Does PA supports Agentless Remote Access VPN

[Pramod.G]

Hi All,

Please let me know, whether PA supports agentless(GlobalProtect) remote access VPN? With SSL or IPSec.

If it supports, please let me know how to configure it.

Thank you in advance..

[Hithead]

Hi,

How you imagine to build up a Client-VPN connection without any agents?

PANOS requires GP for Client-VPN.

[Pramod.G]

Thanks Hithead for your response.

But, its not my imagination; It was a client's requirement and also I said its not possible. They have insisted to getr an answer the same from PA. So, I have posted the question.

Anyway Thanks!!!

[Raido_Rattameister]

As Windows built in VPN client is not standards based IPSec then it does not work with Palo.

You need GlobalProtect agent for it (Cisco vpn client works also).

With IOS and Android you can use GlobalProtect app (you need gateway subscription in your firewall) or you can use built in vpn client and no additional license is required. Built in client is actually Ciscos client.

[reaper]

Hi All

There are some products out there that support what is called "clientless vpn". In reality this is usually a sort of web-portal that allows the user proxied access to certain applications via browser plugins. GlobalProtect however is a full suite VPN solution that allows for additional security including HIP checks and pre-windows-logon full security VPN. It does support ipsec and SSL but does require a client.

hope this helps

Tom

[pulukas]

There are products that are able to do remote vpn via web browser based clients only or using the built in clients of the OS.  these are especially useful when you are trying to allow a VPN to a vendor or contractor where you do not have access to install software on the computer, or the user will not have the access to do so, or company policy does not allow adding software, or there are already VPN clients installed for use that conflict.

Palo Alto does not support this approach at this time.  If you company wants an official answer, you will need to contact your sales engineer or open an officlal support ticket.  Palo Alto does not discuss roadmap product features in public forums.

[Raido_Rattameister]

Not all clientless solutions out there does not mean it really works out of the box.

For example you might need to install active-x plugin. To install that you might need Admin permissions and it is not available in Edge browser. There are also Java solutions available but this means that they still need supporting software. 

[Pramod.G]

Thank you all for your responses!!