Is there a Captive Portal type solution for non http/https services?

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L0 Member

Is there a Captive Portal type solution for non http/https services?

I am looking for a method to force identify users coming in over the internet trying to connect to an internal resource using MS-RDP.

 

I originally thought I could use Captive Portal for this but CP documentation indicates its only works with HTTP & HTTPS....obviously this makes sense because without an http interpreter, how else could an app that is not designed to talk to http recognize the HTTP/HTTPS Captive Port web-form or redirect.

 

Is it possible to force a type of user authentication for users coming from Untrust Internet (any IP) to Trust internal (specific IP).  Or what other method could I use or investigate?

 

Thanks.

Highlighted
L3 Networker

Use of User-ID based rules from Untrust (Internet) to Trust (internal) is discouraged. 

 

As User-ID creates a mapping of the IP address to a single user, the multiple NAT scenarios that can come into play here can give you unintended results. 

 

If we both happened to be at the same coffee shop and NAT'd to the same IP address, if you were the first to access the corporate resource and challenged by captive portal, I and all of the others in the coffee shop would inherit your access rights. 

 

You might consider deploying a GlobalProtect gateway, and then using your App-ID/User-ID based rules to permit access for the appropriate users to the systems via RDP.

 

 

Highlighted
L7 Applicator

as @asilliker already mentions, I'd deploy GlobalProtect from a best practices perspective

it will allow you to identify your users more easily and apply security policy based on their identity,  plus will add a layer of security (ipsec/ssl) to prevent snooping or MitM attacks when your users are making rdp connections from any random uncontrolled location to your infrastructure

Tom Piens - PANgurus.com
New to PAN-OS or getting ready to take the PCNSE? check out amazon.com/dp/1789956374
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!