GlobalProtect Licensing Overview

1. Introduction

GlobalProtect is Palo Alto Networks' comprehensive solution for secure remote access. It extends the protection of the corporate firewall to remote users by establishing a secure connection between the user's device and the enterprise network. Understanding the licensing options is crucial for deploying the appropriate features to meet organizational needs.

2. Licensing Options

GlobalProtect offers different licensing tiers to cater to various requirements:

2.1 Basic Access (No License Required)

For organizations seeking fundamental VPN capabilities, GlobalProtect provides basic access without the need for additional licenses. This includes:

Deployment of GlobalProtect portals and gateways
Support for Windows and macOS endpoints
Single or multiple internal/external gateways

Note: Advanced features are not available in this tier.

2.2 GlobalProtect Gateway License

The Gateway License unlocks advanced functionalities and is required for each firewall hosting a GlobalProtect gateway. Features include:

Host Information Profile (HIP) checks and associated content updates
Support for the GlobalProtect mobile app (iOS, Android, Chrome OS, Windows 10 UWP)
Support for Linux and IoT endpoints
IPv6 support for external gateways
Clientless VPN access
Split tunneling based on destination domain, application process name, or video streaming application
Adding compromised devices to quarantine

2.3 GlobalProtect Subscription License

For enhanced security features, the GlobalProtect Subscription License provides:

Advanced endpoint protection with integration to Palo Alto Networks' security services
Integration with Endpoint Protection Platforms (EPP) and Endpoint Detection and Response (EDR) solutions
Support for Prisma Access for remote users

3. Licensing Summary

Feature	License Required
Basic VPN access (Windows/macOS)	No
HIP checks and content updates	GlobalProtect Gateway License
Mobile app support (iOS, Android, etc.)	GlobalProtect Gateway License
Linux and IoT endpoint support	GlobalProtect Gateway License
IPv6 support for external gateways	GlobalProtect Gateway License
Clientless VPN access	GlobalProtect Gateway License
Split tunneling (domain, app, video)	GlobalProtect Gateway License
Advanced endpoint protection integration	GlobalProtect Subscription License
Integration with EPP/EDR solutions	GlobalProtect Subscription License
Support for Prisma Access	GlobalProtect Subscription License