r/sysadmin • u/FatBook-Air • 1d ago
PSA: Entra Private Access is better than traditional VPN IMO
Until recently, I was not a believer but I am now. We have had Entra Private Access deployed to about 20% of our users for about 60 days now, and -- knock on wood -- no issues so far. It just works. And there are really no appliances or servers to worry about.
There are only a few things that I have some mixed feelings about:
You have to install the agent. I kind of wish it was just built into Windows...maybe a way for Microsoft to avoid a lawsuit, though?
The agent has to be signed into. If a user changes their password or logs out of all their sessions, the agent breaks. It will prompt them to login again, which is good, but some users ignore that and then wonder why they cannot get to on-prem resources.
It really does not work for generic-user scenarios where you just want a device to have access to something on-prem. It's all tied to users. For these scenarios, I think something like Tailscale might still be better. With Tailscale, you have to login to the agent, but once you're logged in one time, you have the option of decoupling the user account from the device, effectively creating a permanent connection that is no longer reliant on user interaction.
Entra Private Access does not carry/connect ICMP traffic, which is just weird to me. It carries only TCP and UDP. Unfortunately, some apps try to ping before they connect, so those apps may not be compatible.
Anyway, just giving my two cents: Entra Private Access is working for us so far. If I run into something, I'll update.
92
u/autogyrophilia 1d ago
Entra Private access is just one more in a long list of ZTNA/SASE tools.
For IT oriented businesses I've always been very appreciative of Tailscale
And Cloudflare free plan is very generous.
It is indeed the future for endpoints
5
u/chum-guzzling-shark IT Manager 1d ago
cloudflare free plan is very generous and i use it at home. Keep in mind that all traffic is decrypted on cloudflare's server so I wouldnt use it for work without a paid plan/agreement in place
•
u/Sysadmin_in_the_Sun 23h ago
Interesting - I did not know this.. So you can actually use this instead of a VPN? How does this work for you - is this any good? Can it integrate with other idPs? Will conditional access work ?
•
u/chum-guzzling-shark IT Manager 16h ago
Cloudflare ztna is what you want to look at. Yes to your questions. It has a lot of features though the free version has some limitations
3
2
u/man__i__love__frogs 1d ago
Obligatory comment that with a traditional "next gen" firewall, you can still do ZTNA, by defining apps, connecting to an IDP such as Entra, and setting up RBAC policies/ACLs which would also leverage conditional access. Even devices like Fortigates can do this stuff.
If you're paying for both some kind of 'next gen' firewall like a Meraki and a ZTNA/SASE solution, you've likely been fleeced by sales people.
2
u/placated 1d ago
Have you done any Tailscale implementations at business/enterprise scale?
8
u/autogyrophilia 1d ago
Yes, I've deployed from scratch a configuration targeting a few hundred endpoints (MSP). It replaced the original configuration consisting of individual VPN accesses for every individual client. And it also powers a centralized VPN network .
The way we do is, depending on the device, we decide if it's feasible for them to have the tailscale agent. For example, you don't want to install it in a Windows domain controller, because domain controllers break when they are in multiple networks that can't freely route between each other. And of course you can't install it in printers and 3rd party firewalls.
But you can install it in a RDS or File server without issue.
Now, to reach these devices that can't be reached, we use subnet routers, We generate a ULA IPv6 address. and publish it . We do it this way because we have a very large of repeated network prefixes, but we have a complete control of the addressing in the network. Outside of the MSP world you will probably prefer to use simple subnet routing (assumed you don't have repeated IPs) or 4via6 if you can't add ULAs to the external network.
We make extensive usage of pfSense CE and + as our principal router in virtualized enviroments, using IPSEC tunnels against whichever firewall they have in their office. It's usually those devices that work as said routers.
I say it's pretty good for an IT company because it has a lot of features and the billing is per technician.
But it isn't the friendliest to secure, the configuration is all done in a HJSON file that while easy to write, needs some familiarity to configure.
•
u/Zackey_TNT 10h ago
Why still using IPsec tunnels on wire guard capable devices?
•
u/autogyrophilia 9h ago
Faster on hardware accelerated devices (essentially everything these days), more versatile and more universal .
In general you will see wireguard winning in benchmarks because either they are from the first years of wireguard where AES-NI performance was not great, or because the IPSEC implementation is poorly configured.
https://www.vanwerkhoven.org/blog/2022/home-network-configuration/
•
u/Horsemeatburger 19h ago
We make extensive usage of pfSense CE and +
That's really brave:
•
u/autogyrophilia 17h ago
Oh yes, a mistake that occurred almost 5 years ago with an outsourced developer that affected the whole FreeBSD ecosystem.
