Endpoint Compatibility Guidelines

Akamai Enterprise Applications Access (EAA) VPN

Infoblox Endpoint is compatible with Akamai EAA VPN in the split-tunnel mode.

Note: Support for Akamai EAA VPN was verified only for Windows.

Infoblox Endpoint is compatible with Appgate VPN in the split-tunnel mode.

Note: Infoblox Endpoint supports Appgate SDP v5.3.2 or higher.

Infoblox Endpoint is not compatible with AWS Client VPN Endpoint because when your VPN configuration is set up to modify the DNS server on the network interface, Infoblox Endpoint cannot provide proper protection to your network.

Issue: When AWS Client VPN Endpoint with DNS server IP address is configured, it modifies the DNS server IP configured on the network interface of the Client machine. As a consequence, Infoblox Endpoint will not be able to provide proper protection as designed.

Per Microsoft support, Azure VPN is not supported to use loop back as DNS server for P2S VPN connection. This is a by-design limitation and currently there is no official workaround for this scenario.

N/A

Infoblox Endpoint is compatible with Check Point VPN in the split-tunnel mode.

Infoblox Endpoint is not compatible with Check Point VPN in the full-tunnel mode.

Infoblox Endpoint is compatible only with the Internet portion of AnyConnect VPN in the split-tunnel mode.

Infoblox Endpoint is not compatible with AnyConnect in the full-tunnel mode.

N/A

Infoblox Endpoint is compatible with Fortinet Forticlient VPN for windows devices.

Tested versions of Forticlient: 7.0.8.0308 Windows.

Infoblox recommends the following:

• Do not configure the client DNS address as “Same as client DNS Address".
• Specify the DNS servers on the Fortigate server.

Infoblox Endpoint is partially compatible with the McAfee Web Gateway Proxy.

Some of the features, such as block redirect or bypass redirect, might not function properly.

Issue: When the McAfee Web Gateway proxy is enabled, all traffic goes through the proxy. Some of the features, such as block redirect and bypass redirect, might not function properly

Workaround: Add the redirect IPs to the McAfee proxy bypass list. That way, the proxy is allowed to get the contents from the redirect IP during the HTTP(S) GET requests for block domains.

Issue: The Redirect Page is not being displayed with the IPv6 address due to the proxy. 

Workaround: 

1. Add all IPv4 and IPv6 redirect address to SSL decryption exception.

2. Add all IPv4 and IPv6 address to Traffic steering proxy by pass.

3. Enabled Treat as local address option in Traffic steering.

N/A

Infoblox Endpoint is compatible on windows with Palo Alto Networks GlobalProtect VPN using the below configuration:

• Network > GlobalProtect > Portal > [Portal Name] > Agent > [Agent Name] > App > Split-Tunnel Option. Do note that you have to set the "Split-Tunnel" option to "Both Network Traffic and DNS" instead of "Network Traffic Only".

• my-ip.debug.infoblox.com and csp.infoblox.com must be must be resolvable from the Endpoint. You may need to add these domains to the "Include Domains" in your GlobalProtect gateway configurations.

• Infoblox Endpoint must be able to access csp.infoblox.com on TCP port 443

• Internal domains configured in the Infoblox Platform must also be added, if the configuration allows it, as “Include domains” in all configured Palo Alto Networks GlobalProtect gateways. Do note that not all configurations permit this. 

• Do note that "Internal Domains" on the GlobalProtect Gateway configuration can be found in the Palo Alto Networks PAN-OS web UI under (Network > GlobalProtect > Gatways > NameOfGateway > Agent > Client Settings > NameOfClientSetting > Split Tunnel > Domain and Application > Include Domain).

• Infoblox Endpoint on MAC OS is not compatible with Palo Alto Networks GlobalProtect VPN with DNS server IP address parameter turned on.

