topic Re: Blocking a host name to access global protect gateway? in GlobalProtect Discussions

Blocking a host name to access global protect gateway?

tinhnho — Thu, 27 Feb 2025 03:39:27 GMT

Edit: I figured it out.

Re: Blocking a host name to access global protect gateway?

JayGolf — Wed, 02 Oct 2024 18:27:49 GMT

You can't block via hostname, but you can via IP. Are you saying that there is a user within your org that is using the same username as you and is trying to login?

Re: Blocking a host name to access global protect gateway?

tinhnho — Wed, 02 Oct 2024 21:02:10 GMT

Hi JayGolf,

No, no one from my organization is using the same username as me to try to log in.

There are many attempts from same hostname 'my laptop' that uses different usernames (most of the username are bogus) with different ip addresses. I found a URL below that mentions block a hostname on PanOS 9.1 https://origin-docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/globalprotect/network-globalprotect-block-list

I block multiple IP addresses of that specific hostname but but he always have new IP addresses everytime he attempts.

If we can block a hostname, we maybe able to stop these attempts. I wonder if there is a way.

Re: Blocking a host name to access global protect gateway?

riley-wirtz — Wed, 16 Oct 2024 14:16:34 GMT

Our org is also experiencing this. 4-5 different host-names like "mypc" with hundreds of bogus usernames from hundreds of ips (typically hosting providers and never residential public ips)

If palo doesn't have a solution i might look into using our siem and create a rule that matches traffic from the malicious host-name to our vpn ip/fqdn and dump the malicious ips into an existing ip-block-list EDL.

At least that way the ips are dynamically added and blocked.

Keep me posted if you find something though!