topic Re: How to limit concurrent GlobalProtect connections per user in General Topics

How to limit concurrent GlobalProtect connections per user

Remo — Mon, 17 May 2021 21:13:14 GMT

Hi communit

So far it isn't possible to limit the concurrent GlobalProtect connections per user directly in PAN-OS. There is a feature request #4603 for which you can vote and wait/hope that this will be implemented.

If you need a solution (workaround) right now, once more the PAN-OS API is your friend. Because we (like probably some or a lot og admins here) had the problem, that we had users, specially from external suppliers, who shared their accounts and so they logged in multiple times. So I wrote this little powershell script. The script needs to be configured as scheduled task to run every minute for example. Every time the script runs it checks the connected Global Protect users and then kicks out users that are logged in multiple times. If you want, you can also specify the number of allowed concurrent logins per user with the variable $maxlogins. This way you're able to kick out users that are logged in more than 3 times for example.

[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12; $apikey = "INSERT_API_KEY_HERE" $firewall = "FIREWALL_HOSTNAME_OR_IP" $gpgateway = "GLOBAL_PROTECT_GATEWAY_NAME" $maxlogins = 1 Function callApiOp ($firewall, $param) { $request = New-Object System.Net.WebClient $apiurl = "https://" + $firewall + "/api/?key=" + $apikey + "&type=op&cmd=" + $param return [xml]$request.DownloadString($apiurl) } $param = "<show><global-protect-gateway><current-user><gateway>" + $gpgateway + "</gateway></current-user></global-protect-gateway></show>" $logins = callApiOp $firewall $param $logins = $logins.response.result.entry | sort 'login-time-utc' $loginevents = @{} foreach ($event in $logins) { $username = $event.username if ($loginevents.ContainsKey($username)) { $loginevents.($username) = $loginevents.($username) + 1 } else { $loginevents.Add($username,1) } } foreach ($user in $loginevents.GetEnumerator()) { $forcelogout = $logins | Where-Object {$_.username -eq $user.key} $userstologout = $user.Value - $maxlogins for ($i=0;$i -lt $userstologout; $i++) { if ($forcelogout.count -eq $null) { $domain = $forcelogout.domain $computer = $forcelogout.computer $username = $forcelogout.username } else { $domain = $forcelogout[$i].domain $computer = $forcelogout[$i].computer $username = $forcelogout[$i].username } $logoutparam = "<request><global-protect-gateway><client-logout><gateway>" + $gpgateway + "-N</gateway><reason>force-logout</reason><user>" + $username + "</user><computer>" + $computer + "</computer>" if ($domain -ne "") { $logoutparam += "<domain>" + $domain + "</domain>" } $logoutparam += "</client-logout></global-protect-gateway></request>" $status = callApiOp $firewall $logoutparam if ($status.response.result.response.status -eq "success") { write-host "Logged out user $username from computer $computer" } else { $msg = "Could not logout " + $username + " from computer " + $computer + " because of the following error: " + $status.response.result.response.error Write-Host $msg } } }

Maybe this helps at least some of you, or at least gives another idea for the almost countless use cases of the PAN-OS API.

Feedback is appreciated 😉

Regards,

Remo

Re: How to limit concurrent GlobalProtect connections per user

bernardo.hernandez — Wed, 21 Nov 2018 23:44:40 GMT

Hey Remo:

Where should this run, exactly?

Re: How to limit concurrent GlobalProtect connections per user

Remo — Thu, 22 Nov 2018 19:17:07 GMT

Hi @bernardo.hernandez

On a server/computer that has acces to the API of the firewall where you have globalprotect configured.

Regards,

Remo

Re: How to limit concurrent GlobalProtect connections per user

bernardo.hernandez — Thu, 22 Nov 2018 19:22:33 GMT

Thanks Remo

I'm having a lot of trouble trying to get my API key. I've tried sending a GET request to the FW per this article https://www.paloaltonetworks.com/documentation/80/pan-os/xml-api/get-started-with-the-pan-os-xml-api/get-your-api-key using powershell, however I've had no luck yet.

