Restricting Global protect VPN access to specific countries

[Sunugopal]

How to configure Global Protect vpn users to access from only specific countries ?

[hshawn]

You can create an inbound VPN security policy that is only allowing from those geographical regions, the firewall has built-in regions that you can choose from or you can define your own

On my lab device I have it setup to do this. depending on your topology/config it may vary but should be easily accomplished and you can narrow it down to the layer 7 specific apps as well

[Mick_Ball · Accepted solution]

also... in version 8.something you can offer gateways dependant on what country the user is connecting from...

network/portal/agent/configs/external

this is the help link...

Source Region—Source region for client devices. When users connect, GlobalProtect recognizes the device region and only allows users to connect to gateways that are configured for that region. For gateway choices, source region is considered first, then gateway priority.

[Sunugopal]

Thank you hshawn.

[Sunugopal]

Thank you MickBall. I have 8.1.0 version and this is the vpn setting i was lookin for. 

[TechnologySvcs]

I tried this as shown below, but did not work as expected. Global protect can still connect from other countries. I have only one portal and one gateway.

[Mick_Ball]

What happens if you remove the “Any” from region settings...

[TechnologySvcs]

same effect without "Any". i already tried this.

[Mick_Ball]

OK worth a try.. I must admit I have never used it but I just noticed the option when was looking into gateway priority.

If it's causing an issue perhaps it should be logged as a fault with support.

going by the documentation, it should work.

can you confirm that your PA is deffo recognising the regions you are connecting from.

[TechnologySvcs]

In the log, source country is showing corrctly. 

Also "show location ip x.x.x.x" is showing correct country

[fwmike]

@TechnologySvcs , did you get this working?

I require this capability in a new GP deployment and would like to avoid putting another device upstream to restrict the portal and gateway access by region.

Thanks

[Sunugopal]

fyi, in my case it did not work at that time. I haven't tried again.

But i believe it is possible to restrict Global protect access to your public ip address using security policy rules.

Try creating two rules as mentioned below.

RULE1

--------

source zone : outside

source address : IN  (for eg. India, add required countries)

destination zone : outside

destination address :  x.x.x.x (your public ip) 

applications : panos-global-protect, panos-web-interface, ssl, 

service : application-default

action: allow

RULE2

--------

source zone : outside

source address : any

destination zone : outside

destination address :  x.x.x.x (your public ip) 

applications : panos-global-protect, panos-web-interface, ssl, 

service : application-default

action: deny

[Mick_Ball]

@fwmike , Hi.

yes, gateway selection visa regions does work for both windoze and ios.