For details on cookie usage on our site, read our Privacy Policy
GlobalProtect MAC Address Filter?
- LIVEcommunity
- Discussions
- General Topics
- GlobalProtect MAC Address Filter?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-26-2018 02:03 PM
Hello folks,
I am being asked if GlobalProtect could be locked down to only except a specific list of MAC addresses (our corporate laptops) only.
I see information about Device Block list or HIP configuration. I don't really want to specify a block list, but rather an allow list and block everything else.
Is that possible?
We using PA 3020 with 7.1.15.
Accepted Solutions
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-29-2018 01:26 PM
It would be along side...
also along side your existing authentication method.....
so... go daddy for tls profile, ldap or sso or local user or 2 factor auth plus device cert to only allow known devices.
your challenge will be to distribute certs...
can be done via Group policy..
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-27-2018 06:00 AM
Not via mac address but have you considered certifcates...
just generate a root CA on your palo and then use this to create device certificates...
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-29-2018 11:40 AM - edited 10-29-2018 11:40 AM
Ok, gotcha. Thanks @MickBall
Would this be along side (separately) from the existing wildcard we use for our GlobalProtect Gateway SSL/TLS profile?
Or instead of?
As I am thinking...sounds like could be instead of. Could use "local" certificates rather than one like GoDaddy that every device has a CA root cert for.
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-29-2018 01:26 PM
It would be along side...
also along side your existing authentication method.....
so... go daddy for tls profile, ldap or sso or local user or 2 factor auth plus device cert to only allow known devices.
your challenge will be to distribute certs...
can be done via Group policy..
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-29-2018 01:51 PM
Thank you! @MickBall
Looks like I can follow this documentation.
I have a test environment to prove this out. I'll close this now, update it later.
- SAML Authentication for GP Portal and GP GW in GlobalProtect Discussions
- Regex Help Event ID 4720 in Cortex XDR Discussions
- A way to correlate the logs for DNS Sinkhole? in General Topics
- RQL Custom queries for AWS needed URGENTLY in Prisma Cloud Discussions
- add a second portal address to GlobalProtect (v5.2.12-26) on Mac in General Topics
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
