Adding MFA to Pre-login GlobalProtect

Ahmed_Eissa — Tue, 24 Apr 2018 10:59:27 GMT

Global Protect VPN Solution is defined with Pre-login and always-on VPN features.

Workflow:

Once machine is booted and before user login, Machine is authenticated based on certificate and identified in logs with (Pre-login) user
Pre-login access is restricted to Mac Management solution and AD.
Once user is logged in, a new tunnel is initiated and authenticated by same certificate with ability to identitfy username in certificate to be added to user-ip mapping table
User group Access rules is created to match only specific user group to access internal resources.

Required: MFA integration With Pre-login

My main scope is to add more strong authentication mechanism, as with pre-logon,

Step1: machine are authentication and authorized once it boots up baed on First Authentication factor (Client-Certificate) to access AD servers.

Step2: adding to that Second factor Authentication Factor Credential logins to be able to open the laptop itself.

In case of Client-Certificate is compromised then attacker can import it to its machine and do step1 then step2 (as device credentials is already know to attacker - already his machine-).

Proposal A:

If we applied it with pre-login , I think it won’t be suitable as machine is already authenticated and any traffic is blocked except for specific Destinations as AD.
Once users log in , maybe here we can apply Authentication security policy declares for access to internal resource we need MFA.

So with My proposal A , attacker can still connected through VPN. maybe he doesn`t have access to internal resources without Valid OTP but he stills can do DOS attack to bring down my service.

So hope it is a good challenge for you to think about 🙂 ....

Re: Adding MFA to Pre-login GlobalProtect

Ahmed_Eissa — Tue, 24 Apr 2018 15:58:03 GMT

any recommendations?

Re: Adding MFA to Pre-login GlobalProtect

Remo — Thu, 10 May 2018 17:58:16 GMT

I think there is no real solution for you in this case, except that you disable pre-logon if there isn't enough security for you.

It's probably about the question: do you trust the loginscreens of windows and mac? If not, then change everything to user-logon and there will be no connection to your internal network until the uset is successfully authenticated.

Re: Adding MFA to Pre-login GlobalProtect

hshawn — Thu, 10 May 2018 19:05:29 GMT

TLDR version of this exact question at my organization: Use 2FA on the windows login instead of GP if 2FA is desired in this configuration

topic Re: Adding MFA to Pre-login GlobalProtect in General Topics

Adding MFA to Pre-login GlobalProtect

Re: Adding MFA to Pre-login GlobalProtect

Re: Adding MFA to Pre-login GlobalProtect

Re: Adding MFA to Pre-login GlobalProtect