topic Re: Dual ISP in General Topics

Dual ISP

infotech — Thu, 21 Aug 2014 13:51:00 GMT

My main PA is configured for dual ISP's and I am going to put third party certs for my global protect clients. Do I put two certs on? One for each ISP?

Re: Dual ISP

HULK — Thu, 21 Aug 2014 14:42:23 GMT

Hello Infotech,

You can use the same cert for both ISP.

Thanks

Re: Dual ISP

infotech — Thu, 21 Aug 2014 15:40:35 GMT

Even if the url and IP address are different?

Re: Dual ISP

HULK — Thu, 21 Aug 2014 15:43:37 GMT

it might give you a certificate CN mismatch warning.

Re: Dual ISP

HULK — Thu, 21 Aug 2014 15:56:25 GMT

You can follow the suggestion given by Steven Pulika in the other discussion thread.

Re: Dual ISP

jtyler — Fri, 22 Aug 2014 14:12:12 GMT

infotech,

Think of a certificate as belonging to a FQDN - you should have one certificate per FQDN. For example, many people create an A record in their external DNS server for vpn.mycompany.com - then purchase a certificate for vpn.mycompany.com. Via DNS, you can modify the IP behind that URL at anytime, but the certificate will always match the URL.

If you have two separate URLs with different FQDNs, you will need two separate certificates. If you have one FQDN but two IP addresses, you only need one certificate.

Re: Dual ISP

infotech — Mon, 25 Aug 2014 17:17:14 GMT

So if I use the ip address instead of the FQDM it gives me the cert error but I can go ahead and click continue and it still works right? But if I use the FQDn it doesn't give me an error and passes me on to where I am going. Other than the annoying message how is that batter?

Re: Dual ISP

hshah — Mon, 25 Aug 2014 17:27:48 GMT

Hello Infotech,

Yes you are right, its just an cert error, and it will still work. There is a logic behind error.

If user tries to access Site through IP and cert has FQDN than user gets warning that "He might be connected to wrong site because certificate has different CN(FQDN) name".

Basically software is trying to inform user that he might be connecting to fake site. So, now user has chance to relook URL and certificate details to validate the same.

Sometimes Hackers change DNS records. Lets say they change DNS record for bankofamerica.com and point it to their server. Now user is connecting to https://bankofamerica.com, he connects to hackers server. But hackers server gives certificate with different CN name.

Now software prompts user to check certificate, based on certificate CN name he can determine its an attack. So its security mechanism.

Regards,

Hardik Shah

Re: Dual ISP

infotech — Mon, 25 Aug 2014 19:29:59 GMT

Well if I am trying to connect through a global protect client does it really matter if the get the error and have to hit continue. It seems like it would be more usefull if they were found not to have the correct cert on them they would be denied access.

Remoting to a network using global protect is different that going to a wrong web site.

Re: Dual ISP

hshah — Mon, 25 Aug 2014 19:33:32 GMT

Hello Infotech,

GP and accessing website follows same logic as long as certificate is considered.

In your case certificate error doesnt matter, user can still access GP, he just need to accept warning. Let me know if you have further query.

Regards,

Hardik Shah

Re: Dual ISP

HULK — Mon, 25 Aug 2014 19:41:57 GMT

Hello Infotech,

You have an option in GP configuration, if the portal certificate is invalid, the user will not be able to connect to the GP.

FYI:

Thanks

Re: Dual ISP

infotech — Mon, 25 Aug 2014 19:45:34 GMT

Where is the setting located at hulk I don't see it

Re: Dual ISP

HULK — Mon, 25 Aug 2014 19:48:06 GMT

Go to Network > Global Protect > Portal >Agent configuration. There you will get these options.

Thanks

Re: Dual ISP

infotech — Mon, 25 Aug 2014 19:49:11 GMT

I went there and I don't see it

Re: Dual ISP

HULK — Mon, 25 Aug 2014 19:56:09 GMT

Could you please share a screenshot.

Re: Dual ISP

infotech — Mon, 25 Aug 2014 20:30:34 GMT

what are you referring too when you say external DNS server?

Re: Dual ISP

HULK — Mon, 25 Aug 2014 20:30:54 GMT

Could you please login as admin user and verify this option.

Thanks

Re: Dual ISP

infotech — Mon, 25 Aug 2014 20:54:31 GMT

Same options when I log in as an admin and my PA version is 5.06