topic xauth use on global protect tunnels in General Topics

xauth use on global protect tunnels

jdprovine — Mon, 30 Apr 2018 14:11:39 GMT

how many are using xauth on the global protect tunnels and why ? We are using it because we have users using native clients on PC's and phones (don't want to pay for the mobile license for on)?

Let me know what you think and the pros and cons of using xauth

Re: xauth use on global protect tunnels

hshawn — Mon, 30 Apr 2018 15:06:23 GMT

I am using it for my lab network so I can avoid the mobile client. Frankly (I cannot speak to the iOS version) the Android client seems like it is an afterthought and looks very dated. I also had some pretty notiable battery drain while I was testing it since it was setup to always be on and would auto connect/disconnect each time I would unlock/relock my phone. Xauth PSK works great and you can have it setup in conjunction with GP. That being said we do not have employees using it from BYOD devices. For that we have another MDM solution with a per-app micro VPN tunnel

Re: xauth use on global protect tunnels

jdprovine — Mon, 30 Apr 2018 15:16:36 GMT

@hshawn

Thanks for you input. Do you see any security issues when using xauth?

Re: xauth use on global protect tunnels

hshawn — Tue, 01 May 2018 15:57:02 GMT

I think the standard security issues apply here... of course make sure to use a really good shared key and password for the user, use security policies to further scope down what the user(s) can do/have access to, monitor the VPN connections (these will show up in the GP gateway along side the GP VPN connections) etc...

Re: xauth use on global protect tunnels

fjwcash — Wed, 02 May 2018 04:03:08 GMT

We use it on two GP Gateways to allow Linux stations to connect to the VPN. Along with LDAP user authentication.

And we use it to allow Grandstream 3200-series VoIP handsets to connect to the PBX via the VPN. These are Android-based phones, and it was a lot easier to connect to the GP Gateway than to get SIPS and other stuff enabled on the PBX.

Until there's a working, stable version of the GP Agent for Linux, well continue to use X-Auth for these.

Re: xauth use on global protect tunnels

jdprovine — Wed, 02 May 2018 13:03:56 GMT

@fjwcash

Have you tried the new version 4.1 GP client its suppose to supporet linux

Re: xauth use on global protect tunnels

fjwcash — Wed, 02 May 2018 13:59:56 GMT

Not yet. 4.1.0 had lots of issues. 4.1.1 was just released that's supposed to have fixed then, but haven't tested it yet.

Don't you need PanOS 8.x to use GP 4.1? We are just upgrading to 7.1.x with no plans to go to 8.0 this year.

Re: xauth use on global protect tunnels

BPry — Wed, 02 May 2018 14:35:58 GMT

@fjwcash,

You need to be running at least 7.1 for GP 4.1.