Palo Alto Remote Access VPN for Android

For a basic remote access VPN connection to a Palo Alto Networks firewall (called “GlobalProtect”), the built-in VPN feature from Android can be used instead of the GlobalProtect app from Palo Alto itself. If the additional features such as HIP profiling are not needed, this variant fits perfectly.
I am showing a few screenshots and logs from the Android smartphone as well as from the Palo Alto to show the differences.

This post is very similar to the post about the iPhone. I am running a PA-200 with PAN-OS version 7.0.3. The phone is a Samsung Galaxy S4 Mini with Android version 4.4.2.
The GlobalProtect app from Palo Alto works without any problems if a correct Portal and Gateway are already configured. In order to use the native “IPSec Xauth PSK” on Android, the “X-Auth Support” must be enabled on the GlobalProtect Gateway, such as shown here in my post about the Linux vpnc client.

GlobalProtect App vs. Native VPN

The following Android screenshots show the configuration steps for the native IPsec VPN tunnel. The “IPSec Xauth PSK” type must be chosen:

Choose “IPSec Xauth PSK” as type.

Enter the “Group Name” and “Group Password”, as it is called by Palo Alto.

And, of course, the user login.

Just for a comparison: The GlobalProtect app looks like that:

GlobalProtect app.

Connect.

Status.

Palo Alto Logs

It is interesting to see the differences in the Palo Alto logs, i.e., the GlobalProtect Previous User, System Log and Traffic Log. Here are the differences:

GlobalProtect Previous User: The native Android client does not reveal the “Client” version.

System Log: The differences are highlighted.

Traffic Log: In my case, the native Android client was recognized as “ciscovpn”, while the GlobalProtect app as “panos-globa-protect” and “web-browsing” on port 443 (!).