Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
12-16-2022 04:30 AM
Hello,
I am a manjaro(arch linux based distro) user, and I need to use this Global Protect VPN for some reason. But I can't install. I am looking for an alternative installation or solution. I installed my own AUR repository and defined versions with openconnect. I provide connection but no access. I can't download the files in the .tgz file from their site. I am waiting for your help, best regards...
#manjaro#globalprotectvpn
01-16-2023 02:35 PM
Hi @merlins ,
As you have already figured out, the official GlobalProtect agent is not supported on Arch based distributions.
Having that said there is unofficial project that is using the Openconnect VPN agent and configure it in a way to look like a GP agent - https://github.com/yuezk/GlobalProtect-openconnect
I didn't understand quite understand you, but you probably already have found the same software in the AUR repository.
Based on your description - "provide connection but no access", I would guess that the VPN to which you are connecting is enforcing HIP check - https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/host-information/about-host-....
Basically VPN is established, which will logically connect you to the PAN FW, where you still need to match firewall rule to allow to pass over the firewall. Probably the FW rule allowing traffic for GP users to internal resources is using HP profiles. This means that FW will allow only traffic if the VPN user is connecting for compliant machine (meaning your laptop cover some basic checks like, have AV, disk encrypted, not running outdated OS, etc). It is possible that your Openconnect successfully authenticates you and establish the tunnel to the FW, but it doesn't submit HIP (host information) report to the FW, so you don't match the allow rule.
As you can see here Openconnect support HIP submission - https://wiki.archlinux.org/title/OpenConnect
The question is what HIP profile is configured on the FW? What requirements you need to fulfill to consider your machine complaint, but this is completely based on what the FW admin has configured, so you may need to check with FW team supporting this FW.
01-16-2023 02:35 PM
Hi @merlins ,
As you have already figured out, the official GlobalProtect agent is not supported on Arch based distributions.
Having that said there is unofficial project that is using the Openconnect VPN agent and configure it in a way to look like a GP agent - https://github.com/yuezk/GlobalProtect-openconnect
I didn't understand quite understand you, but you probably already have found the same software in the AUR repository.
Based on your description - "provide connection but no access", I would guess that the VPN to which you are connecting is enforcing HIP check - https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/host-information/about-host-....
Basically VPN is established, which will logically connect you to the PAN FW, where you still need to match firewall rule to allow to pass over the firewall. Probably the FW rule allowing traffic for GP users to internal resources is using HP profiles. This means that FW will allow only traffic if the VPN user is connecting for compliant machine (meaning your laptop cover some basic checks like, have AV, disk encrypted, not running outdated OS, etc). It is possible that your Openconnect successfully authenticates you and establish the tunnel to the FW, but it doesn't submit HIP (host information) report to the FW, so you don't match the allow rule.
As you can see here Openconnect support HIP submission - https://wiki.archlinux.org/title/OpenConnect
The question is what HIP profile is configured on the FW? What requirements you need to fulfill to consider your machine complaint, but this is completely based on what the FW admin has configured, so you may need to check with FW team supporting this FW.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
