How to Deactivate GP Package on the Firewall

[RMikalauskas]

Hello. It is known that GP Portal landing page in the browser can be easily bypassed by replacing login.esp with getsoftwarepage.esp

PAN knows this, they do not see it as a security risk, which is nuts if you ask me. Don't mind the ability for someone to run a download loop and eat the bandwith downloading 200MB file infinitelly from multiple sources...

So we do not want to host a file "free for all" on the Internet, and completelly remove it from the Firewall. Problem is that even when you delete all the GP packages from the CLI - one still remains "activated", and download page still works. Yes, even with Portal landing page Disabled.

Thoughts?

[TomYoung · Accepted solution]

Hi @RMikalauskas ,

Wow!  I did not know this.  I tested this, and you are correct!  This concerns me not because of bandwidth as you mentioned, but that unauthenticated users can access a small, supposedly protected portion of the NGFW file system.

Thankfully, there IS a solution.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001VieCAE&lang=en_US%E2%80%A...

1. PANW does NOT consider it a security vulnerability as mentioned in the article above.
2. You can block the web via a custom URL category.
   1. I would not block it with a URL Filtering Security Profile as the article above details, but I would create a security policy rule as the article below details.
3. You can have your SE vote for FR ID: 3205 to only allow authenticated users to access the GlobalProtect download page as mentioned in the article above.
4. Blocking the download web page will break GP automatic upgrades as mentioned in the article below.

https://packetpassers.com/how-to-disable-the-globalprotect-download-page/

Thanks to PacketPassers for the awesome article!

I tried to see if I could block it via application.  I created a security policy rule to only allow panos-global-protect and ipsec-esp-udp to my NGFWs, and that did not stop ssl and web-browsing (b/c the NGFW is decrypting it) from being allowed and working.  I guess ssl is an integral part of panos-global-protect.  (Yes, I created a block rule before the intrazone-default rule.  The allowed ssl and web-browsing hit my rule that only allowed panos-global-protect.)  So, you cannot block it by application.

I also tried to delete the activated file via the CLI with delete global-protect-client version <value>.  That deletes the file, but there is still a check mark under Currently Installed and you can still download the files from the web page.

Thanks,

Tom

[RMikalauskas]

Thanks, Tom. 👍