How to restrict GP Portal authentication to specified countries

[bpotter98]

I'm seeing multiple failed login attempts from China & Russia.   I know I can restrict access to source countries with GP Gateway which I'm currently doing but how can I do this with the Global Protect Portal?

[Major2375]

Hi,

the Region configuration is under GP portal, im guessing that you meant that you want to configure the region under the gateway?
you can configure a policy rule for the gateway to not allow traffic from certain country's.

the region configuration under portals->agent-external is not enabling any users from those chosen country's to connect to the portal.

hope that i made things clear, im here for more questions

thank you.

[bpotter98]

Hi, no, what I'm asking about is restricting the web portal for the GP Portal based on source location.  So far I've just disabled Portal Login Page found under Network > GlobalProtect > Portals > General > Appearance.   I'm already doing geographic restrictions from the portal to the GlobalProtect Gateways.   I do like to have the Portal Login Page enabled just for testing and allowing for vendors to grab our latest Global Protect Agent.

[TomYoung]

Hi @bpotter98 ,

Traffic from the untrust zone to the interface in the same untrust zone is allowed by the intrazone-default rule.  The easiest way to solve your problem is to create a drop rule (which will be above intrazone-default) that will drop all countries you do not want.

Rule Type:  intrazone

Source Zone:  Untrust

Source Address:  List you countries you want to allow and check Negate.

Destination Address:  Portal IP (could also be any if you want to block for all public IP addresses)

Application:  Any

Service/URL Category:  Any

Action:  Drop

You can choose not to log if you don't want the clutter, but you may need to enable for troubleshooting.

Thanks,

Tom

[bpotter98]

I will give that a try.   Thank you!