topic Re: GP VPN client vs native OS VPN client in General Topics

GP VPN client vs native OS VPN client

jdprovine — Tue, 14 Jul 2015 14:23:57 GMT

I am trying to decide whether to put global protect clients on all the users or just use the native VPN client included in the OS. Is there an advantage to using the GP client over a native client

Re: GP VPN client vs native OS VPN client

bmorris1 — Tue, 14 Jul 2015 21:42:40 GMT

Hello jprovine,

You will need to install the client in order to establish the VPN. Luckily it can be easily distributed to your users with a GPO or your users can browse to the portal, log in and download the client software with it already configured.

For more information you can check out the admin guide:

GlobalProtect Administrator's Guide 6.1 (English)

and the product site:

https://www.paloaltonetworks.com/products/technologies/globalprotect.html

Personally I have no issues with the client, its brilliant when combined with HIP checks and has clear to read debug logs if there are any issues.

thanks,

Ben

Re: GP VPN client vs native OS VPN client

jdprovine — Wed, 15 Jul 2015 12:28:52 GMT

I am already using the global protect client and know how to install it and configure it. My question was in the future on new machines is there any advantage to using the native VPN client in the OS or the palo alto global protect client

Re: GP VPN client vs native OS VPN client

_slv_ — Wed, 15 Jul 2015 13:34:41 GMT

Hello

It's depends on what OS are You have.

ie. for android/iOS devices You have to buy licene to use GP client - so using native is free of charge but You can't use HIP application VPN and so on...

Regards

SLawek

Re: GP VPN client vs native OS VPN client

jdprovine — Wed, 15 Jul 2015 20:23:29 GMT

Windows 7 pro, Win 8.1 and Windows 10

Re: GP VPN client vs native OS VPN client

_slv_ — Thu, 16 Jul 2015 21:03:11 GMT

Did You read Mobile Security ? there is a lot of advantage of using GP - it's depends on Your needs.

For me for Windows OS GP is the best option, its free, You can use different logon serwers (AD/Radius etc) and avery user use their passwords.

With other than GP client You have to share X-ayth password for example for Linux VPN clients.

Regards

SLawek

Re: GP VPN client vs native OS VPN client

thakala — Mon, 20 Jul 2015 09:14:42 GMT

I have done some research lately regarding Windows native VPN client support with PAN and come to conclusion that none of Windows native VPN connection methods are compatible with PAN-OS.

PAN-OS (7.0) does not support L2TP, PPTP or SSTP tunnel protocols which Windows VPN client supports for remote access. However PAN-OS does support IKEv2 which Windows 7 and up also supports but none of Windows supported authentication methods for IKEv2 are compatible with current PAN-OS releases (up to 7.0).

So with Windows you are currently stuck with Global Protect client or you need some 3rd party IPsec client like Shrew Soft VPN or GreenBow VPN Client.

If someone has gotten Windows VPN IKEv2 to work with PAN-OS I would be very happy to learn how 🙂

Cheers,

Tomi

Re: GP VPN client vs native OS VPN client

_slv_ — Mon, 20 Jul 2015 11:02:07 GMT

>If someone has gotten Windows VPN IKEv2 to work with PAN-OS I would be very happy to learn how 🙂

PAN OS 7.0

https://www.paloaltonetworks.com/documentation/70/pan-os/newfeaturesguide/vpn-features/ikev2-support-for-vpn-tunnels.html

gives us this functionality.

I'm on 6.1.4 so I can't test it now.

Regards

Slawek

Re: GP VPN client vs native OS VPN client

jdprovine — Mon, 20 Jul 2015 12:46:50 GMT

Really I have people using the native OS client to connect via there pc and phones