Palo Alto Tech Tips for Global Protect Cloud Service

### Overview In this Palo Alto Tech Tip edition, Tony Tanzi, a partner architect for Optiv focusing on Palo Alto Networks, introduces GlobalProtect Cloud Service (GlobalProtect as a service). The offering is designed to help organizations manage GlobalProtect deployments across distributed environments, specifically addressing the security and operational challenges associated with supporting both remote networks and mobile users.

### Key Topics - **Distributed Workforce and Security Challenges**: Organizations face difficulties maintaining consistent security policies across headquarters, remote branches, and mobile users. Traditional solutions such as traffic backhauling or hair-pinning lead to high costs and poor performance. In contrast, deploying disconnected point products at remote sites results in inconsistent security posture and operational overhead, while mobile users frequently bypass protections entirely. - **GlobalProtect Cloud Service Solutions**: The service delivers unified policy enforcement across devices and locations without requiring complex on-premises hardware footprints at branch sites. - **Shared Ownership Model**: Palo Alto Networks handles the underlying cloud infrastructure (ensuring availability, scalability, and reliability), while the customer retains control over policy creation, authentication, and log analysis. - **Centralized Management via Panorama**: Customers can manage the cloud service alongside their existing physical and virtual firewalls directly within Panorama, reusing established configuration objects and policies.

### Technical Details - **Mobile User Connectivity**: Connects endpoints using the GlobalProtect app installed on user devices, ensuring consistent corporate threat protection and access policies regardless of user location. - **Remote Network Connectivity**: Remote branch networks connect to GlobalProtect Cloud Service using standard IPSec VPN-capable devices or SD-WAN. - **Integration and Threat Intelligence**: Leverages Panorama for centralized policy definition and integrates with tools such as AutoFocus for threat intelligence across the next-generation security platform. - **Licensing Structures**: - *Remote Networks*: Licensed via an aggregated bandwidth pool divided among branch locations, with tiers ranging from 200 Mbps to over 10,000 Mbps. - *Mobile Users*: Licensed based on user count, offering tiers ranging from 200 users to more than 50,000 users.

### Takeaways GlobalProtect Cloud Service eliminates the trade-off between performance penalties from backhauling and policy fragmentation from disparate point products. By offloading infrastructure operations to Palo Alto Networks while retaining policy control and object reuse in Panorama, organizations can achieve consistent security prevention across all endpoints and remote offices.