GlobalProtect: portal, gateways (internal/external), authentication, connect methods (user-logon, pre-logon, on-demand), split tunneling, HIP objects and profiles, IPsec vs SSL tunnels

GlobalProtect extends firewall policy to users wherever they are. It has three parts: the portal, one or more gateways, and the GlobalProtect app on endpoints. The portal is the first contact point: the app authenticates to it and downloads its configuration, including the list of gateways, the connect method, split tunnel behavior and HIP (Host Information Profile) collection settings. The portal is configured under Network > GlobalProtect > Portals on a Layer 3 interface or loopback, with an SSL/TLS service profile that supplies its certificate.