GlobalProtect remote access: portal, gateway, authentication and split tunnelling

Calder's sales team works from customers' sites and needs the intranet (web01) and the depot LAN, but nothing else, through the company. You'll build GlobalProtect on FW1's internet interface:

• portal and gateway on 203.0.113.2, with a certificate for gp.calder.lab;
• users authenticated against the local user database (alice / Alice-Access-5);
• remote users get an address from 10.9.9.0/24 and routes only for 10.1.1.0/24 and 172.16.1.0/24 (split tunnel). Their own internet traffic stays local.

The Internet node plays alice's laptop. The lab images include no GlobalProtect app, so that node has three small commands written for this lab:

• gp-check walks the HTTPS conversation an app has with the portal and gateway, and prints what each step returns.
• gp-connect does the same, then builds a real SSL tunnel to the gateway as an interface called gp0, so you can send traffic through it.
• gp-disconnect logs out and closes the tunnel.

They aren't the GlobalProtect app. They use SSL only, where the app tries IPsec first; they send no host information (HIP) report; and they don't check the firewall's certificate.

Before you start. Start all the nodes. The firewall takes 6-8 minutes to boot and comes up with this lab's starting configuration already loaded. Wait until the FW1 console shows FW1 login:, then log in as admin / Lab-Access-1. Until the management plane is ready it answers Login incorrect, even with the right password. The Linux hosts are ready within seconds.