In Day 44 of my PCNSA Palo Alto Firewall Training series, I show you the basic, real lab configuration of GlobalProtect VPN—portal, gateway, and how to verify the tunnel is up. Before jumping into config, I tell you clearly: if you didn’t watch Day 43 (concept), you should watch that first, otherwise you will get confused between portal and gateway. In this lab I’m using a very simple topology and even a non-licensed GlobalProtect setup, so you can still practice in EVE-NG and understand how it works in real environments. I start by configuring inside and outside interfaces (inside static IP, outside DHCP), then I generate a certificate because portal access and client download happens over HTTPS and SSL handshake is required. After that I create a local user and an authentication profile (local database), just to keep the lab simple—later you can do AD/TACACS/SSO/2FA. Then I configure the GlobalProtect Portal (outside interface, auth profile, gateway list/priorities) and the GlobalProtect Gateway, enable the tunnel, create a VPN zone, and define an IP pool for remote users. Finally, on the client side I install GlobalProtect, handle the certificate trust issue, connect to the gateway, confirm the assigned IP, and verify the session from the firewall under Gateway > Remote Users.