Inbound Listening Ports on GP Connected MAC's

[recross]

Has anyone noticed the ability to make inbound connections to a GlobalProtect connected MAC OSX system?  We had recently enabled split-tunneling thanks to the big bad video conferencing applications. But quickly discovered that on MAC and Windows systems, when domain or application split-tunneling is enabled, all inbound access from the local network is allowed. In other words, another host on the users home WiFi could SSH or proxy through the GP connected system, gaining access to the corporate network. Sure defense in depth may help you here, but the this seems like a major oversight. So, we rolled back split-tunneling. The windows systems returned to what we considered to be the expected behavior when the "no direct access to local network" box is checked. Which is, no inbound or outbound connections are allowed from the GP connected system to the local network. The MAC systems did not behave as we had expected. The ability to SSH or Proxy through the GP connected MAC persisted. Curious if anyone could replicate the testing?

Test States:

windows:

state: ndla-yes, no splits - no access from local network is permitted

state: ndla-yes, route split, no domain/app splits - no access from local network is permitted

state: ndla-yes, route split, domain split, no app splits - inbound access from local network is permitted

state: ndla-yes, route split, no domain split, app splits - inbound access from local network is permitted

state: once ndla-no  - inbound/outbound access from local network is permitted (splits don't change this)

MAC:

state: ndla-yes, no splits - inbound access from local network is permitted

state: ndla-yes, route split, no domain/app splits - inbound access from local network is permitted

state: ndla-yes, route split, domain split, no app splits - inbound access from local network is permitted

state: ndla-yes, route split, no domain split, app splits - inbound access from local network is permitted

state: once ndla-no  - inbound/outbound access from local network is permitted (splits don't change this)

[kiwi]

Hi @recross ,

I'm unable to replicate this.  What's the versions you're testing this in ?

Eitherway, the behaviour does not seem correct and I would recommend reaching out to support.

Guessing some tunnel and physical interface PCAPs + GP dump level debug on split tunnel routing decisions need to be taken to further troubleshoot this.

Cheers,

-Kim.

[recross]

TAC has stated that from a MAC perspective it is behaving as expected. Their response below in red. If I had to guess your system firewall is enabled and blocking incoming connections. As for versions I have tested, firewall OS 8.1.10, 8.1.13, GP 5.0.5, 5.0.9, 5.1.2,5.1.3.

I've been researching on this and found some points on the DLSA behavior:

- The DLSA feature (No Direct Access to Local Subnet) only blocks outbound access based on the routing table.
- For IPv4 on Windows OS, GP client modifies physical adapter setting to let access route take precedence over source IP so the response packets of the incoming connects also goes through tunnel.
- For MacOS, inbound connection's response goes through the source IP of interface.
- In general, the incoming connections should be controlled by the firewall of local device.

As per research until this point, it looks like working as expected where:
- Response to the inbound connections on Windows is going via GP Tunnel
- Response to the inbound connections on MacOS is going via the source IP of interface where the connection is made

Additionally, we will check/confirm the WindowsOS vs MacOS behavior for DLSA related to Inbound Connections in the lab. If needed, we will involve engineering for confirmation and update you.