topic How to restrict GP Portal authentication to specified countries in GlobalProtect Discussions

How to restrict GP Portal authentication to specified countries

bpotter98 — Wed, 22 Nov 2023 16:08:08 GMT

I'm seeing multiple failed login attempts from China & Russia. I know I can restrict access to source countries with GP Gateway which I'm currently doing but how can I do this with the Global Protect Portal?

Re: How to restrict GP Portal authentication to specified countries

Major2375 — Thu, 23 Nov 2023 07:41:40 GMT

Hi,

the Region configuration is under GP portal, im guessing that you meant that you want to configure the region under the gateway?
you can configure a policy rule for the gateway to not allow traffic from certain country's.

the region configuration under portals->agent-external is not enabling any users from those chosen country's to connect to the portal.

hope that i made things clear, im here for more questions

thank you.

Re: How to restrict GP Portal authentication to specified countries

bpotter98 — Mon, 27 Nov 2023 17:39:54 GMT

Hi, no, what I'm asking about is restricting the web portal for the GP Portal based on source location. So far I've just disabled Portal Login Page found under Network > GlobalProtect > Portals > General > Appearance. I'm already doing geographic restrictions from the portal to the GlobalProtect Gateways. I do like to have the Portal Login Page enabled just for testing and allowing for vendors to grab our latest Global Protect Agent.

Re: How to restrict GP Portal authentication to specified countries

TomYoung — Tue, 28 Nov 2023 17:14:28 GMT

Hi @bpotter98 ,

Traffic from the untrust zone to the interface in the same untrust zone is allowed by the intrazone-default rule. The easiest way to solve your problem is to create a drop rule (which will be above intrazone-default) that will drop all countries you do not want.

Rule Type: intrazone

Source Zone: Untrust

Source Address: List you countries you want to allow and check Negate.

Destination Address: Portal IP (could also be any if you want to block for all public IP addresses)

Application: Any

Service/URL Category: Any

Action: Drop

You can choose not to log if you don't want the clutter, but you may need to enable for troubleshooting.

Thanks,

Tom

Re: How to restrict GP Portal authentication to specified countries

bpotter98 — Tue, 28 Nov 2023 17:18:27 GMT

I will give that a try. Thank you!