Block a specific MAC address to be barred from connecting through our Global protect VPN

[SahulH]

Hi Team,

We have a query whether we can able to block a specific device from Connecting our Global Protect VPN by using the Device MAC Address.

Please review and share us with your thoughts. Awaiting for your reply !!

Best Regards,

Sahul Hameed

[BPry · Accepted solution]

@SahulH,

Not via MAC address. You would do this by creating an entry within the Device Block List and specifying the Host ID and Hostname of the blocked endpoint. 

[BPry · Accepted solution]

@SahulH,

Not via MAC address. You would do this by creating an entry within the Device Block List and specifying the Host ID and Hostname of the blocked endpoint. 

[SahulH]

Hi @BPry ,

Thanks for your response. How do I get the Host ID information from a Machine to configure the Device Block List.

Also one more query is that, do we need to a have any specific subscription for using Device Block List feature in PA Firewall.

Best Regards,

Sahul Hameed

[BPry]

@SahulH,

The Host ID field is visible in the GlobalProtect logs (I don't know if this is a default field, so you may have to view detailed logs or simply select it so it's visible). You don't need a GlobalProtect subscription to have the ability to use this feature. 

[SahulH]

@BPry ,

Thanks for your respose. I will check on this and will share you with the outcome shortly. 

Best Regards,

Sahul Hameed

[SahulH]

@BPry ,

Under Global Protect Logs we are unable to get the Host-ID information for Linux based machines. So is this related to Licensing. Since we don't have a valid subscription for GP gateway. Please share your thoughts. 

Best Regards,

Sahul Hameed

[BPry]

@SahulH,

If you don't have a GlobalProtect subscription then your Linux agents are using X-Auth instead of the actual GlobalProtect agent. In that case, a Host ID isn't generated and you don't have a clear cut way to block any one particular endpoint. 

[SahulH]

@BPry ,

Thanks for your response !!

Best Regards,

Sahul Hameed

[SahulH]

@BPry ,

Query 1 --> Whether can we able to see the logs for the user machine which we have blocked using the Host-ID in case if they try to connect to the Global Protect?.

Query 2 --> Also in Global Protect logs, for some of the MAC and Windows machine Host-ID information is not captured by the Agent what will be the possible cause for this and how to resolve this . 

Snap for Host ID not captured for some and captured for some for the same machine itself:

Please let us know if you have thoughts on this below mentioned queries. Awaiting for your response !!

Best Regards,

Sahul Hameed

[SahulH]

Hi @BPry ,

Any inputs on my 2nd query because i found out the answer for the 1st query. 

I am still waiting get an inputs from you for my 2nd query. Please review and share something on this. Awaiting for your response !!

Best Regards,

Sahul Hameed