{"id":3090,"date":"2024-06-01T17:03:19","date_gmt":"2024-06-01T16:03:19","guid":{"rendered":"https:\/\/mortenknudsen.net\/?p=3090"},"modified":"2024-08-23T12:24:29","modified_gmt":"2024-08-23T11:24:29","slug":"entra-private-access-gsa-automatic-network-detection","status":"publish","type":"post","link":"https:\/\/mortenknudsen.net\/?p=3090","title":{"rendered":"Entra Private Access\/GSA – Automatic Network Detection"},"content":{"rendered":"\n

This blog covers a custom script solution for Intune, that can be used to automatically detect, if the Entra Private Access (GSA) client is connected to the internal network – or off-site. When the client is connected to the internal network, we don’t want to send the network traffic into the GSA tunnel through Microsoft – but use direct connectivity to the servers.<\/p>\n\n\n\n

Scripts can be used in Intune with the necessary scripts (detection, remediation, suspension). Scripts can serve as a workaround until Microsoft releases support for this in the Entra GSA client.<\/p>\n\n\n\n

Update Aug 23, 2023 - Method #1 (Resolve_DNSName-Validate_Against_IP)\nI have added a parameter $FailoverTargetIP<\/strong> to method #1, which solves a problem, if the EPA client gets into a wrong state, which can result in DNS lookup not working against an internal DNS server. I have seen this, when EPA client was connected to an 802.1x environment with the EPA client ON, but network was blocking DNS traffic to DNS server as it was coming through the tunnel. Ping was working, but no DNS lookup. Initially it will try to do a DNS lookup. If it fails, it will fall over to do a ping against an internal IP for example the app-proxy server.\n\n$Mode                    = \"Resolve_DNSName-Validate_Against_IP\"\n$Target                   = \"GSA-TEST.xxxxxx\"\n$ExpectedResult   = \"172.22.0.1\"\n$FailoverTargetIP = \"172.22.0.11\"\n\n---------\n\nV2-Update - Entra GSA v2.0\nThis blog has been updated to include new features in Entra GSA v2.0 (released July 2024). My scripts has also been updated as promised and works with the new features.\n\nThe updated scripts will only work for Entra GSA client version 2.0+, which can be downloaded here<\/a>. \n\nYou can always get the latest Entra GSA version using this link https:\/\/aka.ms\/gsawinlatest<\/a><\/strong>\n\nYou can read about the changes later in this blog - click here for shortcut to section<\/a><\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
V2 changes:\n* Support for new reg-key in v2.0 \"\"<\/code><\/pre>\n\n\n\n
<\/p>\n\n\n\n
Background<\/h2>\n\n\n\n
As part of the implementation of Entra Private Access, you define your internal networks in the Entra Private Access solution. Then the agent knows which networks \/ FQDNs to “tunnel” through the agent. This is very cool, when you are sitting home, at guest networks, hotels, etc. <\/p>\n\n\n\n
But when you are sitting onsite close to the servers (internal network), you don’t want the traffic to go through the tunnel, but directly through the local network. Your users will appreciate you for this improvement \ud83d\ude42<\/p>\n\n\n\n
Solution<\/h2>\n\n\n\n
On my Github, I have provided 3 scripts<\/a>, that can be used to solve this problem.<\/p>\n\n\n\n
My script will be updated according to the below mentioned steps.<\/p>\n\n\n\n
Timing<\/td>Functionality<\/td><\/tr>
June 2024<\/td>Script (v1 script – can be found here<\/a>) will stop\/start Windows service for Entra GSA client (3 services), which will impact all client functionality (Private Access, Internet Access)<\/td><\/tr>
July 2024<\/td>My current script (v2) has been adjusted. Now only Entra Private Access will be suspended\/started, so Entra Internet Access functionality is not impacted. You find the current (updated) remediation script here<\/a><\/td><\/tr>
2H- 2024<\/td>Entra Private Access “Intelligent local access” feature built into product<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
<\/p>\n\n\n\n
Support for Entra GSA v2.0 features (July 2024 release)<\/h1>\n\n\n\n
Entra GSA client v2.0+ does now support 2 new reg-keys that allows more flexibility around stop\/start of Entra Private Access. My script (v2, current version) supports these features.<\/p>\n\n\n\n
<\/p>\n\n\n\n
V2 Feature – Stop\/Start Entra Private Access functionality dynamically using regkey<\/h2>\n\n\n\n
You can dynamically control the state of Entra Private Access functionality by setting the key IsPrivateAccessDisabledByUser<\/strong> in registry path HKCU\\Software\\Microsoft\\Global Secure Access Client<\/strong><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
Path<\/td>Key<\/td>Value (DWORD)<\/td><\/tr>
HKCU\\Software\\Microsoft\\Global Secure Access Client<\/td>IsPrivateAccessDisabledByUser<\/td>0 = Private Access is Active

