Restrict GlobalProtect connection from a single Linux computer

mikiTeleco — Wed, 11 Dec 2019 13:58:41 GMT

Hi everyone,

I must to implement some VPN access control based on computers. By this way, a user will only be able to connect to VPN if agent is executed from a specific computer.

I have read the documentation but I don't find if I can restrict the computer from where a user connects to VPN. All VPN clients are Linux and the control can be based on MAC address or serial ID.

Thanks beforehand.

Re: Restrict GlobalProtect connection from a single Linux computer

S.Cantwell — Wed, 11 Dec 2019 14:38:11 GMT

My recommendation is use a client certificate, installed on the Linux computer, that will allow only that computer to authenticate.

https://docs.paloaltonetworks.com/globalprotect/8-1/globalprotect-admin/authentication/about-globalprotect-user-authentication/supported-globalprotect-authentication-methods/client-certificate-authentication.html

It is recommended that you have a Global Protect Gateway license, and if you do, then you can do host information profile checks, that indeed, would use the OS and/or a serial number as an "inspection" prior to being able to gain access to the VPN.

https://docs.paloaltonetworks.com/globalprotect/7-1/globalprotect-admin/use-host-information-in-policy-enforcement/about-host-information

Please review this doc and let us know if there are any questions.

topic Re: Restrict GlobalProtect connection from a single Linux computer in General Topics

Restrict GlobalProtect connection from a single Linux computer

Re: Restrict GlobalProtect connection from a single Linux computer