topic Re: Global Protect Portal Policy - Application Default breaks access in General Topics

Global Protect Portal Policy - Application Default breaks access

MGoodnow — Mon, 29 Apr 2013 18:51:10 GMT

Hello,

I have a Global Protect Portal setup which works properly with a policy set for the App-IDs of "SSL", "Web-Browsing" and "PANOS-Global-Protect" and "any" Service. If I set service to "Application-default" - the portal login page no longer displays. The logs then show that SSL (443) was "Allowed" and Web-Browsing (443) is "Deny".

Is there a particular reason that using the "application-default" with the APP-ID access policy for Global Protect, would not work? Thanks!

Cheers,

Mike

Re: Global Protect Portal Policy - Application Default breaks access

zarina — Mon, 29 Apr 2013 21:12:20 GMT

It might be because you have decryption enabled and since the default port for web-browsing is not 443, its getting blocked. You have disable decryption for your portal page or allow web browsing on 443

Re: Global Protect Portal Policy - Application Default breaks access

MGoodnow — Thu, 09 May 2013 15:40:25 GMT

Hello,

No decryption enabled at this time. That does make sense about the 443 not working within "web-browsing". I had assumed the APP-ID for the Global-Protect would contain the ports/signatures to allow Application Default to function. I will lock it down by specific ports for the apps.

Mike