topic Re: Use HIP to deny logon to PA with exception in Prisma Access Discussions

Use HIP to deny logon to PA with exception

Thrace — Fri, 21 May 2021 15:46:28 GMT

Has anyone effectively used HIP to deny login to Prisma Access? One of the biggest challenges we had with AnyConnect (and a large reason we are moving away) is that there were no native methods for controlling which device a user was connecting with.

I have built a Security Pre-Rule that references the Domain-joined HIP Policy, and I can see the matches in our monitor tab. I would like to deny logon to anyone who does not satisfy this rule EXCEPT those who are members of a specific Active Directory user group.

I figure the rules would look something like this:

1) HIP Match on domain = allowed to connect to Portal URL

2) Match on security group membership = allowed to connect to Portal URL

3) Deny all connections to Portal URL.

Can anyone confirm that this would be effective?

Re: Use HIP to deny logon to PA with exception

NikolayDimitrov — Fri, 06 Aug 2021 12:33:01 GMT

Have you checked the article below?

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/redistribute-hip-information-and-run-hip-reports.html

For using HIP in the security policy :

https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/host-information/configure-hip-based-policy-enforcement.html

Re: Use HIP to deny logon to PA with exception

nikoolayy1 — Mon, 09 Aug 2021 13:06:40 GMT

Also before that make a rule with the correct groups so that you don't match the blocking rule:

How to Add Groups or Users to Security Policy - Knowledge Base - Palo Alto Networks