05-01-2020 07:40 PM
Has anyone noticed the ability to make inbound connections to a GlobalProtect connected MAC OSX system? We had recently enabled split-tunneling thanks to the big bad video conferencing applications. But quickly discovered that on MAC and Windows systems, when domain or application split-tunneling is enabled, all inbound access from the local network is allowed. In other words, another host on the users home WiFi could SSH or proxy through the GP connected system, gaining access to the corporate network. Sure defense in depth may help you here, but the this seems like a major oversight. So, we rolled back split-tunneling. The windows systems returned to what we considered to be the expected behavior when the "no direct access to local network" box is checked. Which is, no inbound or outbound connections are allowed from the GP connected system to the local network. The MAC systems did not behave as we had expected. The ability to SSH or Proxy through the GP connected MAC persisted. Curious if anyone could replicate the testing?
Test States:
windows:
state: ndla-yes, no splits - no access from local network is permitted
state: ndla-yes, route split, no domain/app splits - no access from local network is permitted
state: ndla-yes, route split, domain split, no app splits - inbound access from local network is permitted
state: ndla-yes, route split, no domain split, app splits - inbound access from local network is permitted
state: once ndla-no - inbound/outbound access from local network is permitted (splits don't change this)
MAC:
state: ndla-yes, no splits - inbound access from local network is permitted
state: ndla-yes, route split, no domain/app splits - inbound access from local network is permitted
state: ndla-yes, route split, domain split, no app splits - inbound access from local network is permitted
state: ndla-yes, route split, no domain split, app splits - inbound access from local network is permitted
state: once ndla-no - inbound/outbound access from local network is permitted (splits don't change this)
