topic Re: GlobalProtect MAC Address Filter? in General Topics

GlobalProtect MAC Address Filter?

OMatlock — Fri, 26 Oct 2018 21:03:59 GMT

Hello folks,

I am being asked if GlobalProtect could be locked down to only except a specific list of MAC addresses (our corporate laptops) only.

I see information about Device Block list or HIP configuration. I don't really want to specify a block list, but rather an allow list and block everything else.

Is that possible?

We using PA 3020 with 7.1.15.

https://www.paloaltonetworks.com/documentation/71/globalprotect/globalprotect-admin-guide/use-host-information-in-policy-enforcement/block-device-access

Re: GlobalProtect MAC Address Filter?

Mick_Ball — Sat, 27 Oct 2018 13:00:40 GMT

Not via mac address but have you considered certifcates...

just generate a root CA on your palo and then use this to create device certificates...

Re: GlobalProtect MAC Address Filter?

OMatlock — Mon, 29 Oct 2018 18:40:49 GMT

Ok, gotcha. Thanks @Mick_Ball

Would this be along side (separately) from the existing wildcard we use for our GlobalProtect Gateway SSL/TLS profile?

Or instead of?

As I am thinking...sounds like could be instead of. Could use "local" certificates rather than one like GoDaddy that every device has a CA root cert for.

Re: GlobalProtect MAC Address Filter?

Mick_Ball — Mon, 29 Oct 2018 20:26:29 GMT

It would be along side...

also along side your existing authentication method.....

so... go daddy for tls profile, ldap or sso or local user or 2 factor auth plus device cert to only allow known devices.

your challenge will be to distribute certs...

can be done via Group policy..

Re: GlobalProtect MAC Address Filter?

OMatlock — Mon, 29 Oct 2018 20:51:42 GMT

Thank you! @Mick_Ball

Looks like I can follow this documentation.

https://www.paloaltonetworks.com/documentation/71/globalprotect/globalprotect-admin-guide/set-up-the-globalprotect-infrastructure/set-up-globalprotect-user-authentication/set-up-client-certificate-authentication/deploy-machine-certificates-for-authentication

I have a test environment to prove this out. I'll close this now, update it later.

Re: GlobalProtect MAC Address Filter?

Mick_Ball — Mon, 29 Oct 2018 21:29:14 GMT

Yep, you got it.., if you need any further assistance then jus update this post...

good luck...

laters....

Re: GlobalProtect MAC Address Filter?

JiaXiang — Wed, 22 Dec 2021 08:20:10 GMT

I`m using PanOS 10.0.8 and I notice there is no Device Block List for me to select. I want to block a few device mac address to access global protect.

Network > GlobalProtect > Device Block List

May I know is is PanOS 10 removed the feature ?