Personal VPN Services thwarting Company Policies

[Jaragorn]

Downstream of our PAN's, we have our Citrix environment.  This environment includes some Netscalers that have a nice feature in that they provide in their SYSLOG, two fields named "ClientIP" and "NATIP".   This proves quite useful in that while the ClientIP field geolocates to a local Boston IP address, the NATIP address shows they are coming in from, for example, Spain.   While we have rules in our PAN that should prevent these non-US connections, the VPN services apparently use a local proxy that thwarts the PAN's location lookup.

I've searched and can't seem to find if the PAN's can present and utilize something equivalent to the Netscaler's NATIP so as to be able to leverage it in a policy rule or not.

Note: I have the TOR rules setup but these connections are not TOR.

Any ideas?

Thanks!

[Jaragorn]

Hello OtakarKlier, I've looked into the use of EDL's but the total number of IP addresses the PAN can support from EDL's is far short of the number of US VPN endpoints currently known.   Given this I have two options:

• create a web server that can lookup IP addresses accessing our Citrix environment against a list of known VPN endpoints (yes, there are services that maintain a list of known worldwide VPN endpoints), and add matches found to a EDL.
• Or, figure out how to get the PAN to show the real NATIP as shown above.  A rule that would test  Where SOURCEIP  <> NATIP -> DROP would be all it'd take.

I don't know why a Netscaler can see the real NATIP and a PAN cannot.

Still looking for the answer.

Thanks for kicking this around with me!

[OtakarKlier]

Hello,

I think this is a real scenario that others are facing as well. I reached out to a SE I know really well and he suggested the following:

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-new-features/networking-features/web-proxy

Not sure of the code version or hardware you are running however.

Regards,