Description
Palo Alto Networks GlobalProtect is a network security endpoint client that extends the Next-Generation Security Platform to all users regardless of location. It delivers secure remote access that goes beyond traditional VPN by combining identity-aware authentication, device posture enforcement, and consistent security policies in a single solution.
Key Capabilities
- Identity-Based Access Control — SAML and MFA-based authentication with cloud identity integration for granular, identity-aware access policies.
- Device Trust Enforcement — Assess endpoint security posture before granting network access to ensure only compliant devices connect.
- Consistent Policy Enforcement — Apply industry-leading security controls and inspection across all application traffic, wherever users connect.
- Flexible Deployment — Client and clientless options across Windows, macOS, Linux, iOS, Android, and Chrome OS.
Use Cases
Modernizing remote access for hybrid workforces, replacing legacy VPNs with zero-trust access, and securing remote employees with least-privilege access to sensitive data.
Highlights
Pros
- Integrates natively with Palo Alto Networks next-generation firewalls and Prisma SASE for deep packet inspection and SSL-offloading-based security
- Supports identity-aware authentication with SAML, Kerberos SSO, and third-party MFA (Duo, Google, Microsoft Authenticator) for granular access control
- Provides URL-level filtering and Advanced Threat Prevention to block malicious websites, phishing attempts, and malware at the gateway
- Enforces device posture checks before granting network access, assessing endpoint health and compliance with enterprise security policies
- Delivers full visibility into remote workforce traffic across all applications, ports, and protocols through the Application Command Center and detailed logging
- Offers both client-based and clientless (browser-based) deployment options across Windows, macOS, Linux, iOS, Android, and Chrome OS
Cons
- Initial configuration is complex with a multi-step setup process, presenting a steep learning curve for IT administrators unfamiliar with Palo Alto's ecosystem
- Requires Palo Alto Networks firewall appliances or Prisma Access subscription to function — not available as a standalone VPN product
- Does not support auto-reconnect when the VPN session drops, requiring users to manually log in again after disconnections or system reboots
- Policy controls for remote devices lack flexibility, making it difficult to enforce granular rules on unmanaged or BYOD endpoints
- Users report frequent and unpredictable disconnections, particularly when switching between networks, with sessions failing to persist