Clientless Remote Access VPN

[Alexis_Koch]

Hello,

We've just purchased a PA-3020 in order to replace an old Checkpoint. We have a few site-to-site VPN, and some other VPNs using a Checkpoint client. I would like to get rid of the clients and use some king of clientless VPN, so I won't be bothered by the OS (which kind of Windows is supported by GlobalProtect client, do the partner have admin rights etc). But I cannot find how to configure this. I've read the admin guide and the Global Protect agent user guide and now I'm asking myself (and you 😉 😞 can Palo Alto support clientless VPN?

Thank you!

[Raido_Rattameister · Accepted solution]

Palo Alto Networks firewall does not have clientless VPN.

GlobalProtect still is agent running in client machine (either laptop or phone).

In case of phone you can use built in vpn client (instead of GlobalProtect app) if you need to.

[Alexis_Koch]

That is so disappointing... Even without speaking about the seller who, I'm pretty sure, told me PAN can do it...

[jharlow]

Does this mean you cannot use the native VPN client in Windows or say iOS to establish a VPN connection?

[Raido_Rattameister]

Not sure about Windows but you can use built in client in iOS for example.

[jvalentine]

Does this mean you cannot use the native VPN client in Windows or say iOS to establish a VPN connection? 

PAN-OS supports standards-based IPSEC.  This means you can use the built-in iOS and Android clients for mobile platforms, as well as the built-in VPN capabilities in Mac OSX.

Unfortunately, Windows does not support standards-based IPSEC, so your only option is to install a client - either the GlobalProtect SSL client (recommended) or a standards-based IPSEC client. 

[jharlow]

This is unfortunate to hear. We are currently using a Cisco ASA as our VPN solution which works with Windows native VPN solutions. Are there any plans to support Win native client? Has this change with the release of Windows 10?

[johan.ryberg]

Hi,

It's now supported in version 8 for web applications