How to Deactivate GP Package on the Firewall

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

How to Deactivate GP Package on the Firewall

L2 Linker

Hello. It is known that GP Portal landing page in the browser can be easily bypassed by replacing login.esp with getsoftwarepage.esp

 

PAN knows this, they do not see it as a security risk, which is nuts if you ask me. Don't mind the ability for someone to run a download loop and eat the bandwith downloading 200MB file infinitelly from multiple sources...

 

So we do not want to host a file "free for all" on the Internet, and completelly remove it from the Firewall. Problem is that even when you delete all the GP packages from the CLI - one still remains "activated", and download page still works. Yes, even with Portal landing page Disabled.

 

Thoughts?

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Hi @RMikalauskas ,

 

Wow!  I did not know this.  I tested this, and you are correct!  This concerns me not because of bandwidth as you mentioned, but that unauthenticated users can access a small, supposedly protected portion of the NGFW file system.

 

Thankfully, there IS a solution.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001VieCAE&lang=en_US%E2%80%A...

 

  1. PANW does NOT consider it a security vulnerability as mentioned in the article above.
  2. You can block the web via a custom URL category.
    1. I would not block it with a URL Filtering Security Profile as the article above details, but I would create a security policy rule as the article below details.
  3. You can have your SE vote for FR ID: 3205 to only allow authenticated users to access the GlobalProtect download page as mentioned in the article above.
  4. Blocking the download web page will break GP automatic upgrades as mentioned in the article below.

https://packetpassers.com/how-to-disable-the-globalprotect-download-page/

 

Thanks to PacketPassers for the awesome article!

 

I tried to see if I could block it via application.  I created a security policy rule to only allow panos-global-protect and ipsec-esp-udp to my NGFWs, and that did not stop ssl and web-browsing (b/c the NGFW is decrypting it) from being allowed and working.  I guess ssl is an integral part of panos-global-protect.  (Yes, I created a block rule before the intrazone-default rule.  The allowed ssl and web-browsing hit my rule that only allowed panos-global-protect.)  So, you cannot block it by application.

 

I also tried to delete the activated file via the CLI with delete global-protect-client version <value>.  That deletes the file, but there is still a check mark under Currently Installed and you can still download the files from the web page.

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

View solution in original post

2 REPLIES 2

Cyber Elite
Cyber Elite

Hi @RMikalauskas ,

 

Wow!  I did not know this.  I tested this, and you are correct!  This concerns me not because of bandwidth as you mentioned, but that unauthenticated users can access a small, supposedly protected portion of the NGFW file system.

 

Thankfully, there IS a solution.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001VieCAE&lang=en_US%E2%80%A...

 

  1. PANW does NOT consider it a security vulnerability as mentioned in the article above.
  2. You can block the web via a custom URL category.
    1. I would not block it with a URL Filtering Security Profile as the article above details, but I would create a security policy rule as the article below details.
  3. You can have your SE vote for FR ID: 3205 to only allow authenticated users to access the GlobalProtect download page as mentioned in the article above.
  4. Blocking the download web page will break GP automatic upgrades as mentioned in the article below.

https://packetpassers.com/how-to-disable-the-globalprotect-download-page/

 

Thanks to PacketPassers for the awesome article!

 

I tried to see if I could block it via application.  I created a security policy rule to only allow panos-global-protect and ipsec-esp-udp to my NGFWs, and that did not stop ssl and web-browsing (b/c the NGFW is decrypting it) from being allowed and working.  I guess ssl is an integral part of panos-global-protect.  (Yes, I created a block rule before the intrazone-default rule.  The allowed ssl and web-browsing hit my rule that only allowed panos-global-protect.)  So, you cannot block it by application.

 

I also tried to delete the activated file via the CLI with delete global-protect-client version <value>.  That deletes the file, but there is still a check mark under Currently Installed and you can still download the files from the web page.

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

Thanks, Tom. 👍

  • 1 accepted solution
  • 1694 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!