I want to create a IPSec tunnel and use the global protect client to access via VPN our PCI internet network can that be done?
So you are creating a IPSec Tunnel on the Palo Alto that allows access to a PCI network; and then you want to allow your GlobalProtect clients (or a subset of clients) access to these resources?
Generally I caution people to be very cautious when looking to enable remote access on a PCI network, and to guarantee that you have actually read through and verified you meet all requirements. One such example would be that you need to have MFA on this if you are accessing a PCI network to maintain compliance.
With already have this process in place using a ASA 5510, (less then 10 people have this access), but the ASA 5510 going end of support so we need to replace it. Currently the use the native client on their PC to connect to the ASA 5510 and go through a IPSec tunnel to access the PCI network. I tried to use the globalprotect portal but it did not offer IKE2. I want to use GP client 4.1 with multiple portal options to connect to the PA and go through a IPSec tunnel to the PCI network and yes we NAT to the PCI network.
I guess I am not sure the correct way to go about doing this or if the GP client can even be used in this way. If anyone is doing something similar let me know
you probably do not need IKEv2 for global protect,
you already have a anyconnect client, coming in on an ASA, then it routes to a PaloAlto firewall that has a VPN tunnel and the traffic flows through it, If true, you should be able to configure Paloalto to use SSL and then reroute the traffic through VPN (B2B) tunnel.
you already have a anyconnect client, coming in on an ASA, then it routes to a ASA firewall that has a VPN tunnel (U-Turning the traffic) and the traffic flows through it, If true, you should still be able to configure Paloalto to use SSL and then reroute the traffic to the ASAand eventually VPN (B2B) tunnel, you would just need to make sure routing is set properly on both firewalls, my suggestion would be to use seperate set of pool ip addresses for both.
If there is another scneraio, let me know.
We do not use annyconnect, mostly they currently use the native client on their PC. Yes we are planning on putting an ssl cert on the new tunnel. The plan is to replace the ASA and only use the PA as a VPN IPSec tunnel into the PCI network, I am just trying to figure out what I need to configure to make that happen
So I think some of the terminology is getting crossed here.
1) Do you currently connect to the PCI network via an IPSec Tunnel; by that I mean does the ASA form a tunnel to a payment processor?
2) Do you wish to keep the ability to use the internal VPN client or force them to use the GlobalProtect Agent?
How you would likely want to set this up.
1) You'll need to form the tunnel between the PA and the payment processor, essentially just recreating the tunnel on the Palo Alto. I would generate a completely new zone for this and call it something like 'PCI Network'.
2) You can either configure security policies that would allow the users who require PCI Network access and keep a single gateway, or you could create a new gateway for the PCI network and they would simply switch between the two.
3) Since this is touching PCI you need to ensure that GlobalProtect would be secured by MFA.
Ideally, and how I would personally recommend you configure this, is that the PCI network gets it's own VSYS on the firewall. This ensures that you don't have to really worry about misconfiguring something and accidently granting interzone communication that allows non-PCI compliant traffic access to your PCI network. It also makes PCI audits a bit easier to deal with since they don't have to look at your entire firewall configuration.
Ok, makes sense now,
To achieve this, i would put Global Protect and VPN tunnels in seperate zones, and then we can use virtual router in order to route the traffic from one zone to another, and use Security policy to restrict it to specific ip and port too.
In a nutshell you need:
1) global protect
2) b2b tunnel to PCI
3) seperate zones for both mentioned above
4) security rules to allow traffic between these two zones.
if you need help setting either of these i can provide you links to them.
what is b2b tunnel?
Global protect client is what you are referring too
You mentioned I did not need IKE2 but our security guy wants us to use IKE2 that is why I was unable to use a global protect portal and have to look at using an IPSec tunnel instead
PCI already has its own zone configured on the firewall
Yes I would be interested in seeing the links you are referring too
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!