xauth use on global protect tunnels

[jdprovine]

how many are using xauth on the global protect tunnels and why ? We are using it because we have users using native clients on PC's and phones (don't want to pay for the mobile license for on)? 

Let me know what you think and the pros and cons of using xauth

[hshawn]

I am using it for my lab network so I can avoid the mobile client. Frankly (I cannot speak to the iOS version) the Android client seems like it is an afterthought and looks very dated. I also had some pretty notiable battery drain while I was testing it since it was setup to always be on and would auto connect/disconnect each time I would unlock/relock my phone. Xauth PSK works great and you can have it setup in conjunction with GP. That being said we do not have employees using it from BYOD devices. For that we have another MDM solution with a per-app micro VPN tunnel

[jdprovine]

@hshawn

Thanks for you input. Do you see any security issues when using xauth?

[hshawn]

I think the standard security issues apply here... of course make sure to use a really good shared key and password for the user, use security policies to further scope down what the user(s) can do/have access to, monitor the VPN connections (these will show up in the GP gateway along side the GP VPN connections) etc...

[fjwcash]

We use it on two GP Gateways to allow Linux stations to connect to the VPN. Along with LDAP user authentication.

And we use it to allow Grandstream 3200-series VoIP handsets to connect to the PBX via the VPN. These are Android-based phones, and it was a lot easier to connect to the GP Gateway than to get SIPS and other stuff enabled on the PBX.

Until there's a working, stable version of the GP Agent for Linux, well continue to use X-Auth for these.

[jdprovine]

@fjwcash

Have you tried the new version 4.1 GP client its suppose to supporet linux

[fjwcash]

Not yet. 4.1.0 had lots of issues. 4.1.1 was just released that's supposed to have fixed then, but haven't tested it yet.

Don't you need PanOS 8.x to use GP 4.1? We are just upgrading to 7.1.x with no plans to go to 8.0 this year.

[BPry]

@fjwcash,

You need to be running at least 7.1 for GP 4.1.