Android app directory · VPN and access
These are the app restrictions Palo Alto Networks documents for GlobalProtect on Android when it is managed by a third-party MDM. They let IT point the app at the right portal, sign people in with a certificate, decide when the VPN connects and limit the tunnel to chosen apps. The connect method you set here takes priority over the one in the portal.
Nomidcom.paloaltonetworks.globalprotect Common setups
Copy a setup into the managed configuration of a policy, then adjust the values. Each one uses only keys explained below.
Point the app at the portal, authenticate with a certificate and connect without any action from the person.
{
"portal": "vpn.example.com",
"certificate": "MIIC...",
"client_certificate_passphrase": "changeme",
"connect_method": "user-logon"
}Only the listed apps go through the tunnel. Personal apps keep using the normal connection. On Android, opening a listed app does not start GlobalProtect by itself.
{
"portal": "vpn.example.com",
"connect_method": "user-logon",
"app_list": "allowlist:com.example.erp;com.example.crm"
}Remove what was pushed earlier, for example when a device is reassigned to someone on another portal.
{
"remove_vpn_config_via_restriction": true
}Managed configuration
Key names and value types come from the vendor’s documentation. The explanations are written by Nomid.
| Key | Type | What it does | Example |
|---|---|---|---|
| Portal and sign-in | |||
portal | Portal address | The IP address or hostname of the GlobalProtect portal the app contacts first. It saves people from typing it. | vpn.example.com |
username | User name | Pre-fills the user name for sign-in. With an MDM that supports variables you can insert the person's own user name. | jsmith |
password | Password | Pre-fills the password. Avoid it when you can use a client certificate instead, because the value is stored in your MDM configuration. | |
certificate | Base64 client certificate | A client certificate, Base64 encoded, that the app uses to authenticate to the portal and gateway. | MIIC... |
client_certificate_passphrase | Certificate passphrase | The passphrase that protects the client certificate pushed in the certificate key. | |
mobile_id | Device ID from your MDM | A unique identifier your MDM assigns to the device. GlobalProtect uses it to look up information about the device. | device-0042 |
| Connection behavior | |||
connect_method | Choice: user-logon or on-demand | With user-logon the app connects by itself. With on-demand people connect manually. This value overrides the portal setting. | user-logon |
app_list | allowlist: or blocklist: plus package names | Turns on per-app VPN. Start with allowlist: or blocklist: and separate package names with semicolons. Apps not named in either list do not use the tunnel. | allowlist:com.example.erp;com.example.crm |
remove_vpn_config_via_restriction | On or off | Permanently removes the GlobalProtect VPN configuration that was pushed to the device and puts the app back to its original settings. | false |
Deploy with Nomid
Find it on Google Play from the policy’s apps list and choose how it is installed.
In the policy, set the app’s managed configuration with the keys and values from this page.
Devices in the policy receive GlobalProtect and its configuration on their next sync.
Questions
com.paloaltonetworks.globalprotect. Use it to find the app when you add it to a policy.
Yes. Palo Alto Networks documents that the connect_method set through the MDM takes precedence over the one defined in the portal configuration.
Set app_list to allowlist: followed by package names separated by semicolons. Since PAN-OS 10.1 the keywords are allowlist and blocklist without a space.
Prefer certificates. A password in an MDM configuration is readable by anyone who can see that policy.
Add the app to a Nomid policy, set its configuration and choose its permissions.