1 = Private Access is Suspended<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
<\/p>\n\n\n\n
V2 Feature – Allow User to stop\/start Entra Private Access functionality manually<\/h2>\n\n\n\n
You can allow a user to control Entra Private Access functionality by setting the key ‘HideDisablePrivateAccessButton<\/strong>‘ in the path HKLM\\Software\\Microsoft\\Global Secure Access Client<\/strong><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
Path<\/td>Key<\/td>Value (DWORD)<\/td><\/tr>
HKLM\\Software\\Microsoft\\Global Secure Access Client<\/td>HideDisablePrivateAccessButton<\/td>0 = User is allowed to start\/stop Entra Private Access

1 (or no key) = User is not allowed to control stop\/start<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
<\/p>\n\n\n\n
New detection features in v2 script<\/h2>\n\n\n\n
Thank you for the questions and feedback to extend the detection method.<\/p>\n\n\n\n
v2 of my remediation script (link to Github<\/a>) includes  3 methods for local network detection. . Hope the new features can support your needs. <\/p>\n\n\n\n
Method #1 - Resolve_DNSName-Validate_Against_IP - Local DNS Name lookup - result should respond to IP addr\nNOTE: Requires local DNS solution like Windows AD DNS, InfoBlox, Router DNS, etc.\n\n        $Mode                                = \"Resolve_DNSName-Validate_Against_IP\"\n        $Target                               = \"DC1.2linkit.local\"\n        $ExpectedResult               = \"10.1.0.5\"\n\n------------------------------------------------------------------------\n\nMethod #2A - Ping_DNSName-Resolve_DNSName_To_IP - IP address reverse lookup - result should respond to DNS hostname address - use specific DNS server\n\nNOTE: This DNS domain cannot be inside Private Access tunnel. Must be an external zone used locally\nReason: Entra Private Access treats any hosts names part of Private DNS-functionality as wildcards, so it will  respond with an internal tunnel IP when client is running\n\n        $Mode                                = \"Ping_DNSName-Resolve_DNSName_To_IP\"\n        $Target                               = \"10.1.0.5\"\n        $ExpectedResult               = \"DC1.2linkit.local\"\n        $DNSServerIP                    = \"10.1.0.5\"\n\n------------------------------------------------------------------------\n\nMethod #2B - Ping_DNSName-Resolve_DNSName_To_IP - IP address reverse lookup - result should respond to DNS hostname address - use DNS from IP\/DHCP settings on client\n\nNOTE: This DNS domain cannot be inside Private Access tunnel. Must be an external zone used locally\nReason: Entra Private Access treats any hosts names part of Private DNS-functionality as wildcards, so it will respond with an internal tunnel IP when client is running\n\n        $Mode                                = \"Ping_DNSName-Resolve_DNSName_To_IP\"\n        $Target                               = \"10.1.0.5\"\n        $ExpectedResult               = \"DC1.2linkit.local\"\n        $DNSServerIP                    = $null\n\n------------------------------------------------------------------------\n\nMethod #3 - Ping_IP-Validate_MACAddr_Against_ARP_Cache - Ping IP addr and validate MAC address matches the expected result\n\nNOTE: Method can typically only be used when device is on same subnet as target IP device fx. router (switched\nnetwork). This method can easily be extended into an array covering all local sites, but it must be manually maintained\n\n        $Mode                                = \"Ping_IP-Validate_MACAddr_Against_ARP_Cache\"\n        $Target                               = \"192.168.1.1\"\n        $ExpectedResult               = \"d2-21-f9-7e-82-86\"<\/code><\/pre>\n\n\n\n
<\/p>\n\n\n\n
Requirement to use V2 features<\/h2>\n\n\n\n
You need to update your Entra GSA client to v2.0+. You can always get the latest version using this link https:\/\/aka.ms\/gsawinlatest<\/a><\/strong><\/p>\n\n\n\n
The updated scripts part of this blog will only work with Entra GSA client version 2.0+ <\/p>\n\n\n\n
<\/p>\n\n\n\n

