disabling global protect web portal

[nevolex]

hi team 

is there a way to disable global protect web portal only leaving the actual vpn gateway functioning?

thank you

[nevolex]

Hi, thanks for the comment, I was meant to say how to disable the web portal itself (from the firewall side), so palo alto does not listen on 443 to launch the webpage once url us entered 

[MP18]

@nevolex I do not think it is possible by design to do this.

As GP uses IPSEC/SSL connection to work.

Regards

Mahesh

[nevolex]

it is very possible 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClbpCAC

[MP18]

@nevolex 

As per my understanding  the  user is asking if Portal config is not there not the login page.

Thanks for the reply.

Regards

Mahesh

[Raido_Rattameister · Accepted solution]

Initially GlobalProtect agent will connect to portal and get list of gateways.

After that GlobalProtect agent will establish VPN tunnel to one of gateways (if all gateways have same priority then latency is deciding factor which gateway is chosen).

GlobalProtect agent will then cache this list of gateways. By default for 24 hours before it needs to talk to portal again.

You can disable portal web login but portal itself needs to exist (as mentioned in link shared previously).

[JordanScott]

This was the solution I was looking for and worked for me. Thank you!

[Flang3r]

Is it possible to keep GP portal (and login page), but disable it listening on port 80 so it only listens on 443?

[Raido_Rattameister]

Port 80 will redirect to 443 by default.

If you don't like 80 to be open then don't add this port into firewall rule that permits traffic from Internet towards GlobalProtect Portal.

[Flang3r]

The thing is, I don't have any rule in firewall policy exclusively permitting anything from internet to outside facing interface, that GP portal/gateway run on. Furthermore if I watch traffic log and telnet to public_ip:80, I don't even see that flow logged, although every rule including explicit deny any rule in the end for all to all zones have logging enabled. I can see successful/failed VPN activity on GlobalProtect log page though.

[Raido_Rattameister]

If you don't have "Block Any" rule at the end then traffic from outside zone to outside zone is permitted by default rule "intrazone-default".

As step one select intrazone-default rule, click "Override" at the bottom and check "Log at Session End" on Actions tab to enable logging on the rule.

[Flang3r]

I do have deny any configured exclusively in the end with logging enabled. Could this be something related to firewall being a VM version? Also PA VMs don't have an override option for their default rules.

[ZachHeise]

We found nevolex's link as well - but the problem is that in our portal configuration, the "Disable" option is outright missing, we only have "factory-default" on all our portals. How do we add Disable as an option? We have an 'import' button too though..... but is disabling a portal something we need to import??

edit: oh good grief I just noticed the "disable" option is under "portal login page" NOT "portal landing page" - the image on the article confused me, since the dropdown is extended, it looked as if I should be finding the option to Disable on Portal Landing. All set.