topic Re: Any way to get this scenario configured? in General Topics

Any way to get this scenario configured?

SThatipelly — Tue, 11 Jun 2019 15:27:45 GMT

I have GP Gateway license on my PA-5020 firewalls. I would like to allow 200 corporate owned samsung phones to access the VPN and block all other mobile phones. what are all the options I have to selectively allow them other than having a certificate authentication(because I have external clients connecting to same portal/gateway on laptops)?

thank you.

Re: Any way to get this scenario configured?

Mick_Ball — Tue, 11 Jun 2019 17:58:18 GMT

Hmmmm.... not sure why you cannot include external devices, you could send them a self signed cert.

either way i would probably include HIP to my security policies and only allow access to known IEMI,s.

Re: Any way to get this scenario configured?

SThatipelly — Tue, 11 Jun 2019 18:37:24 GMT

manually entering IMEis is a admin nightmare for me as the device count is 200+. I wish palo supports importing a list of IMEI.

Re: Any way to get this scenario configured?

BPry — Wed, 12 Jun 2019 07:57:54 GMT

@SThatipelly,

For the IMEI sidde of things I would really recommend either scripting the setup via the API or manually including the IMEIs within the XML configuration file itself; it makes things much more manageable from that standpoint.

Re: Any way to get this scenario configured?

OtakarKlier — Wed, 12 Jun 2019 16:28:01 GMT

Hello,

How about controling it by who can authenticate to the portal?

Just a thought.

Re: Any way to get this scenario configured?

SThatipelly — Wed, 12 Jun 2019 16:31:58 GMT

@OtakarKlier yes I have that enabled. That would limit the user accounts. i would also like to limit the phones.