections from remote clients on the internet.

Which configuration on the firewall defines which traffic from GlobalProtect clients bypasses the VPN tunnel?

Answer: Split Tunnel Access Route

Split Tunnel Access Routes configured on the gateway define which subnets or domains are routed through the VPN versus sent directly to the internet.

What is the purpose of the Clientless VPN feature in GlobalProtect?

Answer: To provide browser-based access to internal web applications without installing the GP agent

Clientless VPN provides access to internal web applications through an SSL-secured browser portal without requiring the GlobalProtect agent to be installed.

When configuring GlobalProtect for IPv6, which statement is correct?

Answer: GlobalProtect supports IPv6 for both the tunnel interface and client-assigned addresses

GlobalProtect supports IPv6 for tunnel interfaces and can assign IPv6 addresses to connecting clients in addition to IPv4.

What is the effect of enabling 'Enforce GlobalProtect Connection for Network Access' on an endpoint?

Answer: It blocks network access until the GlobalProtect VPN is connected

This setting prevents the endpoint from accessing any network resources until the GlobalProtect agent successfully establishes a VPN connection.

Which log type on the Palo Alto firewall would you review to troubleshoot a failed GlobalProtect authentication?

Answer: GlobalProtect Logs

GlobalProtect Logs record connection attempts, authentication results, HIP check outcomes, and disconnection events for VPN troubleshooting.