topic Geolocation ip address blocking | Different access for different user groups in General Topics

Geolocation ip address blocking | Different access for different user groups

MarkusMix — Fri, 22 Feb 2019 09:02:06 GMT

Hallo,

I am new in PA matter, coming from Fortinet / Cisco (regarding to Firewall / UTM matter) and like to know if it is possible to have different geo location ip blocking restrictions / rules for the same service.

e.g. Access with Global Protect VPN

- Usergroup A: Only access with GP from Germany

- Usergroup B: Access with GP from whole Europe

Thanks all for reading and thinking about it

Best regards,

Markus

Re: Geolocation ip address blocking | Different access for different user groups

Mick_Ball — Fri, 22 Feb 2019 10:54:20 GMT

@MarkusMix if you take a look at this link then yes it should be doable from V8.

i did have a play but was adding my own regions, seemed pointless in the end as all our UK wifi is natted to the same IP...

anyhows... take a look here...

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-new-features/globalprotect-features/external-gateway-priority-by-source-region

Re: Geolocation ip address blocking | Different access for different user groups

MarkusMix — Tue, 05 Mar 2019 07:01:57 GMT

@Mick_Ball I´ll test that but this is only for gp.

I guess for special web addresses, which we do host in DMZ, this is not possible, right?

Re: Geolocation ip address blocking | Different access for different user groups

Mick_Ball — Tue, 05 Mar 2019 08:46:49 GMT

for a web hosted in your DMZ, yes this is possible without GP.

create a security policy and add the region to the source address. you can also mix this with user groups, zones, applications etc...

Re: Geolocation ip address blocking | Different access for different user groups

MarkusMix — Tue, 05 Mar 2019 08:48:15 GMT

User-ID on outside interface?

Re: Geolocation ip address blocking | Different access for different user groups

Brandon_Wertz — Tue, 05 Mar 2019 17:06:37 GMT

@MarkusMix wrote:
User-ID on outside interface?

Is a very risky and dangerous idea. There have been vulnerabilties in the past about exploiting the user-id process (I think in ver 6 code) and the main factor was an admin had to enable user ID process on an externally facing zone.