policy to only allow specific Host-ID auth thru GlobalProtect.

logmpang — Fri, 31 Mar 2023 05:33:18 GMT

i'm seeing bad guys trying to bruteforce my GlobalProtect VPN and I want to stop that.

I want to achieve only specific laptop Host-ID can go thru GlobalProtect authentication and bad guys when they trying to auth with wrong account/pwd should not able to or GlobalProtect shall not prompt 'wrong account/password'.

Can I do this via policy?

Re: policy to only allow specific Host-ID auth thru GlobalProtect.

TomYoung — Mon, 03 Apr 2023 10:47:16 GMT

Hi @logmpang ,

The common solution to this issue is to deploy certificates to the hosts and require certificate AND username/password for GlobalProtect. The GlobalProtect client will check for the certificate 1st. If it does not exist, an error will be displayed instead of the username/password prompt. You can use the same certificate for each client or a unique certificate for each client.

Make sure that you configure "No (User Credentials AND Client Certificate Required)" under the client authentication entry on the portal.

Thanks,

Tom

topic Re: policy to only allow specific Host-ID auth thru GlobalProtect. in GlobalProtect Discussions

policy to only allow specific Host-ID auth thru GlobalProtect.

Re: policy to only allow specific Host-ID auth thru GlobalProtect.