Scenario: Computer is NOT connected to internal network – it can NOT do NSLOOKUP of DNS record<\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"
Screenshot shows script runs in testing mode every 2 sec $RerunTesting = $True. You can disable testing, by setting to $true and then it will run with the parameter you define in $RerunEveryMin<\/figcaption><\/figure>\n\n\n\n
Result: GSA client is started<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Scenario: Computer is connected to internal network – it can do NSLOOKUP of DNS record<\/strong><\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"
Screenshot shows script runs in testing mode every 2 sec $RerunTesting = $True. You can disable testing, by setting to $true and then it will run with the parameter you define in $RerunEveryMin<\/figcaption><\/figure>\n\n\n\n
Result: GSA is stopped<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
Suspension of behavior once in production<\/h1>\n\n\n\n
Suspension of script-behavior is built into the remediation-script, in case of rogue network detection or user wants to override.<\/p>\n\n\n\n
In advance, you can prepare the suspension-script<\/a> in Intune, so you quickly can activate it for a single user or multiple users. Basically it sets a reg-key. <\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
Implementation<\/h2>\n\n\n\n
Using Intune Proactive Remediations, you can implement the detection<\/a> and remediation<\/a> scripts. Of course you want to test it before uploading to Intune \ud83d\ude42<\/p>\n\n\n\n
Please adjust the following parameters in the remediation script:<\/p>\n\n\n\n
##################################\n# VARIABLES\n##################################\n\n$Internal_DNSRecord_Name = \"<put in your DNS record here>\"\n$Internal_DNSRecord_Expected_Response = \"<put in the expected IPv4 address here>\"\n\n$RerunEveryMin = 1\n\n$RerunNumberBeforeExiting = 59\n# When it hits the number, it forces script to Exit 1. It must be less than 1 hr, as remediation job kicks off hourly\n\n\n$RerunTesting = $False\n# If $true it will force script to run every 2 sec. If $False, if uses $RerunEveyMin<\/code><\/pre>\n\n\n\n
Based on the values above, the script runs every 1 minute with 59 runs and then it terminates. The remediation script should run hourly. Feel free to fine-tune to your needs of how often you want the script to wait\/run. <\/p>\n\n\n\n
NOTE:\nThe updated V2 script must run in the context of the user, so below setting 'Run this script using the logged-on credentials' must be set to YES. <\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
This blog covers a custom script solution for Intune, that can be used to automatically detect, if the Entra Private … <\/p>\n
Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":3134,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"ngg_post_thumbnail":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[161,158,163,133,134,132,1],"tags":[],"class_list":["post-3090","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-entra-id","category-entra-private-access","category-identity","category-microsoft-security","category-mvpbuzz","category-security","category-uncategorized","infinite-scroll-item","resize-featured-image"],"featured_image_src":"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/07\/image-2.png","author_info":{"display_name":"Morten Knudsen","author_link":"https:\/\/mortenknudsen.net\/?author=1"},"jetpack_featured_media_url":"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/07\/image-2.png","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/3090","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3090"}],"version-history":[{"count":21,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/3090\/revisions"}],"predecessor-version":[{"id":3225,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/3090\/revisions\/3225"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/media\/3134"}],"wp:attachment":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3090"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3090"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3090"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}