URL filtering or tightening up on GlobalProtect security rule?

[inSync-MarkValpreda]

I have a security rule for my GlobalProtect, and want to see if I can make it even tighter....

• Source
  • Zone: untrust (outside)
  • Address\User\Device: Any
• Destination
  • Zone: untrust 
  • Address: IP of my interface/GlobalProtect IP
  • Device: Any
• Application
  • Any
• Service/URL
  • GP-4501 (4501/udp)
  • service-https
  • Category: Any
• Actions
  • Just a vulnerability group that blocks brute force (40017) 

Thinking there is an opportunity to lock that down even more. Maybe with URL filtering? Maybe with applications? I am only seeing ipsec-esp-udp, ssl, and panos-global-protect as the biggest applications. 

I do have my home IP address whitelisted on the interface management as a 'just in case' sort of thing....so I don't want to inadvertently kill that. Maybe put my emergency IP addresses into a different security group?

Thanks for any suggestions or criticisms! 

[BPry]

@inSync-MarkValpreda,

I would utilize app-id for this and do away with your any application and service rule that you have currently. Also note that if you're security profile is only accounting for 40017 you're missing 16 other signatures related to GlobalProtect. I don't much see a point in maintaining a profile specific to GlobalProtect and trying to manually specify IDs that should be active.

Can you limit the sources that you're allowing to hit your portal/gateway? You can cut back exposure and scanning/probing by limiting to the regions that you actually need active; while this doesn't prevent a targeted attack by any means it at least cuts back on noise.

---

@inSync-MarkValpreda wrote:

I do have my home IP address whitelisted on the interface management as a 'just in case' sort of thing....so I don't want to inadvertently kill that. Maybe put my emergency IP addresses into a different security group?

---

Why? Do you have a static IP at your house or are you just relying on it staying the same?

Personally this is never something that I would facilitate or allow any of my staff to implement. The risk analysis for this would never have the benefit of this outweigh the risk that is introduced. Things either wait until someone can be onsite and restore things properly, or you implement a proper out-of-band connection.