GlobalProtect M&A reference architecture
Remote-access pattern for absorbing acquired networks without collapsing address space or trust.
--- title: "GlobalProtect M&A reference architecture" summary: "Remote-access pattern for absorbing acquired networks without collapsing…" stack: ["GlobalProtect", "Routing", "Identity"] relevance: "A repeatable integration path instead of a bespoke one per acquisition." featured: false section: work ---
Every acquisition is the same three problems
An acquired network arrives with overlapping RFC 1918 address space, a second identity store that does not federate with yours, and a trust posture nobody has assessed. The details differ each time; the shape does not.
Treating each acquisition as a new design problem means re-deriving the same answers under deadline, which is how integrations end up with permanent exceptions in them.
Address space
Renumbering the acquired network is the clean answer and it is almost never available — the integration has a date, and renumbering does not fit inside it.
The pattern therefore assumes overlap and handles it at the access layer: remote-access clients are assigned from a coordinated pool that is unique across the merged estate, and translation is applied per destination segment rather than as a blanket rule. The acquired environment renumbers on its own schedule, if it ever does, without holding up access.
Identity
Authentication is three-factor: a device certificate, SAML to the enterprise IdP, and MFA. The certificate settles whether the endpoint is a managed one before any credential is offered, which matters most during the window when acquired hardware is still being enrolled and the population is mixed.
Authorization resolves against the acquiring organization's IdP from day one. The acquired directory is a source to migrate from, not a second authority to trust — federating the two and sorting it out later grants that directory authority over the merged estate before anyone has audited how it issues accounts.
Transport and posture
The gateway offers SSL and DTLS only; IPsec is disabled. DTLS carries the steady state and SSL is the fallback for networks that block or throttle UDP, which an acquired network's egress rules frequently do before anyone has mapped them. Leaving IPsec off removes a negotiation path that would otherwise need assessing site by site.
Tunnel mode follows endpoint posture rather than a per-user setting. HIP checks decide whether a session gets a split tunnel or a full tunnel, so a device that fails a posture requirement is narrowed automatically instead of becoming an exception somebody has to remember.
Trust staging
Connectivity and trust are granted separately and on different schedules. The first stage gives the acquired users reachability to a defined set of applications and nothing else. Broader access follows assessment, one segment at a time.
Staging it this way also means the integration has a defensible state at every point, rather than a cutover that is either not started or complete.
Why a reference architecture
The output is a pattern with the decisions already made and the reasoning attached, not a diagram. Each acquisition supplies its own inputs — address ranges, application inventory, identity source — and follows the same path.
A repeatable integration path is auditable in a way that a series of bespoke designs is not.