GP+DECRYPT+MFA

[norbhinn]

Hello,

I have been playing around with this setup:

- user connect to internal network with globalprotect

- initiating any connection to internal resources trigger ether a redirect to captive portal for MFA challenge or a global protect popup with the captive portal URL for MFA challenge.

This seem to work as expected, but I have encounter a show-stopping problem:

Accessing the palo-alot mgmt URL i expected to be redirected to the captive portal page for multi-factor-auth. but instead I got access to the URL. Investigating I noticed that the decryption failed (for some reason for this to work you have to decrypt SSL. Initiating an SSH connection will trigger the MFA popup from GP but you do not need to decrypt ... that in itself is a bit strange).

Anyhow I suspect that there are some chiper issue that fail when PA tries to decrypt the default SSL certificates. I could off curse solve this by replacing the management SSL certificates but this means that any SSL internal resource that fail the decryption will be accessible without MFA.

Should not the default action here be to drop the connection? As far as I am aware there is no possible security policy to deny access if decryption fail.

[reaper]

Is the mgmt profile configured on the same interface that hosts the CaptivePortal page? 

setting the profile on a 'remote' interface (connection needs to travel through the firewall to get to the interface) may resolve your issue

[norbhinn]

Hello,

Thanks for the reply.

No its not. The captive protal is hosted on the tunnel interface used by globalprotect. Works as a charm on all other stuff except the mgmt interface. I think I will replace the build in certificates and see what happens. Thanks.