What is X-Auth support in PAN firewalls and how to troubleshoot it?
42371
Created On 09/17/20 15:03 PM - Last Modified 05/11/23 03:12 AM
Question
- What is X-Auth?
- How to troubleshoot X-auth?
Environment
- Palo Alto Networks Firewalls running PAN-OS 8.1 and above
- This assumes the customer has a Globalprotect portal and gateway set up already, and has enabled X-Auth support on the Gateway. This configuration is located at Network >> Gateways >> Agent >> Tunnel Settings >> Enable X-Auth Support
- It also assumes the customer has configured the 3rd party VPN client application properly.
Answer
What is X-Auth and how does it work with the firewall?
- Xauth (Extended Authentication within IKE) is what Palo Alto Networks use to support third party VPN software using the Globalprotect Gateway.
- It allows the third party VPN client to authenticate through the Globalprotect auth profile as part of the IKE negotiation.
- IKE V.1 must be used on the 3rd party clients.
- Supported IPSec clients: Third-Party VPN Client Support
- The Palo Alto Network firewall uses the OpenSSL crypto library - Reference: GlobalProtect App Cryptographic Functions
- The customer sets the crypto configuration in the third party application, and as long as the firewall supports those parameters (and the PSK is correct) IKE phase 1 and 2 should negotiate successfully.
- Globalprotect IPsec crypto profiles aren't used for the X-auth clients.
- The end device simply sets up a tunnel between the device itself and the Globalprotect Gateway interface.
- Troubleshooting of the tunnel is done much the same way as any IPSec tunnel would be troubleshot. Refer to the document IPSec and Tunneling Resource list on Configuring and Troubleshooting
- Refer to the information of what X-Auth does from IETF: Extended Authentication within IKE (XAUTH)
Additional Information
Limitations:
X-auth support has the following limitations:
- It does not support multiple concurrent connection sessions from one GP user: for x-auth, the firewall differentiates the user connection based on the username and public IP address. We can't have 2 clients with the same username/source IP logged in via x-auth at the same time. While for Global protect clients, it uses a username and computer name; so it is easier to make a distinction between the clients (computer name is not communicated with x-auth)
- Support for Framed IP address assignment/allocation: Framed IP address attribute is not supported currently for X-auth Clients
- X-auth for firewall on FIPS mode: For the firewall running FIPS mode, the X-auth option for the globalprotect gateway is not available
- Support for region restriction in the gateway client setting: When region specification is defined under Gateways > [gateway-name] > Agent > Client Settings, x-auth client connection fails. The right configuration for X-Auth should be having no region config inside the client config. X-Auth clients require a separate configuration to allow them to connect when a regional restriction is in place