topic Re: Restricting Global protect VPN access to specific countries in General Topics

Restricting Global protect VPN access to specific countries

Sunugopal — Thu, 19 Apr 2018 15:38:22 GMT

How to configure Global Protect vpn users to access from only specific countries ?

Re: Restricting Global protect VPN access to specific countries

hshawn — Thu, 19 Apr 2018 16:02:32 GMT

You can create an inbound VPN security policy that is only allowing from those geographical regions, the firewall has built-in regions that you can choose from or you can define your own

On my lab device I have it setup to do this. depending on your topology/config it may vary but should be easily accomplished and you can narrow it down to the layer 7 specific apps as well

Re: Restricting Global protect VPN access to specific countries

Mick_Ball — Thu, 19 Apr 2018 16:25:58 GMT

also... in version 8.something you can offer gateways dependant on what country the user is connecting from...

network/portal/agent/configs/external

this is the help link...

Source Region—Source region for client devices. When users connect, GlobalProtect recognizes the device region and only allows users to connect to gateways that are configured for that region. For gateway choices, source region is considered first, then gateway priority.

Re: Restricting Global protect VPN access to specific countries

Sunugopal — Thu, 19 Apr 2018 20:44:28 GMT

Thank you hshawn.

Re: Restricting Global protect VPN access to specific countries

Sunugopal — Thu, 19 Apr 2018 20:52:34 GMT

Thank you MickBall. I have 8.1.0 version and this is the vpn setting i was lookin for.

Re: Restricting Global protect VPN access to specific countries

TechnologySvcs — Wed, 25 Apr 2018 06:06:06 GMT

I tried this as shown below, but did not work as expected. Global protect can still connect from other countries. I have only one portal and one gateway.

Re: Restricting Global protect VPN access to specific countries

Mick_Ball — Wed, 25 Apr 2018 06:25:18 GMT

What happens if you remove the “Any” from region settings...

Re: Restricting Global protect VPN access to specific countries

TechnologySvcs — Wed, 25 Apr 2018 07:49:39 GMT

same effect without "Any". i already tried this.

Re: Restricting Global protect VPN access to specific countries

Mick_Ball — Wed, 25 Apr 2018 07:56:05 GMT

OK worth a try.. I must admit I have never used it but I just noticed the option when was looking into gateway priority.

If it's causing an issue perhaps it should be logged as a fault with support.

going by the documentation, it should work.

can you confirm that your PA is deffo recognising the regions you are connecting from.

Re: Restricting Global protect VPN access to specific countries

TechnologySvcs — Wed, 25 Apr 2018 09:21:29 GMT

In the log, source country is showing corrctly.

Also "show location ip x.x.x.x" is showing correct country

Re: Restricting Global protect VPN access to specific countries

fwmike — Mon, 13 May 2019 13:56:51 GMT

@TechnologySvcs , did you get this working?

I require this capability in a new GP deployment and would like to avoid putting another device upstream to restrict the portal and gateway access by region.

Thanks

Re: Restricting Global protect VPN access to specific countries

Sunugopal — Tue, 14 May 2019 15:29:47 GMT

fyi, in my case it did not work at that time. I haven't tried again.

But i believe it is possible to restrict Global protect access to your public ip address using security policy rules.

Try creating two rules as mentioned below.

RULE1

--------

source zone : outside

source address : IN (for eg. India, add required countries)

destination zone : outside

destination address : x.x.x.x (your public ip)

applications : panos-global-protect, panos-web-interface, ssl,

service : application-default

action: allow

RULE2

--------

source zone : outside

source address : any

destination zone : outside

destination address : x.x.x.x (your public ip)

applications : panos-global-protect, panos-web-interface, ssl,

service : application-default

action: deny

Re: Restricting Global protect VPN access to specific countries

Mick_Ball — Wed, 15 May 2019 08:09:28 GMT

@fwmike , Hi.

yes, gateway selection visa regions does work for both windoze and ios.