Virtual Private Networks

In this chapter, we will learn about site-to-site VPNs and the challenges you may encounter when connecting to different vendors. We will learn how to set up a GlobalProtect user VPN and verify whether hosts connecting remotely are in a permissible state to enter the network or need to be quarantined.

In this chapter, we’re going to cover the following main topics:

• Site-to-site VPNs
• The GlobalProtect client and satellite VPNs

By the end of this chapter, you’ll be able to connect remote locations and remote users to a datacenter or central office in a secure way.

Technical requirements

In this chapter, we will be covering remote connections and protection from inbound connections. If you have a lab environment where you can simulate setting up VPN connections to other devices or produce incoming connections from a client, this will help greatly in visualizing what is being explained.

Setting up the VPN

There are several ways of connecting devices in a secure way.

Palo Alto Networks firewalls currently support the following protocols:

• Generic Routing Encapsulation (GRE) is a fairly old protocol that is not very secure but can be useful if legacy devices need to be connected to the firewall to provide rudimentary security to the encapsulated packets.
• Internet Protocol Security (IPSec) is the de facto tunneling protocol between remote sites and can be used for very strong encryption.
• Secure Socket Layer (SSL), which is really Transport Layer Security (TLS), is used to connect endpoints over a network-friendly protocol.

To set up GRE tunnels, you can set up a connection in Networks | GRE Tunnels. All you need to configure is the following:

• Name (this can be any description)
• Source interface
• Source IP is the IP associated with the source interface
• Destination IP is the IP for the remote peer
• Tunnel...

Summary

In this chapter, you learned how to set up site-to-site VPN tunnels and a client-to-site VPN with GlobalProtect. You can now not only provide connectivity but also scan the client machine for compliancy and know how to control the user experience.

In the next chapter, we will learn about creating custom applications and custom signatures for threat prevention, and how to apply zone protection and protect individual services using DoS protection profiles and policies.

If you’re preparing for the PCNSE, remember that the clientless VPN is a proxied connection and that applications must be created. You’ll need to understand the difference between the GlobalProtect Portal and Gateway, and know which features require an additional license (mobile clients, split tunnels for applications and domains, HIP checks, Clientless VPN, IPv6, and split DNS).