Global protect client to connect using a IPSec tunnel

[jdprovine]

I want to create a IPSec tunnel and use the global protect client to access via VPN our PCI internet network can that be done?

[BPry]

@jdprovine,

So you are creating a IPSec Tunnel on the Palo Alto that allows access to a PCI network; and then you want to allow your GlobalProtect clients (or a subset of clients) access to these resources? 

Generally I caution people to be very cautious when looking to enable remote access on a PCI network, and to guarantee that you have actually read through and verified you meet all requirements. One such example would be that you need to have MFA on this if you are accessing a PCI network to maintain compliance. 

[jdprovine]

@BPry

With already have this process in place using a ASA 5510, (less then 10 people have this access), but the ASA 5510 going end of support so we need to replace it. Currently the use the native client on their PC to connect to the ASA 5510 and go through a IPSec tunnel to access the PCI network.  I tried to use the globalprotect portal but it did not offer IKE2.  I want to use GP client 4.1 with multiple portal options to connect to the  PA and go through a IPSec tunnel to the PCI network and yes we NAT to the PCI network.

[jdprovine]

@BPry

Yes we already do MFA to access the PCI network

[jdprovine]

I guess I am not sure the correct way to go about doing this or if the GP client can even be used in this way. If anyone is doing something similar let me know

[Harshit]

you probably do not need IKEv2 for global protect,

Scenario:1

you already have a anyconnect client, coming in on an ASA, then it routes to a PaloAlto firewall that has a VPN tunnel and the traffic flows through it, If true, you should be able to configure Paloalto to use SSL and then reroute the traffic through VPN (B2B) tunnel.

Scenario: 2

you already have a anyconnect client, coming in on an ASA, then it routes to a ASA firewall that has a VPN tunnel (U-Turning the traffic)  and the traffic flows through it, If true, you should still be able to configure Paloalto to use SSL and then reroute the traffic to the ASAand eventually VPN (B2B) tunnel, you would just need to make sure routing is set properly on both firewalls, my suggestion would be to use seperate set of pool ip addresses for both.

If there is another scneraio, let me know.

~HTH

[jdprovine]

@Harshit

We do not use annyconnect, mostly they currently use the native client on their PC. Yes we are planning on putting an ssl cert on the new tunnel.  The plan is to replace the ASA and only use the PA as a VPN IPSec tunnel into the PCI network, I am just trying to figure out what I need to configure to make that happen

[BPry]

@jdprovine,

So I think some of the terminology is getting crossed here. 

Couple questions.

1) Do you currently connect to the PCI network via an IPSec Tunnel; by that I mean does the ASA form a tunnel to a payment processor? 

2) Do you wish to keep the ability to use the internal VPN client or force them to use the GlobalProtect Agent? 

How you would likely want to set this up. 

1) You'll need to form the tunnel between the PA and the payment processor, essentially just recreating the tunnel on the Palo Alto. I would generate a completely new zone for this and call it something like 'PCI Network'. 

2) You can either configure security policies that would allow the users who require PCI Network access and keep a single gateway, or you could create a new gateway for the PCI network and they would simply switch between the two. 

3) Since this is touching PCI you need to ensure that GlobalProtect would be secured by MFA. 

Ideally, and how I would personally recommend you configure this, is that the PCI network gets it's own VSYS on the firewall. This ensures that you don't have to really worry about misconfiguring something and accidently granting interzone communication that allows non-PCI compliant traffic access to your PCI network. It also makes PCI audits a bit easier to deal with since they don't have to look at your entire firewall configuration. 

[Harshit]

Ok, makes sense now,

To achieve this, i would put Global Protect and VPN tunnels in seperate zones, and then we can use virtual router in order to route the traffic from one zone to another, and use Security policy to restrict it to specific ip and port too.

In a nutshell you need:

1) global protect

2) b2b tunnel to PCI

3) seperate zones for both mentioned above

4) security rules to allow traffic between these two zones.

if you need help setting either of these i can provide you links to them.

~HTH

[jdprovine]

@Harshit

what is b2b tunnel?

