topic Re: Global Protect HIP Check and AD Computer Account in GlobalProtect Discussions

Global Protect HIP Check and AD Computer Account

BusanaB — Tue, 11 Jul 2023 11:31:32 GMT

Hello,

I'm currently trying to restrict Global Protect users from logging into the Portal or Gateway with unauthorized devices.

In our setup, all devices that are allowed to connect (mobile, laptops, desktops, etc.) are listed in an Active Directory OU (computer account).

I have been unable to find any information on how to configure this restriction in the official documentation or through online resources.

Is it possible to implement this limitation?

Thanks,

Re: Global Protect HIP Check and AD Computer Account

TomYoung — Thu, 20 Jul 2023 02:12:47 GMT

Hi @BusanaB ,

One method you could use is to verify the domain retrieved under host info:

If the domain matches the HIP object, then it is a device in the domain.

Thanks,

Tom

Re: Global Protect HIP Check and AD Computer Account

GOMEZZZ — Thu, 20 Jul 2023 22:43:04 GMT

Hi,

The most secure way of checking this I using certificates, checking if the connecting client is using a certificate distributed by your companies PKI.

https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/authentication/set-up-client-certificate-authentication

You can even deploy separate certificates per device type using extended key usage and check on the specific OID. (Microsot PKI)

On top of the client cert user or machine cert you add SAML/LDAP/RADIUS authentication.

Or you can do the check for allowed on you authentication backend RADIUS (NPS/ISE). But this will not disallow users from connecting to portal and trying to authenticate on it. Can only be achieved with certificates.