topic SNI for GlobalProtect in General Topics

SNI for GlobalProtect

CLIq — Wed, 14 Oct 2020 16:53:17 GMT

Hi,

is there a way for globalprotect to only listen to a specific URL and forward all other FQDNs?

I already have webservers behind the palo listening to specific SNIs and would like to keep it this way.

Re: SNI for GlobalProtect

CLIq — Fri, 16 Oct 2020 11:20:18 GMT

is a "bump" allowed? ^^

Re: SNI for GlobalProtect

BPry — Fri, 16 Oct 2020 19:39:58 GMT

@CLIq,

The firewall natively doesn't support this feature. You can reach out to your SE to get a feature request put in for this to be considered going forward.

Re: SNI for GlobalProtect

CLiqr — Sun, 04 Apr 2021 21:45:17 GMT

I used a reverse proxy for the portal which works fine and entered a fqdn in the portal for the gateway...

unfortunately the globalprotect client simply resolves the IP and doesnt pass the SNI so it could be passed through a reverse proxy...
but maybe a clientless connection would work... might try that