Global Protect Clients connection Policies through the NGFW

[Vachy]

Hi, Comunity,

I'd like to ask your advice.
Is there any instruction somewhere on how to do the best set of the rules on Firewall PAN to only allow traffic for global protect clients?
The clients are on a normal network with DHCP. They have DNS from AD server.
I want the client to get to the Internet only via Prisma Access/ This means that the client passes through a firewall that only allows access to  Mobile Users Gateways.

I have found via API in Panorama/Cloud Plugin GW addresses, Portals and even IP ranges. I gradually prepared the rules.
I still have a problem with this. After setting the rules it works. However, the next day it doesn't.

Thank you

[nikoolayy1]

You can try on the Firewall to create a policy rule that allows only the Globalprotect Application from your source IP addresses/username/ad groups as a workaround.

Outside of that better make a server that pulls your Prisma Access endpoint addresses using the API as you already saw and then make an External Dynamic List that the Palo Alto Firewalls can ingest but will be complex. You can alse feed in the firewalls using their API and and modify the address object. As Prisma Access addreses change better pull the data every maybe 10 minutes.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/use-an-external-dynamic-list-in-po...

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-panorama-api/get-started-with-the-pan-os-rest-a...

The API to retrive the Prisma Access addresses:

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-panorama-api/get-started-with-the-pan-os-rest-a...

[Vachy]

Thank you for your advice. However, it looks like the problem is in Authentication.
The GP client logs in and receives a cookie for 24 hours. However, after expiring this cookie, it is unable to re-authenticate.
I'll try enabling SAML portal now and see what happens.

[nikoolayy1]

Also check if the cookies are correctly configured as maybe the portal cookie timeout is different of the gateway one:

How to generate cookies on GlobalProtect Portal and use cookies for Gateway Authentication

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boODCAY

GlobalProtect portal and gateway authentication override cookie lifetime does not expire or last for set lifetime

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004NCxCAM&lang=en_US%E2%80%A...