topic Re: Enforcing Global Protect Connection Issue in General Topics

Enforcing Global Protect Connection Issue

Josh990 — Wed, 20 Jan 2021 13:28:42 GMT

Hi All,

Has anyone who's implemented the Enforce Global Protect connection option had issues permitting remote support applications?

I've tried adding the required wildcarded FQDN's to the Global Protect Portal under App Configurations but no joy yet.

Just wondering if anyone else has had a similar issue?

Re: Enforcing Global Protect Connection Issue

BPry — Wed, 20 Jan 2021 14:53:52 GMT

@Josh990,

What exactly are you trying to do, have it bypass the tunnel?

Re: Enforcing Global Protect Connection Issue

Josh990 — Wed, 20 Jan 2021 15:11:12 GMT

Correct, my thinking is that if an end user cannot connect to the Gateway for whatever reason but the Global Protect Client is still preventing internet access we'd be unable to provide them with remote support unless we used the static disable passcode.

Re: Enforcing Global Protect Connection Issue

Sec101 — Tue, 26 Jan 2021 17:17:47 GMT

Commenting here to follow.

Re: Enforcing Global Protect Connection Issue

BPry — Tue, 26 Jan 2021 21:59:02 GMT

@Josh990,

So I've only done this in my lab, but it appears to work as I would expect without any issues and I can access allowed resources without issue. I think the difference here though is that you're trying to access the machine remotely through this method right? So you're trying to allow access to some service such as logmein or something like that so you can then remote into the machine?

Re: Enforcing Global Protect Connection Issue

Sec101 — Tue, 26 Jan 2021 22:22:18 GMT

The connect to FQDN while enforcing is a 5.2 feature isn't it? Are there any catches/issues to that?

Re: Enforcing Global Protect Connection Issue

Josh990 — Wed, 27 Jan 2021 10:07:48 GMT

@BPry Correct, so the remote support client app needs to pull down a code on the impacted endpoint for use by the admin on their host software, who then establishes the remote connection.

Under my current testing using a pilot Portal Agent config, the connection doesn't work and a code isn't even pulled down.

We have the required FQDNs added into App Configurations but there is also an additional TCP port that may be required (I think we'll need to permit this on the Windows Firewall).

Re: Enforcing Global Protect Connection Issue

Josh990 — Thu, 28 Jan 2021 09:26:25 GMT

I think it's also available and working in earlier versions too - although in very old versions (e.g. <5) it doesn't work properly.

Re: Enforcing Global Protect Connection Issue

BPry — Thu, 28 Jan 2021 16:47:18 GMT

@Josh990,

Just FYI, the FQDN exclusions aren't supported in anything prior to 5.2, the only exclusions you can configure prior to 5.2 is IP based exclusions.

Re: Enforcing Global Protect Connection Issue

Josh990 — Fri, 29 Jan 2021 09:24:47 GMT

Ah I think that might be the issue then, so despite the option being present in PAN-OS on the GP Portal, it won't work whatsoever for versions of Global Protect older than 5.2?

Re: Enforcing Global Protect Connection Issue

BPry — Fri, 29 Jan 2021 16:03:31 GMT

@Josh990,

Correct. The options are tied to your PAN-OS version and your content-update release; the firewall doesn't take your deployed agent version into account when listing options.

Re: Enforcing Global Protect Connection Issue

Josh990 — Fri, 29 Jan 2021 16:19:27 GMT

Ok, that makes sense. I'll deploy a later compatible version and test again. Thanks

Re: Enforcing Global Protect Connection Issue

Josh990 — Fri, 05 Feb 2021 13:06:30 GMT

Works fine now since upgrading to 5.2.4. Cheers