Any pointers?

Re: How to limit concurrent GlobalProtect connections per user

Remo — Thu, 22 Nov 2018 19:31:30 GMT

Simply try it in the browser with this url (wher you replace the hostname, username and password to actual values):

https://HOSTNAME/api/?type=keygen&user=USERNAME&password=PASSWORD

Re: How to limit concurrent GlobalProtect connections per user

bernardo.hernandez — Thu, 22 Nov 2018 19:52:09 GMT

Great. I've got my API key.

I had to change the execution policy for the currentuser on my machine so that I could run the script however I get the following errors. One per every one of the first $variables on the script, meaning $apikey, and $firewall.

"The term $variable is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name , or if a path was included, verify that the path is correct and try again."

😞

Re: How to limit concurrent GlobalProtect connections per user

Remo — Thu, 22 Nov 2018 20:00:45 GMT

Hmn ... you copied the script exactly how I posted it in this topic and you only replaces the values between the "" ?

Re: How to limit concurrent GlobalProtect connections per user

bernardo.hernandez — Thu, 22 Nov 2018 20:17:31 GMT

Yes.

Something like this:

$firewall = 192.168.0.1

$gpgateway =GP_test

Re: How to limit concurrent GlobalProtect connections per user

Remo — Thu, 22 Nov 2018 20:20:54 GMT

You need to enclose the values of variables in "". So if you do it like this it should work:

$firewall = "192.168.0.1"
$gpgateway = "GP_test"

Re: How to limit concurrent GlobalProtect connections per user

bernardo.hernandez — Thu, 22 Nov 2018 20:27:22 GMT

All right. I'm getting there...

Just one more hiccup

Re: How to limit concurrent GlobalProtect connections per user

Remo — Thu, 22 Nov 2018 20:51:45 GMT

You probably use a self signed cert on the firewall right?

Try this to disable certificate checks (add it as second line of the script):

[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}

Re: How to limit concurrent GlobalProtect connections per user

bernardo.hernandez — Thu, 22 Nov 2018 21:01:25 GMT

Cool!

It does run. Now, I'm not sure what output should I expect.

I get:

Re: How to limit concurrent GlobalProtect connections per user

Remo — Thu, 22 Nov 2018 21:42:31 GMT

So far the script does not really show an output yet. I will add a new line to script that will show which users were logged out.

Re: How to limit concurrent GlobalProtect connections per user

bernardo.hernandez — Thu, 22 Nov 2018 22:53:30 GMT

Awesome!

Looking forward to it.

Thank you for sharing and taking the time to walk me thru it all. I appreciate it.

Regards

Re: How to limit concurrent GlobalProtect connections per user

Remo — Thu, 22 Nov 2018 23:34:56 GMT

Hi @bernardo.hernandez

The script should now show you the users and computers where the global protect connection was terminated.

Re: How to limit concurrent GlobalProtect connections per user

bernardo.hernandez — Fri, 23 Nov 2018 00:26:15 GMT

Nice!

I can see the user and computer names now.

It doesn't seem to disconnect them tho, but at least I can now know who has multiple sessions and disconnect them manually.

Thanks again!

Re: How to limit concurrent GlobalProtect connections per user

Remo — Fri, 23 Nov 2018 00:29:27 GMT

What PAN-OS Version do you use?

Re: How to limit concurrent GlobalProtect connections per user

bernardo.hernandez — Fri, 23 Nov 2018 00:39:22 GMT

8.0.9

Re: How to limit concurrent GlobalProtect connections per user

Remo — Fri, 23 Nov 2018 00:44:30 GMT

I'll check that again ... I think thats a task you don't want to do manually 😛

Re: How to limit concurrent GlobalProtect connections per user

bernardo.hernandez — Fri, 23 Nov 2018 00:51:25 GMT

Absolutely!

It's the hard knock life for us, sysadmins!

Thanks again!