topic Re: Portal url for VPN gateway no authentication in GlobalProtect Discussions

Portal url for VPN gateway no authentication

MRamadanAHafiez — Sat, 20 Nov 2021 15:48:41 GMT

Hello Bros'

I have a strange issue "As I think it is issue". Our configured Portal for downloading the GlobalProtect gateway for our VPN connected employees supposed to authenticate firstly so that if from any where use internet brower https://x.y.z.k "portal address" we acccept the certificate, then authenticate normally "name/password".

But:

if we copy the browser URL "after authentication process" and past it later on any other browser on any other PC, the URL directly and without any authentication open to the GlobalProtect downnload page.

I belive this is not normal behaviour even if this page for only downloading the available from any where else agent software.

Id this acceptable? how to correct this if it's an issue?

TIA.

Re: Portal url for VPN gateway no authentication

BPry — Sat, 20 Nov 2021 16:35:53 GMT

@MRamadanAHafiez,

This is by design, that agent download page itself isn't actually restricted at all. While I would personally consider that to be bad design, it isn't something that you can change. While this means that anyone can download the agent from your portal without entering in a username/password and authenticating, it doesn't allow someone to connect to your gateway without actually authenticating and gaining access to your network.

Re: Portal url for VPN gateway no authentication

MRamadanAHafiez — Sun, 21 Nov 2021 07:06:52 GMT

@BPry From that I conclude that this is by design and no security c oncerns. "Kindly, confirm"

Thank you so much.

Re: Portal url for VPN gateway no authentication

BPry — Sun, 21 Nov 2021 21:05:20 GMT

@MRamadanAHafiez,

It's by design. The only security concern that would really be raised by this is that someone could use it to launch a DoS attack against your GlobalProtect portal by downloading those files from a bunch of different sources and use it to assist in overwhelming your firewall or internet circuit.