topic Re: Global protect client to connect using a IPSec tunnel in General Topics

Global protect client to connect using a IPSec tunnel

jdprovine — Fri, 27 Apr 2018 12:37:30 GMT

I want to create a IPSec tunnel and use the global protect client to access via VPN our PCI internet network can that be done?

Re: Global protect client to connect using a IPSec tunnel

BPry — Fri, 27 Apr 2018 13:22:20 GMT

@jdprovine,

So you are creating a IPSec Tunnel on the Palo Alto that allows access to a PCI network; and then you want to allow your GlobalProtect clients (or a subset of clients) access to these resources?

Generally I caution people to be very cautious when looking to enable remote access on a PCI network, and to guarantee that you have actually read through and verified you meet all requirements. One such example would be that you need to have MFA on this if you are accessing a PCI network to maintain compliance.

Re: Global protect client to connect using a IPSec tunnel

jdprovine — Fri, 27 Apr 2018 13:27:57 GMT

@BPry

With already have this process in place using a ASA 5510, (less then 10 people have this access), but the ASA 5510 going end of support so we need to replace it. Currently the use the native client on their PC to connect to the ASA 5510 and go through a IPSec tunnel to access the PCI network. I tried to use the globalprotect portal but it did not offer IKE2. I want to use GP client 4.1 with multiple portal options to connect to the PA and go through a IPSec tunnel to the PCI network and yes we NAT to the PCI network.

Re: Global protect client to connect using a IPSec tunnel

jdprovine — Fri, 27 Apr 2018 13:49:58 GMT

@BPry

Yes we already do MFA to access the PCI network

Re: Global protect client to connect using a IPSec tunnel

jdprovine — Fri, 27 Apr 2018 15:11:32 GMT

I guess I am not sure the correct way to go about doing this or if the GP client can even be used in this way. If anyone is doing something similar let me know

Re: Global protect client to connect using a IPSec tunnel

Harshit — Fri, 27 Apr 2018 15:36:55 GMT

you probably do not need IKEv2 for global protect,

Scenario:1

you already have a anyconnect client, coming in on an ASA, then it routes to a PaloAlto firewall that has a VPN tunnel and the traffic flows through it, If true, you should be able to configure Paloalto to use SSL and then reroute the traffic through VPN (B2B) tunnel.

Scenario: 2

you already have a anyconnect client, coming in on an ASA, then it routes to a ASA firewall that has a VPN tunnel (U-Turning the traffic) and the traffic flows through it, If true, you should still be able to configure Paloalto to use SSL and then reroute the traffic to the ASAand eventually VPN (B2B) tunnel, you would just need to make sure routing is set properly on both firewalls, my suggestion would be to use seperate set of pool ip addresses for both.

If there is another scneraio, let me know.

~HTH

Re: Global protect client to connect using a IPSec tunnel

jdprovine — Fri, 27 Apr 2018 15:53:10 GMT

@Harshit

We do not use annyconnect, mostly they currently use the native client on their PC. Yes we are planning on putting an ssl cert on the new tunnel. The plan is to replace the ASA and only use the PA as a VPN IPSec tunnel into the PCI network, I am just trying to figure out what I need to configure to make that happen

Re: Global protect client to connect using a IPSec tunnel

BPry — Fri, 27 Apr 2018 16:08:25 GMT

@jdprovine,

So I think some of the terminology is getting crossed here.

Couple questions.

1) Do you currently connect to the PCI network via an IPSec Tunnel; by that I mean does the ASA form a tunnel to a payment processor?

2) Do you wish to keep the ability to use the internal VPN client or force them to use the GlobalProtect Agent?

How you would likely want to set this up.

1) You'll need to form the tunnel between the PA and the payment processor, essentially just recreating the tunnel on the Palo Alto. I would generate a completely new zone for this and call it something like 'PCI Network'.

2) You can either configure security policies that would allow the users who require PCI Network access and keep a single gateway, or you could create a new gateway for the PCI network and they would simply switch between the two.

3) Since this is touching PCI you need to ensure that GlobalProtect would be secured by MFA.

Ideally, and how I would personally recommend you configure this, is that the PCI network gets it's own VSYS on the firewall. This ensures that you don't have to really worry about misconfiguring something and accidently granting interzone communication that allows non-PCI compliant traffic access to your PCI network. It also makes PCI audits a bit easier to deal with since they don't have to look at your entire firewall configuration.

Re: Global protect client to connect using a IPSec tunnel

Harshit — Fri, 27 Apr 2018 16:10:59 GMT

Ok, makes sense now,

To achieve this, i would put Global Protect and VPN tunnels in seperate zones, and then we can use virtual router in order to route the traffic from one zone to another, and use Security policy to restrict it to specific ip and port too.

In a nutshell you need:

1) global protect

2) b2b tunnel to PCI

3) seperate zones for both mentioned above

4) security rules to allow traffic between these two zones.

if you need help setting either of these i can provide you links to them.

~HTH

Re: Global protect client to connect using a IPSec tunnel

jdprovine — Fri, 27 Apr 2018 16:37:31 GMT

@Harshit

what is b2b tunnel?

Global protect client is what you are referring too

You mentioned I did not need IKE2 but our security guy wants us to use IKE2 that is why I was unable to use a global protect portal and have to look at using an IPSec tunnel instead

PCI already has its own zone configured on the firewall

Yes I would be interested in seeing the links you are referring too

Re: Global protect client to connect using a IPSec tunnel

BPry — Fri, 27 Apr 2018 16:43:39 GMT

@jdprovine,

b2b tunnel is simply an industry term for business to business, in other words you are connecting your university to the PCI Processing network.