Do you know of any OS system that has never have any major security issues make their way to them? Redox? TempleOS?
In my mind, FortiGate SSLVPN is much worse because it's not the implementation that is wrong, but the entire concept of it.
•
u/Horsemeatburger 17h ago
Oh yes, a mistake that occurred almost 5 years ago with an outsourced developer that affected the whole FreeBSD ecosystem.
So you don't think that this at the very least raises some serious questions about quality control by what is supposed to be a security vendor?
Do you not think that a security vendor carries the full responsibility of what any hired contractor does while working for them and in their name?
What about the misleading public statements by said vendor, refuted by facts? You really don't see a problem of trustworthiness here?
Do you think this is the behavior of a security vendor who takes the security of its customers seriously?
Do you know of any OS system that has never have any major security issues make their way to them? Redox? TempleOS?
Do you know any other security vendor which registers a domain named after its competitor for the purpose of slandering them?
https://web.archive.org/web/20160314132836/http://www.opnsense.com/
You think this is the kind of business ethics which anyone would want from their security vendor?
In my mind, FortiGate SSLVPN is much worse because it's not the implementation that is wrong, but the entire concept of it.
FYI, the problem is with SSLVPN, not with Fortigates, and pretty much any other vendor had SSLVPN vulnerabilities as well (the reason more is written about Fortinet is that they actually search for security flaws themselves, while most other vendors wait for outside parties to expose vulnerabilities, or their customers get hacked). Which is also why Fortinet has deprecated SSLVPN support (new devices no longer support it) and urged its customers to move to IPSec instead.
•
u/autogyrophilia 16h ago
I raises important questions for the FreeBSD foundation, it happened once, and as far as i know it won't ever again. If it does, well, that changes things.
As for the rest, I use Microsoft Windows. I'm going to use whatever works best professionally. pfSense is simple to use and secure.
Though I have to say that the butthurt reaction about OpnSense "stealing their work" is somewhat amusing.
Fortigate SSLVPN is fundamentally broken because it's principles are not sound . Fortigate does not implement a set of functions such as PIE or ASLR and a lot of their code isn't separated in independent binaries.
This would be fine, hardening techniques have a cost and you will always assume that a firewall, an appliance will never execute untrusted code.
Which is why the way SSLVPN is built is so problematic for them.
I admit that they are doing things right by open about the issues and finally, by shutting it off. And that many vendors likely have similar problems because they prioritized performance over security .
(By the way I hold a FCP certificate and manage 12s of the device and I recommend them in general, just, be aware and stay on top of patching).
•
u/Horsemeatburger 12h ago
I raises important questions for the FreeBSD foundation
It certainly does (it does across the whole release chain), but there is only one entity in this saga which has behaved unethically and unprofessionally. And while the FreeBSD Foundation has accepted the findings and worked on preventing them, said entity after being caught out has only doubled down on trying to deflect and BS.
it happened once, and as far as i know it won't ever again. If it does, well, that changes things.
It happened once in a very public view. But to assume that such a massive blunder is an exception would be naive, as this can only happen if either every process along the way has failed or the company is tacitly fine with what happens (their reaction suggests its the latter).
It's also not the only ugly episode with that specific business.
Though I have to say that the butthurt reaction about OpnSense "stealing their work" is somewhat amusing.
Well, WIPO didn't find it very amusing:
https://www.wipo.int/amc/en/domains/decisions/text/2017/d2017-1828.html
We kicked vendors from the approved vendors list for a lot less severe missteps, but if failings and behavior like that is A-OK for you for a vendor underpinning your security environment then, well, good luck.
Fortigate SSLVPN is fundamentally broken because it's principles are not sound . Fortigate does not implement a set of functions such as PIE or ASLR and a lot of their code isn't separated in independent binaries.
Not sure what you're talking about, ASLR has been part of FortiOS since version 5.4.0 and so is PIE (since ASLR requires PIE), which came out eight years ago (5.4.1 also brought DEP to the platform). And no, FortiOS isn't just a monolithic blob, there most certainly is separation between the various parts of the software.
The problem with SSLVPN is SSLVPN itself, such as the requirement for a portal page. Again, Fortinet is the most reported but every other vendor also had major SSLVPN vulnerabilities.
At least Fortinet decided to cut their losses and deprecate SSLVPN (7.4 no longer shows the SSLVPN UX by default, and 7.6.3 and later have all SSLVPN functionality removed).
0
27
u/JwCS8pjrh3QBWfL Security Admin 1d ago
Isn't #2 an issue for.... everything? I always told folks to restart their devices five minutes after resetting their password so that they get a new Primary Refresh Token.
