topic Re: PCI compliance and port 443 in General Topics

PCI compliance and port 443

jasonbailey — Tue, 10 Nov 2015 16:44:46 GMT

We are employing GlobalProtect VPN on our PA, which also happens to be our intranet gateway (NAT) to the Internet. Technically speaking, the setup works very well. Because port 443 is typically open on most firewalls, we can connect to the VPN virtually anywhere. Unfortunately, our PCI compliance scan (public side of our PA) flagged the open HTTPS port as a problem that needed fixing.

Disabling the GlobalProtect portal disables the downloading of the GlobalProtect client (which is okay with us), but naturally the TCP port 443 is still listening. Is there a way to configure the VPN service or craft a policy rule that would keep port 443 open for VPN but close it to port scans? In essence, we want to satisfy PCI requirements with the least impact to our VPN configuration.

Re: PCI compliance and port 443

Raido_Rattameister — Tue, 10 Nov 2015 19:55:12 GMT

You can't run GlobalProtect on port 443 but to hide from scan (unless you check logs from where scan comes from and block those IP's 🙂 ).

You can't have any port open at all or you can't have any port open on same ip where traffic goes out from?

You can run GP on some other IP for example.

Or get other subnet from your ISP to run GP on completely diferent IP range.

Or run GP on alternative port but this would mean reconfiguring all your clients also.

Re: PCI compliance and port 443

pulukas — Fri, 13 Nov 2015 10:41:09 GMT

What is the exact statement of problem for this issue in the PCI report?

I think they misunderstand what the service running here is, or the issue is with they way you have VPN access configured.

Certainly you can run web services and still be PCI compliant.

I think they believe you are exposing the web mgmt interface of the firewall to the open internet. This would be flagged as a problem. The scanner cannot know what the content of the web portal is and is probably just assuming this is the firewall mgmt portal because of the address.

I would push back and explain exactly what the service is. I would think you are compliant without any changes.