Enforcing Global Protect Connection Issue

Reply
Josh990
L1 Bithead

Enforcing Global Protect Connection Issue

Hi All,

 

Has anyone who's implemented the Enforce Global Protect connection option had issues permitting remote support applications?

 

I've tried adding the required wildcarded FQDN's to the Global Protect Portal under App Configurations but no joy yet.

 

Just wondering if anyone else has had a similar issue?


Accepted Solutions
BPry
Cyber Elite

@Josh990,

Just FYI, the FQDN exclusions aren't supported in anything prior to 5.2, the only exclusions you can configure prior to 5.2 is IP based exclusions. 

View solution in original post


All Replies
BPry
Cyber Elite

@Josh990,

What exactly are you trying to do, have it bypass the tunnel? 

Josh990
L1 Bithead

Correct, my thinking is that if an end user cannot connect to the Gateway for whatever reason but the Global Protect Client is still preventing internet access we'd be unable to provide them with remote support unless we used the static disable passcode.

Sec101
L2 Linker

Commenting here to follow.   

BPry
Cyber Elite

@Josh990,

So I've only done this in my lab, but it appears to work as I would expect without any issues and I can access allowed resources without issue. I think the difference here though is that you're trying to access the machine remotely through this method right? So you're trying to allow access to some service such as logmein or something like that so you can then remote into the machine? 

Sec101
L2 Linker

The connect to FQDN while enforcing is a 5.2 feature isn't it?   Are there any catches/issues to that?

Josh990
L1 Bithead

@BPry Correct, so the remote support client app needs to pull down a code on the impacted endpoint for use by the admin on their host software, who then establishes the remote connection.

 

Under my current testing using a pilot Portal Agent config, the connection doesn't work and a code isn't even pulled down.

 

We have the required FQDNs added into App Configurations but there is also an additional TCP port that may be required (I think we'll need to permit this on the Windows Firewall).

Josh990
L1 Bithead

I think it's also available and working in earlier versions too - although in very old versions (e.g. <5) it doesn't work properly.

BPry
Cyber Elite

@Josh990,

Just FYI, the FQDN exclusions aren't supported in anything prior to 5.2, the only exclusions you can configure prior to 5.2 is IP based exclusions. 

View solution in original post

Josh990
L1 Bithead

Ah I think that might be the issue then, so despite the option being present in PAN-OS on the GP Portal, it won't work whatsoever for versions of Global Protect older than 5.2?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!