topic Re: Global Protect Clients connection Policies through the NGFW in Prisma Access Discussions

Global Protect Clients connection Policies through the NGFW

Vachy — Tue, 07 Feb 2023 23:40:04 GMT

Hi, Comunity,

I'd like to ask your advice.
Is there any instruction somewhere on how to do the best set of the rules on Firewall PAN to only allow traffic for global protect clients?
The clients are on a normal network with DHCP. They have DNS from AD server.
I want the client to get to the Internet only via Prisma Access/ This means that the client passes through a firewall that only allows access to Mobile Users Gateways.

I have found via API in Panorama/Cloud Plugin GW addresses, Portals and even IP ranges. I gradually prepared the rules.
I still have a problem with this. After setting the rules it works. However, the next day it doesn't.

Thank you

Re: Global Protect Clients connection Policies through the NGFW

nikoolayy1 — Tue, 14 Feb 2023 09:21:34 GMT

You can try on the Firewall to create a policy rule that allows only the Globalprotect Application from your source IP addresses/username/ad groups as a workaround.

Outside of that better make a server that pulls your Prisma Access endpoint addresses using the API as you already saw and then make an External Dynamic List that the Palo Alto Firewalls can ingest but will be complex. You can alse feed in the firewalls using their API and and modify the address object. As Prisma Access addreses change better pull the data every maybe 10 minutes.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/external-dynamic-list

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-panorama-api/get-started-with-the-pan-os-rest-api/work-with-address-objects-rest-api

The API to retrive the Prisma Access addresses:

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-panorama-api/get-started-with-the-pan-os-rest-api/work-with-address-objects-rest-api

Re: Global Protect Clients connection Policies through the NGFW

Vachy — Tue, 14 Feb 2023 12:34:23 GMT

Thank you for your advice. However, it looks like the problem is in Authentication.
The GP client logs in and receives a cookie for 24 hours. However, after expiring this cookie, it is unable to re-authenticate.
I'll try enabling SAML portal now and see what happens.

Re: Global Protect Clients connection Policies through the NGFW

nikoolayy1 — Tue, 14 Feb 2023 20:04:59 GMT

Also check if the cookies are correctly configured as maybe the portal cookie timeout is different of the gateway one:

How to generate cookies on GlobalProtect Portal and use cookies for Gateway Authentication

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boODCAY

GlobalProtect portal and gateway authentication override cookie lifetime does not expire or last for set lifetime

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004NCxCAM&lang=en_US%E2%80%A9