PAN-OS · VPN

PAN-OS-style: GlobalProtect remote access

alice works from home on LAP1. PC1 is only reachable inside. GlobalProtect gives her an address from a pool, and puts her in a zone of her own through a tunnel interface, so the rules decide what she can reach. The client is stood in for: no software is installed.

Palo Alto PAN-OS-style track · Palo Alto PAN-OS-style, Cisco router · 4 objectives

Open in simulator More Palo Alto PAN-OS-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

tunnel.2 in zone vpn-users, and in the virtual router.
GlobalProtect gateway GP on ethernet1/2: pool 10.99.0.10 to 10.99.0.50 /24, tunnel interface tunnel.2, split 192.168.1.0/24. User alice with password Lab123. The Network > GlobalProtect wizard sends all of this. Commit.
On LAP1: vpn connect 203.0.113.1 user alice password Lab123. Then ping 192.168.1.10: it is denied by interzone-default, because no rule allows vpn-users to trust.
Add rule GP-IN from vpn-users to trust, and commit. The ping works, and show global-protect-gateway current-user lists alice.

Start this lab

Before you start

With a split tunnel, only 192.168.1.0/24 goes through the VPN. HIDE doesn’t translate replies to alice, because they go to zone vpn-users, not untrust. So this needs no NAT exemption, unlike an ASA. The two GlobalProtect lines are RouteBuddy’s short teaching form: a real firewall builds a portal and a gateway from many more lines, and asks for the user’s password instead of taking it on the line.

Concept

A tunnel is an interface, so routes and zones decide

On some firewalls a crypto access list picks what goes in a tunnel. Here a tunnel is an interface. A route puts traffic into it, and because the interface is in a zone, a security rule must allow that zone. A NAT rule to untrust doesn’t touch it, because the traffic is going to the tunnel’s zone.

Concept

Remote access: AnyConnect and a clientless portal

A user logs in to the firewall from outside. With AnyConnect the firewall gives the user an address from a pool and a tunnel, and split tunnelling decides which traffic goes through it. With the clientless portal the user gets no address, only bookmarks that the firewall fetches. Each login lands in a tunnel-group, and a group policy says what that user may do.