In Day 47 of my PCNSA series, I show you a real-world style GlobalProtect setup where the Portal and the Gateway are on different Palo Alto firewalls. In my earlier videos I configured portal and gateway on the same device, but in industry you will often see them separated. Here the client first connects to the Portal, and the Portal redirects the client to the correct Gateway. After that, the client initiates the GlobalProtect (IPSec) VPN tunnel with the Gateway and all further inside access goes through the Gateway. In the lab, I keep the topology simple so you focus on the concept and traffic flow. I configure the Portal interface (outside) with DHCP, generate a certificate for the Portal (I use IP address because I don’t have FQDN), create a local user and authentication profile, and build the Portal config including the external gateway IP mapping. Then on the Gateway side I align the authentication to local database as well. Finally, from the client I connect using the Portal IP, install the certificate to trusted to avoid warnings, authenticate with my test user, and verify that the actual connected gateway IP is different from the portal. I also quickly validate the flow using packet capture/streams to show portal-first, gateway-next behavior—very useful for troubleshooting mindset.