GlobalProtect agent download from direct URL

[FabienJ]

Hi everyone,

Do you know if it's possible to block the download of the globalprotect agent via the direct URL ? 

The goal here is to force users to authenticate in the portal web page to be able to download the agent.

Ex. for the 64bit agent :

https://<my-portal-address>/global-protect/getmsi.esp?version=64&platform=windows

If yes, could you please share the steps to solve it ?

Thanks a lot !

Fabien.

[Oyin-Idowu]

There are couple of steps to achieve this depending on the configuration that already exist on your appliance.

1. Go to device > Certificate mgt > ssl/tls service profile > add. It should look like the image (2) below when you are done.

2. Network > GlobalProtect > Portal > Add >On the General Tab > Add > name> external interface > IP Address

3. Then on the authentication Tab confiigure your PA appliance as shown below in Image 1. This forces the portal to request user credentials before they can access the portal to download the agent. FYI, my environment uses the Local User database for authentication, yours may be different.

[Oyin-Idowu]

You will also need to Generate a certificate or upload the certificate for Global protect using the public IP address of your untrust interface. see below

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Generate-a-New-Self-Signed-SSL-Certi...

[BPry]

@FabienJ,

I'm not positive of a way to actually do this and still allow the download to accomplish on the portal. It's kind of like the ASAs in the point where if you know where to direct it for the file itself you can get the download without authentication. You could put the link itself behind a captive portal if this is a big enough issue for you, but the user experiance if they go through the portal would be pretty bad. 

@Oyin-Idowu,

The authentication to the portal itself I'm sure is working perfectly fine, the file however can still be downloaded even if you don't authenticate by going directly to the download link. 

[vsys_remo]

@Oyin-Idowu

I think @FabienJ has already done the steps you describe ... what he wants is to FORCE users to authenticate so nobody should be able to download the GP agent without log in

@FabienJ

You probably want to ask your SE for a feature request.

I can think of a possibility to achieve this, but at the moment I don't know if this works and it also contains something that's normally not recommended ... I will first do a little test before I write some sensless stuff here

... and once again @BPry was faster 😉 ...