GlobalProtect in depth: Linux client, IPsec fallback, per-user settings and HIP

GlobalProtect has been running at Calder for a year: a portal and gateway on 203.0.113.2, with one set of client settings called Sales. Three new requests have reached you:

• The developers use Linux laptops, and one of them says the VPN "changes mode" in hotels. Find out what it's doing.
• Carol in the executive team can't connect. The portal accepts her password and then it fails.
• Bob is a contractor and should reach web01 and nothing else, from his own address range. The security team wants every laptop checked for disk encryption and a host firewall before it reaches the intranet. Carol's internet traffic must go through the firewall, not out of the hotel's network.

Laptop is the Linux laptop, outside the firewall on the internet side. The lab images include no GlobalProtect app and no openconnect, so Laptop has four small commands written for this lab:

• gp-check USER PASSWORD walks the conversation with the portal and gateway, and stops before a tunnel.
• gp-connect USER PASSWORD does the same, then builds the tunnel as interface gp0. Like the app, it tries IPsec first and falls back to SSL, then sends a HIP report from /etc/gp-hip.conf.
• gp-status shows the current tunnel, and gp-disconnect logs out.

They aren't the GlobalProtect app, and their HIP report is built from that one small file. Everything the firewall does with them is real: the tunnel, the logs and the HIP matches.

This lab uses the 10.2.5 evaluation image. HIP checks need a GlobalProtect subscription, and this image carries an evaluation licence for it. On the unlicensed 11.2 image the commit warns that HIP objects "will not take effect", and the gateway never asks for a report. The firewall's clock stays at 1 August 2023 because of that licence, so its logs show that date.

Before you start. Start all the nodes. The firewall takes 10-17 minutes to boot and comes up with this lab's starting configuration already loaded. Wait until the FW1 console shows FW1 login:, then log in as admin / Lab-Access-1. Until the management plane is ready it answers Login incorrect, even with the right password. The Linux hosts are ready within seconds.