Global protect client is what you are referring too

You mentioned I did not need IKE2 but our security guy wants us to use IKE2 that is why I was unable to use a global protect portal and have to look at using an IPSec tunnel instead

PCI  already has its own zone configured on the firewall

Yes I would be interested in seeing the links you are referring too

[BPry]

@jdprovine,

b2b tunnel is simply an industry term for business to business, in other words you are connecting your university to the PCI Processing network. 

Does your security guy want you to utilize IKE2 for the actual PCI tunnel or for the clients connecting to the firewall? You really shouldn't be allowing X-Auth to even be used on this connection and you should be forcing anyone that needs remote PCI access to login through an actual GlobalProtect Agent. 

[Harshit]

Sure,

B2B , Business-to-Business tunnel , is just another name i use to mention VPN tunnel 🙂

you can configure VPN tunnel on IKEv2 and Use SSL for Global protect

for site to site

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/vpns/set-up-site-to-site-vpn

for global protect:

https://live.paloaltonetworks.com/t5/Configuration-Articles/Basic-GlobalProtect-Configuration-with-U...

[jdprovine]

1) Do you currently connect to the PCI network via an IPSec Tunnel; by that I mean does the ASA form a tunnel to a payment processor? 

Not to the payment processor but for our users to access the PCI network

2) Do you wish to keep the ability to use the internal VPN client or force them to use the GlobalProtect Agent? - 

They have been using a native client and L2TP. The PA does not support L2TP so they will no longer be able to use the native client anymore so I have to provide them with a client that is compatible with the PA.

How you would likely want to set this up. 

1) You'll need to form the tunnel between the PA and the payment processor, essentially just recreating the tunnel on the Palo Alto. I would generate a completely new zone for this and call it something like 'PCI Network'. 

Already have a zone on the PA for the PCI network

2) You can either configure security policies that would allow the users who require PCI Network access and keep a single gateway, or you could create a new gateway for the PCI network and they would simply switch between the two. 

I plan on creating a new gateway - but my big issue is the IPSec tunnel configuration on the PA how to do it and if it will work with the GP client and if not what client will it work with

3) Since this is touching PCI you need to ensure that GlobalProtect would be secured by MFA. 

     Yes we intend on continuing to use MFA, using radius

[jdprovine]

@BPry

Does your security guy want you to utilize IKE2 for the actual PCI tunnel or for the clients connecting to the firewall?  good question if I know him he would want both if it can be done. 

I agree absolutely we need to get rid of x-auth but its hard to get them all off the native client and the cisco client. Even the security guy uses his native client instead of the GP client on his MAC

[BPry]

@jdprovine,

Okay so referencing the same number scheme as before.

1) Do you currently connect to the PCI network via an IPSec Tunnel; by that I mean does the ASA form a tunnel to a payment processor? 

Not to the payment processor but for our users to access the PCI network

So you don't have a tunnel to the processor and the PCI Network is simply a zone that you had the ASA located in.

2) Do you wish to keep the ability to use the internal VPN client or force them to use the GlobalProtect Agent? - 

They have been using a native client and L2TP. The PA does not support L2TP so they will no longer be able to use the native client anymore so I have to provide them with a client that is compatible with the PA.

This is good, you don't want X-Auth on at all and you should be forcing people onto the agent.

How you would likely want to set this up. 

1) You'll need to form the tunnel between the PA and the payment processor, essentially just recreating the tunnel on the Palo Alto. I would generate a completely new zone for this and call it something like 'PCI Network'. 

Already have a zone on the PA for the PCI network

Good

2) You can either configure security policies that would allow the users who require PCI Network access and keep a single gateway, or you could create a new gateway for the PCI network and they would simply switch between the two. 

I plan on creating a new gateway - but my big issue is the IPSec tunnel configuration on the PA how to do it and if it will work with the GP client and if not what client will it work with

If the PCI Network already exists on the Palo Alto and you don't need to make a connection to a payment processing network don't worry about re-creating the tunnel here. If this tunnel truly is to just allow users to connect force them to the GlobalProtect agent. 

3) Since this is touching PCI you need to ensure that GlobalProtect would be secured by MFA. 

     Yes we intend on continuing to use MFA, using radius

Good