Who rated this post

Hi @RMikalauskas ,

Wow!  I did not know this.  I tested this, and you are correct!  This concerns me not because of bandwidth as you mentioned, but that unauthenticated users can access a small, supposedly protected portion of the NGFW file system.

Thankfully, there IS a solution.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001VieCAE&lang=en_US%E2%80%A...

1. PANW does NOT consider it a security vulnerability as mentioned in the article above.
2. You can block the web via a custom URL category.
   1. I would not block it with a URL Filtering Security Profile as the article above details, but I would create a security policy rule as the article below details.
3. You can have your SE vote for FR ID: 3205 to only allow authenticated users to access the GlobalProtect download page as mentioned in the article above.
4. Blocking the download web page will break GP automatic upgrades as mentioned in the article below.

https://packetpassers.com/how-to-disable-the-globalprotect-download-page/

Thanks to PacketPassers for the awesome article!

I tried to see if I could block it via application.  I created a security policy rule to only allow panos-global-protect and ipsec-esp-udp to my NGFWs, and that did not stop ssl and web-browsing (b/c the NGFW is decrypting it) from being allowed and working.  I guess ssl is an integral part of panos-global-protect.  (Yes, I created a block rule before the intrazone-default rule.  The allowed ssl and web-browsing hit my rule that only allowed panos-global-protect.)  So, you cannot block it by application.

I also tried to delete the activated file via the CLI with delete global-protect-client version <value>.  That deletes the file, but there is still a check mark under Currently Installed and you can still download the files from the web page.

Thanks,

Tom