- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
09-21-2013 06:56 PM
Hi all,
I am configuring a PA-500 for a POC exercise with a customer who is currently using a Sonicwall.
While there are obviously other/better ways to accomplish this and I realize how silly this is, given the limited scope I'm presently working in, I need to find a way to replicate a feature they presently "require".
In Sonicwall world, a user outside the corporate network can browse to the WAN IP of the firewall and log in with their credentials to become a "Trusted User" on the firewall. A firewall rule applying only to "Trusted Users" then allows them to RDP to a different IP in their /28 which gets NAT-ed through to a Remote Desktop server on the inside. Kind of a "Captive Portal in reverse", I guess.
Is there any way to replicate this functionality as closely as possible in PAN world??
Many thanks!
--jeff
09-22-2013 12:22 AM
Hello Jeff,
You can set up and customize a captive portal to direct user authentication by way of an authentication profile, an authentication sequence, or a client certificate profile. Captive portal can be used in conjunction with the User-ID Agent to extend user identification functions beyond the Active Directory domain. Users are directed to the portal and authenticated, thereby creating a user-to-IP address mapping.
Also If the user cannot be identified based on login information, an established session or client probe, the firewall can redirect any outbound HTTP requests and redirect the user to a web form. The web form can transparently authenticate the user through a NTLM challenge, which is automatically evaluated and answered by the web-browser or through an explicit login page.
Thanks
09-22-2013 12:22 AM
Hello Jeff,
You can set up and customize a captive portal to direct user authentication by way of an authentication profile, an authentication sequence, or a client certificate profile. Captive portal can be used in conjunction with the User-ID Agent to extend user identification functions beyond the Active Directory domain. Users are directed to the portal and authenticated, thereby creating a user-to-IP address mapping.
Also If the user cannot be identified based on login information, an established session or client probe, the firewall can redirect any outbound HTTP requests and redirect the user to a web form. The web form can transparently authenticate the user through a NTLM challenge, which is automatically evaluated and answered by the web-browser or through an explicit login page.
Thanks
09-22-2013 02:58 AM
If these users need connect from the outside/internet, enabling CP on WAN interface would be taxing for the firewall resources. Only alternative that I can think of is using Global Protect configured with External Gateway.
Users can connect to GP portal/gateway and authenticate using their AD/Radius/Kerberos/Local DB credentials and would be assigned an IP from the configured IP pool.
Security policies can be configured between the tunnel zone and Inside zone to access the RDP server.
Plus....GP (1Portal + 1Gateway ) does not need licenses starting OS_4.1.x
HTH..!
09-22-2013 05:01 AM
Typing wan ip to a browser.....
users are outside on the internet ? or inside just guest....solution will depend on their position...
Captive Portal looks like a suitable solution for that.
09-23-2013 02:47 AM
Outside on the internet.
Thanks,
--jeff
09-23-2013 02:48 AM
I imagine that if they buy this thing after the POC that they'll be deploying GP, but sadly for now I have to figure out how to do this without otherwise it isn't going to fly......................
09-23-2013 03:01 AM
The use case here is for some employees with Macs to be able to log into the terminal server from home. I'm told that connecting a Mac to a Sonicwall can be a pain in the backside. Obviously GP works on OS X, and I bet the built in VPN client would work fine as well... but the preference at this point is to rock the boat as little as possible to get the blue device in the door.
I considered throwing it in in vwire mode but one of their pain points is how pokey the Sonicwall is with all the security features turned on.
09-23-2013 03:27 AM
VWIRE mode with following settings should be a good way to start.
1> All the tags allowed 0-4094
2>Non-Syn-tcp-reject turned off
3>assymetric bypass tuned on
These settings would ensure that PA functions as a transparent device, staying inline.
Security features can be selectively turned on an ad hoc basis.
-HTH...!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!