topic Multiple bogus credentials on GP portal in GlobalProtect Discussions

Multiple bogus credentials on GP portal

S_Williams901 — Sat, 13 Apr 2024 16:20:58 GMT

I have noticed there are alot of random IPs that are trying to login to my GP portal. We are using pre-login method of GP so legit users do not login. GP starts and does an auto-login pre-windows login. The logs tell me these failures are coming from GP portal. They are not getting anywhere since a trusted cert on legit users PCs is required, but is there anyway to stop this from happening? Anyway to prevent users from trying to access my GP portal or gateway?

Re: Multiple bogus credentials on GP portal

TomYoung — Sun, 14 Apr 2024 00:15:22 GMT

Hi @S_Williams901 ,

You could ...

Disable the Portal Login Page under the General tab. That will stop the vast majority.
Deny all countries to your GP portal and gateway except the ones you want.
Deny all protocols to your GP portal and gateway except panos-global-protect and ipsec-esp-udp.
Deny PANW and 3rd party EDLs inbound.

Obviously you would need to enable the portal login page and ssl if you want to download the client. (Technically, the portal login page is not required if you go to yourdoamin.com/global-protect/getsoftwarepage.esp, but that is another story.)

Thanks,

Tom

Re: Multiple bogus credentials on GP portal

S_Williams901 — Thu, 18 Apr 2024 16:48:09 GMT

Nothing stops a user from downloading a gp client somewhere on the internet and trying to hit my gateway with bogus usernames correct?