topic Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect for Network Access Enabled in General Topics

Allow traffic to specified hosts/networks when Enforce GlobalProtect for Network Access Enabled

OwenFuller — Wed, 16 Oct 2019 21:15:43 GMT

We've been troubleshooting some issues encountered when using the "Enforce GlobalProtect Connection for Network Access" option in our portal agent configuration. Our TAC engineer mentioned that he had seen a setting called "Allow traffic to specified hosts/networks when Enforce GlobalProtect Connection for Network Access is enabled and GlobalProtect Connection is not established" in 8.1, but didn't see it in 9.0. (The setting should allow certain hosts to be exempted from the enforced use of GP.) However, today I noticed it in the portal config for the first time (we just updated to 9.0.4 last week). I tried putting in an IP address for the parameter value, and also using the whole subnet w/ mask. However, it didn't work to allow access to those hosts.

I can't seem to find documentation for this parameter anywhere! I've looked in the offline help in Panorama, v 8.1 and v 9.0 GlobalProtect administrator's guide, searching on this forum, and searching Google in general. The TAC engineer didn't even have documentation for this. Does anyone know the syntax, or how to get it to work?

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect for Network Access Enabled

S.Cantwell — Wed, 30 Oct 2019 22:01:34 GMT

Hello there

So I am trying to work out and understand the issue.

I see the option for Enforce GlobalProtect Connection for Network Access, and it is a yes or no.

Yes means that NO network traffic can pass without the machine being connected via GP.

I too, looked at the 8.1 GP admin guide and do not see an exception to the Enforce GlobalProtect Connection setting.

So, perhaps the TAC engineer was incorrect in his memory.

For now, I would create a configuration that specifically excludes that particular computer from needing to connect.

Will this help?

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect for Network Access Enabled

OwenFuller — Thu, 31 Oct 2019 03:13:36 GMT

Steve, we are excluding this setting across the board right now, because we unfortunately have a large number of machines which would need an exception. We're still doing Always On mode, and the login dialog box is pretty "in your face" annoying until you sign in, which should help encourage users to authenticate.

Here's a screenshot of the parameter. Want to know the dumber thing? Once you've set a value, you can't change it back to blank! The window won't let you save it anymore! My case engineer escalated it a week ago, and still has no idea how to configure it. It seems to be some half baked "feature" that does nothing at this point.

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect for Network Access Enabled

Shawverr — Thu, 31 Oct 2019 14:34:32 GMT

@OwenFuller Welp, you weren't lying. I set that up on my test palo and was unable to change it back to blank. Well, I was but only because a saved a snapshot first. Otherwise I got the same error.

Looks like a bug that needs fixed.

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect for Network Access Enabled

OwenFuller — Thu, 31 Oct 2019 14:47:30 GMT

@Shawverr wrote:

Looks like a bug that needs fixed.

Well, once TAC acknowledges that the "feature" even exists, then maybe we can get a bugfix submitted! 😄

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect for Network Access Enabled

Shawverr — Thu, 31 Oct 2019 14:53:09 GMT

@OwenFuller LOL!!!! That's why I decided to post, not because I could help, but I could at least confirm the issue. Hopefully that helps.

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect for Network Access Enabled

RichColeman — Thu, 07 Nov 2019 14:07:08 GMT

value must contain the mask i.e 8.8.8.8/32 or 10.0.0.0/8

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect for Network Access Enabled

OwenFuller — Tue, 19 Nov 2019 16:34:53 GMT

For anyone following, or who finds this in the future, here's the latest from TAC:

Seems like the issue with the enforcer exception list will be fixed 8.1.14 and 9.0.8. there are no release dates for these firmware yet, so it might be a while.

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect for Network Access Enabled

OwenFuller — Tue, 19 Nov 2019 16:37:30 GMT

@RichColeman wrote:
value must contain the mask i.e 8.8.8.8/32 or 10.0.0.0/8

Thanks for the tip, Rich. We'll give this a try.

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect for Network Access Enabled

RichColeman — Wed, 20 Nov 2019 09:53:44 GMT

I've had confirmation from TAC this option also "currently" only works with GP client version 5.1.0 (which is in beta), my portal is running 8.1.4 and as soon as I upgraded to 5.1.0 the option (after configuring) worked.