Notes:

• The Infoblox Endpoint is compatible with Palo Alto Networks GlobalProtect client version 6.0.4-c21 and higher.
• A configuration applicable for "Palo Alto Networks GlobalProtect VPN" should also be applicable for "Palo Alto Networks Prisma Access - Mobile User VPN" as they are the same thing except that Palo Alto Networks hosts the infrastructure for Prisma Access, while "GlobalProtect" is run on the on-prem firewalls by the customer.
• When adding an "Internal Domain" on the GlobalProtect Gateway configuration, you must add it with a wildcard character to take effect (e.g. *.internal.domain.corp). Without the wildcard, only the domain itself will be forwarded down the tunnel. This is different to the Infoblox "Internal Domains" list which does not require the addition of the wildcard character.
• On the Palo Alto Networks firewall, you can configure up to 200 domains to be forwarded down the VPN tunnel when the tunnel is configured in split-tunnel ("Both Network Traffic and DNS" mode).
• Palo Alto Networks firewall requires the GlobalProtect licence in order to include traffic to the VPN tunnel based on domain name. 
• For further information, refer to the Palo Alto Networks GlobalProtect documentation: Configure a Split Tunnel Based on the Domain and Application.

Issue: Sometimes in an office network, the endpoint device must be restarted after the Infoblox Endpoint agent installation to work properly with the Palo Alto Networks GlobalProtect client.

Issue: When Palo Alto Networks GlobalProtect VPN with DNS server IP address is configured , it modifies the DNS server ip configured on the network interface of the MAC Client machine. So, Infoblox Endpoint will not be able to provide proper protection as designed on MAC OS.

Issue: Both modes can be enabled; however, an issue occurs when using FQDN-based split-tunneling. FQDN-based split-tunneling is required for the Pulse Secure to receive all DNS traffic when operating in this mode. When operating in this mode, it completely replaces DNS addresses of the physical NIC adapter with its own address. When it gets disconnected, it restores the previous DNS addresses. FQDN-based split-tunneling handles the DNS table of the physical NIC adapter in the same way as Infoblox Endpoint resulting in incompatibility of Pulse Secure with Infoblox Endpoint. 

Workaround: To get Pulse Secure VPN and Infoblox Endpoint to work together on the same machine, FQDN-based split-tunneling must be disabled in the Pulse Secure VPN gateway. Also, if there are any domains configured in the FQDN split tunnel at pulse secure, these domains must be added to the Infoblox Portal as internal domains. 

For additional information, see
https://kb.pulsesecure.net/articles/Pulse_Secure_Article/KB44429.

Infoblox Endpoint is compatible with Symantec WSS Agent when you exclude the following domains and IP addresses on the agent:

TCP 443:

• csp.infoblox.com 
• threatdefense.infoblox.com and its subdomains 

TCP/UDP 53 and 443:

• 52.119.40.100
• 52.119.41.100 
• 103.80.5.100
• 103.80.6.100

With some Tunnelblick versions, Infoblox Endpoint is unable to properly identify the correct internal DNS servers following a VPN disconnect. To avoid this issue, change the “Set DNS/WINS” option in Tunnelblick to "set nameserver (3.1)":

1. Open the Tunnelblick GUI
2. Select your configuration from the right panel.
3. In the Tunnelblick GUI, click on the Settings tab
4. Change “Set DNS/WINS” option value to the “set nameserver (3.1)”

Infoblox Endpoint is compatible with Zscaler Private Access (ZPA). ZPA works correctly with Windows and Mac versions.

Tested versions of Zscaler client: 3.7.0.172 for MAC OS, 3.9.0.183 for Windows. 

Infoblox Endpoint is compatible with Zscaler Internet Access (ZIA). ZIA works correctly with Windows and Mac versions. 

ZIA is supported by using Proxy Auto-Configuration (PAC) files to determine whether web browser requests (HTTP, HTTPS, and FTP) go directly to the destination or are forwarded to a web proxy server.

For information on how to configure PAC files, see the BloxOne Threat Defense Integration in ZScaler deployment guide.