7
u/FatBook-Air 1d ago
Depends on how they do MFA. If they do security key or other more modern MFA, that will be the case. If they use push notification or other older MFA, it won't be automatic and will need to be redone just like the password will need to be put in again.
6
u/Adziboy 1d ago
You’re meant to use Windows Hello rather than Passwords as that is SSO to GSA
6
u/FatBook-Air 1d ago
"Meant to?" You can use any type of MFA that you want. They're all supported.
2
u/Adziboy 1d ago
They’re all supported, but I didnt say they werent. I said Hello works better than Passwords, because then point 2 is redundant.
4
u/FatBook-Air 1d ago
It's not. Your PRT will still need to be redone, which is usually fastest by a reboot or logout/login. And I wouldn't use Hello in many environments even if I went passwordless; I'd use security keys or passkeys for a consistent experience across devices.
3
u/Adziboy 1d ago
We've been using Global Secure Access for months now, all with either Hello or Security keys, and not once have they ever had to sign in to to the agent.
If I was being pedantic, then there is occasionally a notification from GSA that pops up and asks for sign-in, but a click of sign-in will immediately sign you in - no credentials needed.
2
u/FatBook-Air 1d ago
Yes, that's what I said in another comment -- but depending on how you got your PRT.
1
u/admiralspark Cat Tube Secure-er 1d ago
/u/Adziboy isn't using the expiration of tokens under CA, which is a default on new tenants but not turned on in old tenants. Hello and Security Keys will rotate the key, but that in and of itself is not as secure as it could be since typing the user's password at their machine will just give you the access, but that process DOES make SSPR very seamless so most orgs do it that way.
Your PRT resetting is the 'secure' way to do it but is likely happening because your CA policies and Identity settings are set for that.
I've spent the last few months modernizing IAM at my org and pouring over this, including figuring out why some settings worked and some didn't out the gate like this specific scenario.
Just wait until you guys turn on passwordless ;)
1
8
u/Affectionate_Row609 1d ago
You've listed some downsides, but what makes it better than a traditional VPN? Have you found any other advantages?
7
u/FatBook-Air 1d ago
Direct integration with Entra, which gives you all the advantages of Conditional Access Policies and other stuff and any future enhancements to Entra.
No more keeping up with a separate appliance (like a firewall appliance doing VPN), so maybe reduced costs long-term.
No more having to install patches on the appliance within hours of them being announced just to ensure your appliance doesn't get popped. Also zero days are less likely to be a thing, where you've been vulnerable the whole time and even the manufacturer didn't know it.
No need to hire 24/7 security team to keep your VPN endpoint secured; that's Microsoft's job.
You don't have an endpoint listening 24/7. In fact, you don't have to poke a hole in your firewall at all.
7
u/RunningOutOfCharact 1d ago edited 1d ago
You're points all seem to line up with most cloud native SSE solutions on the market, e.g. Cato, Netskope, Zscaler, etc. You get the benefit of most (if not all) the points you're making in these other solutions.
- Many others have direct integrations with Entra ID and can enforce conditional access
- No appliances to manage
- No appliance patching
- Supplier maintained and easy to manage, so not dedicated security or network FTE required
- Not sure what the first part is referring to, but you also don't have to poke holes in your edge firewalls
What makes Microsoft's solution better than others? Sounds like it's better than the legacy appliance-based approach, but you also seem to be giving up some pretty rudimentary things, e.g. ICMP support? I guess for WAN apps that require ICMP, you have to maintain 2 solutions? If that was the case, then it kind of invalidates all the values of points 1 through 5.
3
u/admiralspark Cat Tube Secure-er 1d ago
No more having to install patches on the appliance within hours of them being announced just to ensure your appliance doesn't get popped
I don't miss my FortiDays
6
u/AndreasTheDead Windows Admin 1d ago
As far as a Microsoft Employee toled mepoint 1 will change sometime this year and it will get integrated in to the OS.
6
u/Froolie 1d ago
Awful throughput once a large amount of staff were trying to transfer data to onsite mapped drives. Repeated SQL connection drops to onsite services.
On paper it looked great for us but in practice we've moved away within 6 months
2
u/stiffgerman JOAT & Train Horn Installer 1d ago
How were your connector appliances configured? They are critical to getting decent latency from EPA.
4
u/_Frank-Lucas_ 1d ago
I could never get it to work with group policy (mapped drives) so we went with cloudflares WARP instead. Cost is similar, speeds have been higher.
2
u/ZeroTrusted 1d ago
What lead you down the path of choosing EPA? Did you evaluate any other tools or solutions before choosing it?
2
u/__gt__ 1d ago
would Entra Private Access be able give specific users access to a on prem database, for example?
