WirelessPhreak.com

I like to travel, f*ck with technology, and partake in the occasional tropical drink.
I am also a co-host on The NBD Show podcast.
Follow Me
Showing posts with label VPN. Show all posts
Showing posts with label VPN. Show all posts

 

Recently there has been a change in the behavior when a user tries to upgrade the GP client, they are challenged with the uninstall password if configured with one. Working with Palo Alto networks TAC they identified that during the upgrade the GP client package will uninstall the old version first before it will begin to install the new package. In GP client 5.2.4 and older the upgrade would complete even if uninstall with a password or disallow was enabled. This was identified as a software issue so in clients 5.2.5 and newer the ability to upgrade the client with uninstall option set to password or disallow was disabled.

In a nutshell with the new GP clients you will need to set the client setting to allow uninstall, if you want to utilize the Global Protect client upgrade process. 


Clients 5.2.4 or older, following is the behavior:

  • If you are using GP version older than 5.2.4, the transparent upgrade should work where the user will have no interaction and they can upgrade even if the allow uninstalled is disallowed.

 

Starting with 5.2.5 or above, following is the behavior:

  • Allow User to Uninstall GlobalProtect App is set to Allow
  • Allow User to Upgrade GlobalProtect App as Allow with Prompt/Manually/Transparently. (In this case, the users will be able to upgrade transparently without any interaction and the passcode/password will not be allowed)

  • Allow User to Uninstall GlobalProtect App is set to Disallow
  • Allow User to Upgrade GlobalProtect App as Allow with Prompt/Manually/Transparently (This will be blocked)

  • Allow User to Uninstall GlobalProtect App is set to "Allow with password"
  • Allow User to Upgrade GlobalProtect App as Allow with Prompt/Manually/Transparently. ( In this case, the users will need to enter the uninstall password to complete the upgrade) 


To allow the users to upgrade without providing them a password, you would need to use following.

  • Allow User to Uninstall GlobalProtect App is set to Allow
  • Allow User to Upgrade GlobalProtect App as Allow with Prompt/Manually/Transparently.”

 

My personal recommendation is to allow the client uninstall so you can leverage the GP client upgrade process. I feel the ability to upgrade the clients to ensure functionality and security is more important than blocking them from uninstalling the client. In addition we have tested with clients that are not Admins on the local machine and they were unable to uninstall the client from the windows software manager. So that is a win...


Perhaps the client upgrade functionality can also be managed with an mdm solution or with a software management tool like SCCM. But it will take some testing to find the best process that works for your environment.




**Update**
I have noticed that after upgrading Ubuntu to 20.04 or 22.04 I have run into a little snag.  It appears that the upgrade over rights the sysctl.conf file back to default values. The symptom is your wiregurad server will not be forwarded IP V4 or V6 traffic. 
 
To resolve the issue perform the following steps.
  1. sudo nano /etc/sysctl.conf
  2. net.ipv4.ip_forward = 1
  3. sudo sysctl -p
 
WireGuard is a simple, fast, and secure VPN that utilizes state-of-the-art cryptography. With a small source code footprint, it aims to be faster and leaner than other VPN protocols such as OpenVPN and IPSec. WireGuard is still under development, but even in its non optimized state it is faster than the popular OpenVPN protocol. In fact it connects so quickly you'll likely find your self going to whats my IP to insure your traffic is actually being tunneled.

The WireGuard configuration is as simple as setting up SSH. A connection is established by an exchange of public keys between server and client. Only a client that has its public key in its corresponding server configuration file is allowed to connect. WireGuard sets up standard network interfaces (such as wg0 and wg1), which behave much like the commonly found eth0 interface. This makes it possible to configure and manage WireGuard interfaces using standard tools such as ifconfig and ip. I was going to post a guide but there are so many good guides already on the internet just google it. Also the official documentation is really good and has some install guides as well.

Enjoy, be safe, support and contribute to WireGuard.

Another version of Windows and another hurdle for those os us using Cisco IPSec VPN clients.  Here are the steps I took to install IPSec in Windows 8.1 64bit OS, and so far it seems to be working.


  1. Uninstall completely existing VPN client SW
  2. Download and run this tool for 32-bit system:ftp://files.citrix.com/dneupdate.msi or this one for 64-bit system:ftp://files.citrix.com/dneupdate64.msi
  3. If you run into issues installing DNE software download and run this tool: ftp://files.citrix.com/winfix.exe and perform step 2 again
  4. If needed restart system
  5. Install Cisco VPN client SW again I used version 5.0.07.0440-k9
  6. Import or configure VPN profile and run software.
It should be working now...

 Here is a little bit about what the Citrix DNE software is;(http://www.citrix.com/go/lp/dne.html)
Citrix supplies software to a number of software and hardware companies. When they install their products on your systems, they will often contain DNE. DNE extends operating systems and network protocol devices and stacks to introduce measurement and controls. Our customers use these extensions to build products that do things like intrusion detection, VPNs, Network Address Translation (NAT), traffic measurement, response time measurement, bandwidth control, compression, content filtering, content protection, policy management, proxies, billing, packet marking, routing, protocol translation, wireless communication, secure tunnels and much more.