Restrict Access to Gaia Web Interface When RAVPN is in use

[cdooer]

Hey everyone. I see that the question of restricting access to the Gaia web interface from public IP's has been asked and answered many times, but what happens when Remote Access VPN is in use on the appliance, and port 443 needs to be publicly available in order to facilitate the VPN connection? Is the easiest way to change the Gaia web interface port to use something custom, and not related to the VPN negotiation at all, and then make sure that port is blocked in the rulebase for anything except admin machines?

This recently appeared in a pentest, and was flagged as a high priority issue. 

[Lesley · Accepted solution]

GAIA web portal cannot run on the same port if 443 is needed for visitor mode (RAVPN).

You need to change the GAIA portal port to something different. You have to do this via clish or web interface and after that also change the platform portal in SmartConsole under the firewall object. 

Example clish config:

cp-mgmt> set web ssl-port 4434

[cdooer]

So we have Visitor Mode enabled, and as I understand it this is required for the initial connection during the site creation. Gaia is also on port 443, and there don't seem to be any issues. I do see this option in the gateway configuration though...could changing it to Through Internal Interfaces solve the issue?

[PhoneBoy]

Yes, you can change the port via clish: set web ssl-port xxxx
You can also use System Configuration > Host Access to restrict what IPs are allowed to connect (independent of the firewall policy).
Believe this also applies to SSH. 

[cdooer]

Thx, probably best to change the port regardless. Also, the thing about host access is that it still allows you to connect to the web interface, it just doesn't allow you to login. The audit team is saying that is not sufficient.