Does your security guy want you to utilize IKE2 for the actual PCI tunnel or for the clients connecting to the firewall? You really shouldn't be allowing X-Auth to even be used on this connection and you should be forcing anyone that needs remote PCI access to login through an actual GlobalProtect Agent.

Re: Global protect client to connect using a IPSec tunnel

Harshit — Fri, 27 Apr 2018 16:46:39 GMT

Sure,

B2B , Business-to-Business tunnel , is just another name i use to mention VPN tunnel 🙂

you can configure VPN tunnel on IKEv2 and Use SSL for Global protect

for site to site

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/vpns/set-up-site-to-site-vpn

for global protect:

https://live.paloaltonetworks.com/t5/Configuration-Articles/Basic-GlobalProtect-Configuration-with-User-logon/ta-p/136099

Re: Global protect client to connect using a IPSec tunnel

jdprovine — Fri, 27 Apr 2018 16:47:06 GMT

1) Do you currently connect to the PCI network via an IPSec Tunnel; by that I mean does the ASA form a tunnel to a payment processor?

Not to the payment processor but for our users to access the PCI network

2) Do you wish to keep the ability to use the internal VPN client or force them to use the GlobalProtect Agent? -

They have been using a native client and L2TP. The PA does not support L2TP so they will no longer be able to use the native client anymore so I have to provide them with a client that is compatible with the PA.

How you would likely want to set this up.

Already have a zone on the PA for the PCI network

I plan on creating a new gateway - but my big issue is the IPSec tunnel configuration on the PA how to do it and if it will work with the GP client and if not what client will it work with

3) Since this is touching PCI you need to ensure that GlobalProtect would be secured by MFA.

Yes we intend on continuing to use MFA, using radius

Re: Global protect client to connect using a IPSec tunnel

jdprovine — Fri, 27 Apr 2018 16:50:41 GMT

@BPry

Does your security guy want you to utilize IKE2 for the actual PCI tunnel or for the clients connecting to the firewall? good question if I know him he would want both if it can be done.

I agree absolutely we need to get rid of x-auth but its hard to get them all off the native client and the cisco client. Even the security guy uses his native client instead of the GP client on his MAC

Re: Global protect client to connect using a IPSec tunnel

BPry — Fri, 27 Apr 2018 17:05:11 GMT

@jdprovine,

Okay so referencing the same number scheme as before.

1) Do you currently connect to the PCI network via an IPSec Tunnel; by that I mean does the ASA form a tunnel to a payment processor?

Not to the payment processor but for our users to access the PCI network

So you don't have a tunnel to the processor and the PCI Network is simply a zone that you had the ASA located in.

2) Do you wish to keep the ability to use the internal VPN client or force them to use the GlobalProtect Agent? -

This is good, you don't want X-Auth on at all and you should be forcing people onto the agent.

How you would likely want to set this up.

Already have a zone on the PA for the PCI network

Good

I plan on creating a new gateway - but my big issue is the IPSec tunnel configuration on the PA how to do it and if it will work with the GP client and if not what client will it work with

If the PCI Network already exists on the Palo Alto and you don't need to make a connection to a payment processing network don't worry about re-creating the tunnel here. If this tunnel truly is to just allow users to connect force them to the GlobalProtect agent.

3) Since this is touching PCI you need to ensure that GlobalProtect would be secured by MFA.

Yes we intend on continuing to use MFA, using radius

Good

Re: Global protect client to connect using a IPSec tunnel

BPry — Fri, 27 Apr 2018 17:07:37 GMT

Does your security guy want you to utilize IKE2 for the actual PCI tunnel or for the clients connecting to the firewall? good question if I know him he would want both if it can be done.

Your security guy should be happier about utilizing an SSL VPN connection over an IPSec tunnel.

This simply needs to get disabled. With the Linux client being available there is no reason to continue to utilize X-Auth with GP at all. The security guy should be making this push more than anyone else.

Re: Global protect client to connect using a IPSec tunnel

jdprovine — Fri, 27 Apr 2018 18:20:02 GMT

@BPry

Great info.

My plan is to make them use the GP client and that is why I was so glad to see version 4.1 come out but I know there are more types of VPN tunnels that can be created on the PA , IPSec and global protect. I can't use the global protect VPN because there is no IKE2 but quite honestly I don't know how to set up any other kind on the PA. So I need to set up an IPSec VPN tunnel that works with version 4.1 so these same PCI users can VPN into the PCI network and VPN from home into the network. Hope that makes sense

Re: Global protect client to connect using a IPSec tunnel

BPry — Fri, 27 Apr 2018 18:29:51 GMT

@jdprovine,

Right but you are addressing that by simply forcing them to use the GlobalProtect Agent and turning off X-Auth and leaving the 'Enable IPSec' checkbox along so that IPSec isn't used. This forces the agent to utilize the more secure SSL VPN process.

Re: Global protect client to connect using a IPSec tunnel

jdprovine — Fri, 27 Apr 2018 19:02:14 GMT

@BPry

wish it were that easy but I am trying to build a new tunnel to replace the ASA tunnel, not sure what type of tunnel to build

Re: Global protect client to connect using a IPSec tunnel

Harshit — Fri, 27 Apr 2018 19:28:49 GMT

B2B can be built using IKEv2, and i am assuming that is what your security guy wants to do too 🙂

you can inform him about the GP's SSL and i am sure he will agree.

~HTH