Zero Trust Access (ZTA) for allowing server administrator to securely connect to servers.
Currently, supported platforms as below:
1. For Computers running Microsoft Windows or Mac OS
2. For iPad/iPhone devices running iOS
4. Frequently Asked Questions (FAQs)
link on the top menu.
| Computers | Download Option |
| For 32-bit Windows O/S | Download Windows 32-bit GlobalProtect agent |
| For Windows 10 and above | Download Windows 64-bit GlobalProtect agent |
| For Apple Mac O/S 13 and above | Download Mac 32/64-bit GlobalProtect agent |
.
There are two types of access according to the "endpoint compliance check" result of the user's computer or mobile device.
(1) Admin Access: For computers and mobile devices with successful endpoint compliance check, the users can have required administrative access to the servers (e.g. RDH, SSH).
(2) General Access: For computers and mobile devices without successful endpoint compliance check, they can have web-console access to servers via the HTTPS.
For Administrative Access - Agent Access with Compliance Check
| # | App/Resources | Access From | Access To | OS | Endpoint Compliance Check |
| 1 | Admin Access (RDP, SSH, Ping, Traceroute) Web Console Access (443) |
Campus/ Remote Access |
Server Farm | Windows 10 or above. macOS 13 and above |
1. Anti-Malware: Installed. Real-time Protection enabled. Signature within 7 days 2. Patch Management: Installed and Enabled. |
| 2 | Admin Access (RDP, SSH, Ping, Traceroute) Web Console Access (443) |
Campus/ Remote Access |
Server Farm | Apple iOS/iPadOS | *not jailbroken |
For General Access - Agent Access WITHOUT Compliance Check
| # | App/Resources | Access From | Access To |
| 3 | Web Console Access via SSL | Campus | Server Farm |
| 4 | Web Console Access via SSL | Remote Access | Server Farm |
| 5 | RDP, SSL, web browsing | Remote Access | Campus |
Q3: Will PA Zero Trust Access replace FortiClient VPN?
Q1: My computer is running Microsoft Windows. Which one should I install among the "Windows 32-bit GlobalProtect agent" and "Windows 64-bit GlobalProtect agent"?
A1: Most modern PCs are pre-installed with 64-bit Windows operating system. If you want to confirm which version of Windows you are using, you may use the following steps:
Q2: We are system administrators. Do we have the same access right after switching from FortiClient VPN to PA Zero Trust Access?
A2: Based on existing firewall rule policies and traffic information, system administrators are granted with similar access rights as FortiClient VPN to access the server farm. If you cannot access some servers after switching to PA Zero Trust Access, please contact CSC Network Team to check.
Q3: Will PA Zero Trust Access replace FortiClient VPN?
A3: Yes, we plan to replace FortiClient VPN this year.
Q4: I cannot successfully re-install the new GlobalProtect agent because my computer has installed old GlobalProtect software. What should I do?
A4: You should uninstall the old GlobalProtect agent before installing the new GlobalProtect agent.
Q5: My computer should have met the compliance requirement (installed anti-malware software, enabled real-time protection with updated signature and enabled patch management). But when I connect to the ZTA service at the first time, the "Your device is not complied" warning message is shown. What should I do?
A5: Please disconnect from GlobalProtect and reconnect again.
Q6: On Windows, the GlobalProtect software hanging and show connecting but not connected and could not manually refresh/disconnect the attempt.
A6: Open the "Task Manager" and kill the process "Global Protect client" via "End task", the Global Protect agent will re-run, and you can try to connect again.
IT.ServiceDesk@cityu.edu.hk