Think there's a disconnect, I will assume the fix will remove the need for the client to be on an un-released version

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect for Network Access Enabled

Mick_Ball — Wed, 20 Nov 2019 11:35:08 GMT

Thanks for updating with this information.

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect for Network Access Enabled

OwenFuller — Wed, 20 Nov 2019 14:22:36 GMT

Oh, great find! Maybe I'll try this out w/ the beta client.

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect for Network Access Enabled

cyurekli — Fri, 22 Nov 2019 17:33:49 GMT

This feature will be supported with GP Agent 5.1.0. Existing agent is not supporting this option.

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect for Network Access Enabled

RichColeman — Mon, 25 Nov 2019 08:16:28 GMT

Turns out there are a number of features running in 8.1 which isn't available until your running client version 5.1 would be handy of Plao documented them.

I've reached out to my TAM a requested this info, once I have I'll post it on here.

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect for Network Access Enabled

OwenFuller — Tue, 26 Nov 2019 19:35:11 GMT

I have confirmed that the exception list works when using GlobalProtect agent 5.1 beta in accordance with information in the release notes, and the info from @cyurekli. With a little experimenting, I was able to determine the following details, which I'm sharing since documentation is still scant:

A single address in the exception list can be entered with no subnet mask (e.g. 192.168.223.1)
Multiple addresses must be entered with a mask (thanks @RichColeman), and separated by a comma (e.g. 192.168.223.1/32,10.0.0.1/32)
Once the GP client connects to the gateway, access to the exception list addresses no longer applies

As a reminder, my TAC engineer also had this to say:
Seems like the issue with the enforcer exception list will be fixed 8.1.14 and 9.0.8. there are no release dates for these firmware yet, so it might be a while.

Thank you all for the help!

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect f

cyurekli — Wed, 13 May 2020 17:27:28 GMT

0.0.0.0/0 is too large and it is the opposite of GP enforcement. I would expect that 0.0.0.0/0 is ignored. Can you try with a smaller subnet?

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect f

OwenFuller — Thu, 14 May 2020 14:50:46 GMT

@mdensley I'm not sure exactly what you're trying to accomplish. Could you elaborate?

If you don't actually want to enforce GP for network access, I'd disable that option in your portal config. The "Allow traffic to specified hosts/networks when Enforce GlobalProtect Connection for Network Access and GlobalProtect Connection is not established" is really intended for making limited exceptions when you want to lock down all network access if you user isn't on VPN. If your main goal is just to notify users when they've lost their VPN connection due to a poor network connection for example, I'd suggest a different approach. You might want to start with enabling cookies on your portal/gateway which allow the user to reconnect withing a specified amount of time (whatever makes sense with your security/operational requirements) without re-authenticating. Then, use the "Automatic Restoration of VPN Connection Timeout (min)" and the "Wait Time Between VPN Connection Restore Attempts (sec)" settings to enable GlobalProtect to automatically try to reconnect if it briefly loses connection. This is seamless to your end user, and requires no prompt or interaction. If you want the VPN to generally be connected for the user all the time, but not "enforced" for network access, then you can set the "Connect Method" to User-Logon (Always On).

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect f

OwenFuller — Tue, 02 Jun 2020 22:55:15 GMT

I think the closest you will get is doing the cookies with the auto-reconnect option. I believe this should still work just fine. It’s not going to do quite what you want in terms of a specific message, but it should still pop up the GP window from the system tray as it tries to reestablish the connection. Beyond that, you might be right to go the feature request route.

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect f

Sec101 — Wed, 01 Jul 2020 18:16:40 GMT

If you fill in the FQDN area and then delete the value, the firewall will complain too. Seems like either one of these fields, once completed, is enough to make you have to trash your Agent config for that entry, or force you to enter a value in it. This should be fixed.

Re: Allow traffic to specified hosts/networks when Enforce GlobalProtect for Network Access Enabled

DavidMaas1 — Thu, 13 May 2021 14:52:57 GMT

This issue is still with GP Agent 5.1.x