topic Re: New NG PA implementation path URL in General Topics

New NG PA implementation path URL

au_igs — Wed, 17 Apr 2019 01:35:39 GMT

Hi all, we are replacing our aging ASA VPN with the new PA GlobalProtect. ASA has a path of someurl.com/path rather than just a default someurl.com. Makes it a bit harder for the bad guys to guess. Is PA capable of creating a path, rather than a default url?

thank you in advance for the help

Regards

Re: New NG PA implementation path URL

El-ahrairah — Wed, 17 Apr 2019 05:28:39 GMT

Not really no.

Generally speaking it would be best practice to use a totally unrelated domain for the company/organization the remote access is for.

For example, it wouldnt be advisable for CompanyA to use...

eg "remoteaccess.companya.com"

Something generic that could not be traced back to the CompanyA in question would be much more advisable. Also the use of a top level domain that doesnt require it to be registered to a legitimate organisation if you want to be really paranoid....

eg. "tasty.spacechicken.systems"

Obviously something more appropriate than that, but you get the idea 🙂

Re: New NG PA implementation path URL

OtakarKlier — Wed, 17 Apr 2019 14:54:55 GMT

Hello @El-ahrairah ,

That is one cool domain ;)!

Re: New NG PA implementation path URL

Brandon_Wertz — Wed, 17 Apr 2019 18:24:09 GMT

@au_igs wrote:
Hi all, we are replacing our aging ASA VPN with the new PA GlobalProtect. ASA has a path of someurl.com/path rather than just a default someurl.com. Makes it a bit harder for the bad guys to guess. Is PA capable of creating a path, rather than a default url?

thank you in advance for the help
Regards

I think this is easier than you think, or perhaps I'm not understanding. I just went through swapping out ~6,000 laptops from AnyConnect to GP.

For GP you define the DNS name so there's not really a common path that an external entity could guess would be your company's GP portal.

Re: New NG PA implementation path URL

au_igs — Wed, 17 Apr 2019 22:28:32 GMT

that's a great idea, but then we'd need to register a new domain. Then we'd need to buy a new domain in Entrust for the certificate to match the new zone. All doable but sort of not thought of before.

Our 10 year old ASA could do it no dramas.

thank you though. I really do appriciate your replies and help

Re: New NG PA implementation path URL

Remo — Thu, 18 Apr 2019 14:51:42 GMT

@El-ahrairah wrote:
Also the use of a top level domain that doesnt require it to be registered to a legitimate organisation if you want to be really paranoid....

... and don't use anything "better" than a domain validation certificate - self signed would be good too if all the devices that connect are under your control 😉