Network Access Control

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Network Access Control

L0 Member

Hi Guys! 

May someone help me with this - Is there capability with  Palo Alto FWs to enable some sort of network access control for both wirelss and wired to control devices on our network? The goal is to be able to prevent non-company devices from connecting to our network.

I don't think there is, but want to make sure. 

Much appreciated! 

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

@edemura,

There's really nothing directly built into your firewall to function as an actual NAC solution. You could however easily block interzone communication for anything that doesn't pass a domain-joined hip-check so that non-company endpoints couldn't traverse security zones. 

The "best" solution that you could force with just the firewall and managed switches would be teaming ACLs with GlobalProtect. Effectively you would allow communication to your GlobalProtect portal/gateway and nothing else. Then utilize tunnel mode to form a tunnel to the gateway and then utilize the GlobalProtect IP Pools to actually enable network access as required. 

 

Now just a word of caution. The first option is usually the best that you can actually hope to apply within any given organization, and while it doesn't prevent nefarious actions across your security zone it does prevent anyone from crossing security zones and getting internet access. This allows allows you to create exceptions for things that can't utilize user-id like printers and such where interzone traffic is required without a user-id or GlobalProtect connection.

The second option works in some networks and works less well in others. There's a lot of exceptions that need to be created for devices that can't have a GlobalProtect connection (like printers) and it generally means a rather large ACL list to account for everything that can't form a connection to the gateway.  

View solution in original post

4 REPLIES 4

Cyber Elite
Cyber Elite

@edemura,

There's really nothing directly built into your firewall to function as an actual NAC solution. You could however easily block interzone communication for anything that doesn't pass a domain-joined hip-check so that non-company endpoints couldn't traverse security zones. 

The "best" solution that you could force with just the firewall and managed switches would be teaming ACLs with GlobalProtect. Effectively you would allow communication to your GlobalProtect portal/gateway and nothing else. Then utilize tunnel mode to form a tunnel to the gateway and then utilize the GlobalProtect IP Pools to actually enable network access as required. 

 

Now just a word of caution. The first option is usually the best that you can actually hope to apply within any given organization, and while it doesn't prevent nefarious actions across your security zone it does prevent anyone from crossing security zones and getting internet access. This allows allows you to create exceptions for things that can't utilize user-id like printers and such where interzone traffic is required without a user-id or GlobalProtect connection.

The second option works in some networks and works less well in others. There's a lot of exceptions that need to be created for devices that can't have a GlobalProtect connection (like printers) and it generally means a rather large ACL list to account for everything that can't form a connection to the gateway.  

L6 Presenter

The only control is to detect or not the captive portal:

 

 

https://docs.paloaltonetworks.com/globalprotect/9-0/globalprotect-admin/globalprotect-quick-configs/...

 

 

As @BPry mentioned you need NAC solution like F5 APM , etc. or maybe Cisco ISE can help you assign vlans to the used based on the dot1x authentication and so on.

L0 Member

@nikoolayy1 , @BPry 

Thank you guys for the input! I really appreciate that. Will be looking into appropriate solution. 

Do we have to use tunnel mode? The reason I ask is because all of our routing is on the core switch. If we set up tunnel mode, the firewall would need all those routes. So I was thinking if I do not enable tunnel mode, then the computer will keep its DHCP IP, but I am not sure if this method will work. I want to use GP to verify HIP and allow network access once it has passed validation.

  • 1 accepted solution
  • 4683 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!