topic Network Access Control in General Topics

Network Access Control

edemura — Sat, 12 Jun 2021 20:28:52 GMT

Hi Guys!

May someone help me with this - Is there capability with Palo Alto FWs to enable some sort of network access control for both wirelss and wired to control devices on our network? The goal is to be able to prevent non-company devices from connecting to our network.

I don't think there is, but want to make sure.

Much appreciated!

Re: Network Access Control

BPry — Sun, 13 Jun 2021 03:55:30 GMT

@edemura,

There's really nothing directly built into your firewall to function as an actual NAC solution. You could however easily block interzone communication for anything that doesn't pass a domain-joined hip-check so that non-company endpoints couldn't traverse security zones.

The "best" solution that you could force with just the firewall and managed switches would be teaming ACLs with GlobalProtect. Effectively you would allow communication to your GlobalProtect portal/gateway and nothing else. Then utilize tunnel mode to form a tunnel to the gateway and then utilize the GlobalProtect IP Pools to actually enable network access as required.

Now just a word of caution. The first option is usually the best that you can actually hope to apply within any given organization, and while it doesn't prevent nefarious actions across your security zone it does prevent anyone from crossing security zones and getting internet access. This allows allows you to create exceptions for things that can't utilize user-id like printers and such where interzone traffic is required without a user-id or GlobalProtect connection.

The second option works in some networks and works less well in others. There's a lot of exceptions that need to be created for devices that can't have a GlobalProtect connection (like printers) and it generally means a rather large ACL list to account for everything that can't form a connection to the gateway.

Re: Network Access Control

nikoolayy1 — Sun, 13 Jun 2021 17:07:09 GMT

The only control is to detect or not the captive portal:

https://docs.paloaltonetworks.com/globalprotect/9-0/globalprotect-admin/globalprotect-quick-configs/captive-portal-and-enforce-globalprotect-for-network-access.html

As @BPry mentioned you need NAC solution like F5 APM , etc. or maybe Cisco ISE can help you assign vlans to the used based on the dot1x authentication and so on.

Re: Network Access Control

edemura — Sun, 13 Jun 2021 20:49:22 GMT

@nikoolayy1 , @BPry

Thank you guys for the input! I really appreciate that. Will be looking into appropriate solution.

Re: Network Access Control

Miguel_Salas — Tue, 05 Dec 2023 16:34:35 GMT

Do we have to use tunnel mode? The reason I ask is because all of our routing is on the core switch. If we set up tunnel mode, the firewall would need all those routes. So I was thinking if I do not enable tunnel mode, then the computer will keep its DHCP IP, but I am not sure if this method will work. I want to use GP to verify HIP and allow network access once it has passed validation.