topic Re: disabling global protect web portal in General Topics

disabling global protect web portal

nevolex — Mon, 20 Mar 2023 08:04:44 GMT

hi team

is there a way to disable global protect web portal only leaving the actual vpn gateway functioning?

thank you

Re: disabling global protect web portal

nevolex — Mon, 20 Mar 2023 10:04:09 GMT

Hi, thanks for the comment, I was meant to say how to disable the web portal itself (from the firewall side), so palo alto does not listen on 443 to launch the webpage once url us entered

Re: disabling global protect web portal

MP18 — Mon, 20 Mar 2023 10:16:46 GMT

@nevolex I do not think it is possible by design to do this.

As GP uses IPSEC/SSL connection to work.

Regards

Mahesh

Re: disabling global protect web portal

nevolex — Fri, 24 Mar 2023 21:04:04 GMT

it is very possible

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClbpCAC

Re: disabling global protect web portal

MP18 — Sat, 25 Mar 2023 20:11:29 GMT

@nevolex

As per my understanding the user is asking if Portal config is not there not the login page.

Thanks for the reply.

Regards

Mahesh

Re: disabling global protect web portal

Raido_Rattameister — Sun, 26 Mar 2023 01:00:59 GMT

Initially GlobalProtect agent will connect to portal and get list of gateways.

After that GlobalProtect agent will establish VPN tunnel to one of gateways (if all gateways have same priority then latency is deciding factor which gateway is chosen).

GlobalProtect agent will then cache this list of gateways. By default for 24 hours before it needs to talk to portal again.

You can disable portal web login but portal itself needs to exist (as mentioned in link shared previously).

Re: disabling global protect web portal

JordanScott — Wed, 17 May 2023 13:07:08 GMT

This was the solution I was looking for and worked for me. Thank you!

Re: disabling global protect web portal

Flang3r — Fri, 08 Sep 2023 13:52:43 GMT

Is it possible to keep GP portal (and login page), but disable it listening on port 80 so it only listens on 443?

Re: disabling global protect web portal

Raido_Rattameister — Fri, 08 Sep 2023 15:17:41 GMT

Port 80 will redirect to 443 by default.

If you don't like 80 to be open then don't add this port into firewall rule that permits traffic from Internet towards GlobalProtect Portal.

Re: disabling global protect web portal

Flang3r — Fri, 08 Sep 2023 16:29:57 GMT

The thing is, I don't have any rule in firewall policy exclusively permitting anything from internet to outside facing interface, that GP portal/gateway run on. Furthermore if I watch traffic log and telnet to public_ip:80, I don't even see that flow logged, although every rule including explicit deny any rule in the end for all to all zones have logging enabled. I can see successful/failed VPN activity on GlobalProtect log page though.

Re: disabling global protect web portal

Raido_Rattameister — Fri, 08 Sep 2023 16:47:56 GMT

If you don't have "Block Any" rule at the end then traffic from outside zone to outside zone is permitted by default rule "intrazone-default".

As step one select intrazone-default rule, click "Override" at the bottom and check "Log at Session End" on Actions tab to enable logging on the rule.

Re: disabling global protect web portal

Flang3r — Fri, 08 Sep 2023 17:13:32 GMT

I do have deny any configured exclusively in the end with logging enabled. Could this be something related to firewall being a VM version? Also PA VMs don't have an override option for their default rules.

Re: disabling global protect web portal

ZachHeise — Mon, 16 Sep 2024 19:56:29 GMT

We found nevolex's link as well - but the problem is that in our portal configuration, the "Disable" option is outright missing, we only have "factory-default" on all our portals. How do we add Disable as an option? We have an 'import' button too though..... but is disabling a portal something we need to import??

edit: oh good grief I just noticed the "disable" option is under "portal login page" NOT "portal landing page" - the image on the article confused me, since the dropdown is extended, it looked as if I should be finding the option to Disable on Portal Landing. All set.