WirelessPhreak.com

This will be short and sweet, if you have privileges to boot your PC into safe mode you can follow the following steps to delete the affected update.

**Disclamer: This is only a guide please work with Microsoft and or Palo Alto Networks if you have any concerns. **

GlobalProtect VPN can be deployed in different connection configurations. One of the most secure is the always-connected model. When 'always on' is configured, the GlobalProtect agent will force all traffic over the VPN tunnel, even when a user is not logged in. This ensures that all traffic from the device is inspected by a firewall and allows desktop support staff to manage the device. One downfall is that it complicates communications with MDM solutions.

MDM software runs all the time, even when users are not logged in. What this means is the software needs to be allowed to access MDM resources 24x7. In GlobalProtect, this is accomplished with a mechanism called pre-login security policies. Pre-login policies are security policies that allow devices authenticated with a machine certificate to connect to generally a more restricted set of resources. Once a user authenticates the VPN connection, it is promoted to a known-user state and corporate firewall policies are applied to the traffic.

What I want to focus on in this write-up is the pre-login security policies that allow Intune software to communicate with its required Microsoft cloud resources.

1. The first thing that needs to happen is to determine which endpoints the Intune client will need to communicate with. This can be accomplished by running a PowerShell command on an endpoint, which will output the endpoints you will need to configure in your firewall. Here is a link to the Microsoft documentation for running the PowerShell commands. https://tinyurl.com/MS-Intune-Doc

2. Once you receive the endpoints, you will need to create a custom URL category and two address object groups.

    a. The URL category you need to create is for the *.manage.microsoft.com domain. Because this is a wildcard URL, you cannot create an FQDN object and will need to create a second security policy just for this.

    b. You will need to create an Intune-FQDN address object group and add the FQDNs that were part of the above PowerShell output.

    c. Lastly, you will need to create an Intune-Network address object group and add the network address objects that where generated in the above PowerShell output.

3. Configure security policies to utilize the address and URL categories you created above.

    a. The first security policy you need to configure is one that leverages your custom URL category. You will also want to leverage the applicable App-IDs.

    b.  The second policy will use the same App-IDs but will restrict the destination to the two address objects you created earlier.

    c. One thing I want to highlight is that in the user category, you see pre-login defined as the user. This is important as it ensures that certificate-authenticated devices can leverage these policies even though the users are not logged in.

Once these policies are configured, you will see Intune devices connect to your Intune console, and you will be able to utilize the core Intune services.

Self hosting apps and building out your home lab!

I wanted to create this blog post not as a step-by-step guide but as a high-level outline and links to the resources you can use to build your container environment. I have wanted to get into containers and Docker for a while. I have played with Docker in the past and had not had much success. I could get stuff running but to be able to manage the health of my containers and easily deploy and destroy them was not intuitive for a dumb network guy like myself.

So I found a better way!

The second piece that streamlines the home lab setup is Nginx Proxy Manager. This is a user Interface to the powerful Nginx web server. The NPM project has scripted many of the configurations you would have had to manually build out in the past and fronted it with a super intuitive user interface. NPM can even generate and manage your let's encrypt certificates. I can't say enough good things about NPM.

So what you need to get started

1. You will need a computer or even a Raspberry Pi (the Pi si a little under powered though).  You can run Windows, Apple OS, or Linux.  I used Linux there seems to be much more documentation running it in linux. 
2. Own a domain name so you can manage and create your own DNS records.
3. Set up port forwarding on your home router to roward traffci to your new container server.
4. Allow port 443 access on your local firewall if you are running in a VPS or at home.
5. Install Docker link to install Docker. https://docs.docker.com/engine/install/ubuntu/
   
6. Install Portainer here is a link their really great install docs. https://docs.portainer.io/start/install-ce/server/docker/linux
7. Install Nignx Proxy Manager  https://nginxproxymanager.com/setup/#running-the-app

Once this has all been build out you have the basic framework to deploy containerized applications at will. 

 

High level diagram of what your environment will look like

 

Helpful Hint

• When you deploy a container you need to add the container to the NGINX Proxy Manager Default network if you want the app to be fronted by NPM
  
• When you configure NPM you need to use a fully qualified name that will route to your public IP that will in turn forward it to the server and then from NPM to the correct container. 
• You can define the container in the NPM config by the name portainer assigns it.  You don't have to use the IP it was assigned. 
• NPM will perform port translation (your application can be presented on port 443 even though it listens on 8080.)
• NPM will offload SSL and force SSL redirects for apps that don't know they are behind a proxy.

 

 Some Self Hosted App Resources

 https://www.reddit.com/r/selfhosted/

 https://github.com/awesome-selfhosted/awesome-selfhosted

 

Lastly if your interested in an awesome Virtual Private Server (VPS) with unlimited bandwidth check out Frantech.  They are super cheap and super reliable, and they have awesome customer service. 

FYI this is an affiliate link so I will score a little cash if you buy. :)

FranTech