If they don’t need it now and might need it later, grant it later. I’m a fan of the concept of least authority, meaning I’ll only give access to what is absolutely necessary. You can never secure an environment unless you know where users will and will not need access to. What zone(s) will the VPN users need access to? While you could use an already existing zone and subnet, setting up VPN users on their own zone and subnet makes the security of the users much simpler to manage as well as allowing you to be more granular in your security.ģ. What zone will the users be connecting to?Īgain, using a dedicated zone for VPN users is best as well. Trying to use a subnet configured in an already existing zone will be problematic at best.Ģ. In my experience, I’ve found it’s easiest to use a dedicated subnet for your users when setting up VPN access. What subnet will the users be using when they connect in with the VPN client? Here are the questions I use when setting up VPN access:ġ. There are a series of questions that you’ll need to consider when performing this action. Setting up VPN access isn’t something you can simply jump into. This article will review how to set up the client for your usage. This means you’ll need VPN access and, in the parlance of Palo Alto Networks, you’ll also need to set up the GlobalProtect VPN client. You’ve just begun using Palo Alto Networks technology and have found that your users need to access work resources remotely.

Globalprotect vpn big sur