Paloalto VPN Traffic Inspection.

[LeeDongwon]

I have a question regarding Paloalto VPN Traffic Inspection.

Is there a way to inspect traffic that users inside use commercial VPN (free VPN program) on the outside Internet?

[aleksandar.astardzhiev · Accepted solution]

Hi @LeeDongwon ,

It would say in general no, you cannot.

If the VPN client is using IPsec there is no way for the firewall to decrypt it and inspect it. As mentioned here https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-networking-admin/tunnel-content-inspection/tunn... only none-encrypted IPsec can be inspected.

If the VPN client is using SSL,I would assume it is possible to decrypt it with SSL decryption policy, BUT this means the firewall will need to replace the server certificate. And I would assume that most SSL VPN clients are using certificate pinning (expect specific server certificate).

Most free VPN clients are using SSL, so you may decrypt it with SSL decryption policy, but my guess this will break the client and will not connect (because the server cert will be signed by different CA)

[BPry · Accepted solution]

@LeeDongwon,

So I'll preface this by saying that there's a difference between doing something and doing it reliably, but you can identify some traffic to popular VPN programs and proxies. Nord would be an example where inspecting the traffic can see some of it's traffic identified properly as nordvpn, and you could then build a group to block those identified clients for violating policy. If you're inspecting all outbound traffic it also breaks the app from functioning unless you modify some default settings.

Again though, even in that example it doesn't properly identify most traffic and the certificate mismatch issue can be bypassed by the user. 

If you're looking for simple best effort to say that you're attempting to block them then just block the proxy-avoidance-and-anonymizers category for all internal users. That's the easiest way to deal with it without causing too much work and playing a constant cat and mouse came with it.

If you actually need to prevent them from a compliance aspect the proper way would be to block them from installing something that you don't want via things like AppLocker and extension blocking for web browsers. For clients that absolutely needed this layer on the firewall as well, what I've done in the past is enforce a GlobalProtect connection on all clients for network access. Then you can utilize HIP to check for VPN indicators (you'll need to utilize custom checks for this) and block access if anyone is identified running VPN software that isn't GlobalProtect.