06-12-2021 01:28 PM
Hi Guys!
May someone help me with this - Is there capability with Palo Alto FWs to enable some sort of network access control for both wirelss and wired to control devices on our network? The goal is to be able to prevent non-company devices from connecting to our network.
I don't think there is, but want to make sure.
Much appreciated!
06-12-2021 08:55 PM
There's really nothing directly built into your firewall to function as an actual NAC solution. You could however easily block interzone communication for anything that doesn't pass a domain-joined hip-check so that non-company endpoints couldn't traverse security zones.
The "best" solution that you could force with just the firewall and managed switches would be teaming ACLs with GlobalProtect. Effectively you would allow communication to your GlobalProtect portal/gateway and nothing else. Then utilize tunnel mode to form a tunnel to the gateway and then utilize the GlobalProtect IP Pools to actually enable network access as required.
Now just a word of caution. The first option is usually the best that you can actually hope to apply within any given organization, and while it doesn't prevent nefarious actions across your security zone it does prevent anyone from crossing security zones and getting internet access. This allows allows you to create exceptions for things that can't utilize user-id like printers and such where interzone traffic is required without a user-id or GlobalProtect connection.
The second option works in some networks and works less well in others. There's a lot of exceptions that need to be created for devices that can't have a GlobalProtect connection (like printers) and it generally means a rather large ACL list to account for everything that can't form a connection to the gateway.
06-12-2021 08:55 PM
There's really nothing directly built into your firewall to function as an actual NAC solution. You could however easily block interzone communication for anything that doesn't pass a domain-joined hip-check so that non-company endpoints couldn't traverse security zones.
The "best" solution that you could force with just the firewall and managed switches would be teaming ACLs with GlobalProtect. Effectively you would allow communication to your GlobalProtect portal/gateway and nothing else. Then utilize tunnel mode to form a tunnel to the gateway and then utilize the GlobalProtect IP Pools to actually enable network access as required.
Now just a word of caution. The first option is usually the best that you can actually hope to apply within any given organization, and while it doesn't prevent nefarious actions across your security zone it does prevent anyone from crossing security zones and getting internet access. This allows allows you to create exceptions for things that can't utilize user-id like printers and such where interzone traffic is required without a user-id or GlobalProtect connection.
The second option works in some networks and works less well in others. There's a lot of exceptions that need to be created for devices that can't have a GlobalProtect connection (like printers) and it generally means a rather large ACL list to account for everything that can't form a connection to the gateway.
06-13-2021 10:05 AM - edited 06-13-2021 10:07 AM
The only control is to detect or not the captive portal:
As @BPry mentioned you need NAC solution like F5 APM , etc. or maybe Cisco ISE can help you assign vlans to the used based on the dot1x authentication and so on.
06-13-2021 01:49 PM
@nikoolayy1 , @BPry
Thank you guys for the input! I really appreciate that. Will be looking into appropriate solution.
12-05-2023 08:34 AM
Do we have to use tunnel mode? The reason I ask is because all of our routing is on the core switch. If we set up tunnel mode, the firewall would need all those routes. So I was thinking if I do not enable tunnel mode, then the computer will keep its DHCP IP, but I am not sure if this method will work. I want to use GP to verify HIP and allow network access once it has passed validation.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