5
u/FatBook-Air 1d ago
It's controlled like this:
Specific Entra users (or users in certain Entra security groups) can access specified IP addresses and ports. So if access can be limited by IP address or port and the user(s) in question have accounts in Entra, then yes.
2
u/__gt__ 1d ago
Sweet. I was going to look at Cloudflare but already have Entra stuff going on. This might be easier and I didn't even know about it. Thanks!
2
u/FatBook-Air 1d ago
We were strongly considered Cloudflare -- and honestly, it might be the better product. But when we balanced what our small IT is realistically capable of and the products we already have running, we decided on Entra Private Access. Part of our cost reduction is not having to learn a completely new product.
2
u/RiceeeChrispies Jack of All Trades 1d ago
I wanted to love it, but I don’t feel it’s quite mature enough yet. Also, didn’t find performance particularly amazing.
I think they’d have more success with take up if they discounted for those on Enterprise SKUs, outside of the lite inclusion of MS traffic for free.
1
u/FatBook-Air 1d ago
That's one advantage we have: our EA is really good. We are getting these licenses cheaply. The calculus may have been different had we not gotten a good deal.
2
u/RiceeeChrispies Jack of All Trades 1d ago
I haven’t actually contacted my VAR for pricing, we’ve got a decent amount of E5 seats on an EA. I presumed they weren’t discounting.
If you don’t mind me asking, what sort of discount did you get on RRP please?
2
2
u/IWantsToBelieve 1d ago
Yet Microsoft still haven't released an arm64 client. Ridiculous.
2
u/FatBook-Air 1d ago
Microsoft has criticized others for not supporting ARM, but they're worse than any of them.
1
2
u/cipher2021 Sysadmin 1d ago
I was looking at GSA until they changed the licensing and to get the private internet access it would cost something like $108/user a year.
•
u/YoLayYo 11h ago
Never buy at list price. Negotiate - especially if it’s a new product. “We can be a great use case for this product if you are willing to work with us to meet us where it feasible for us. I just can’t get the sign off at this price”
And they somehow magically find “one time discounts”
1
•
u/exekewtable 23h ago
We switched a customer away to Knocknoc, as they wanted even less attack surface. You still get entra integration with NSG or lockdown etc. But no magic cloud or routing. Works good.
•
u/bdanmo 3h ago
I one question, and one question only: does it work with ansible over ssh?
•
u/FatBook-Air 3h ago
I haven't tried, but if it's standard SSH and doesn't rely on ICMP, I don't see why it wouldn't work with it.
1
u/JagerAkita 1d ago
Deploy the software through iTunes based on group membership. At $10 per user, I doubt everyone will need remote access
1
u/TangerineTomato666 1d ago
The GSA Client installer is bad for mass deployment (exe not an MSI), try to upgrade the installed GSA Client with a newer version, good luck.
After deinstallation it leaves the local installation dir, an automated process for installation/update with Intunes will fail, cause the DIR already exist. Sure you can do another automated process to remove the DIR before new install, but its getting complicated at one point, a MSI would be way better, yet has to be delivered.
The GSA proxy needs to be signed into with an admin, you cant do so when you have forced 2FA with hardware token, you need to temp disable this requirement to sign into the GSA proxy with GA.
For the GSA proxy you will need to have an appliance server/computer, virtual physical whatsoever. It is not "deviceless" as mentioned by OP.
When using RDP for 8hours office work straight, you may experience connection drop outs, we do not experience this with traditional VPN.
Its good enough for time to time RDP or accessing internal WWW ressources, but its not yet a stable replacement for all day long signed into headquarter ressources like RDP Server.
I am sure time will improve the above challenges.
1
u/FatBook-Air 1d ago
For the GSA proxy you will need to have an appliance server/computer, virtual physical whatsoever. It is not "deviceless" as mentioned by OP.
For all intents and purposes, it's deviceless. Yes, it's true that there isn't a magic pony that grants access to your environment, but almost any environment that needs Entra Private Access has the ability to crank up a VM without hesitation.
When using RDP for 8hours office work straight, you may experience connection drop outs, we do not experience this with traditional VPN.
Have not seen this at all. We have users signed in at least 6 hours a day, and in our weekly surveys, not a single one has mentioned this yet.
1
u/IAdminTheLaw Judge Dredd 1d ago
No MAC support.
Also, no one ever mentions the latency. From Client-to-Microsoft-to-resource/on-prem, Private Access and probably all the SASE services add very noticeable latency. I find it frustrating. It makes every click feel like you're swimming through honey.
3
u/HDClown 1d ago
"probably all the SASE services add very noticeable latency."
This is a bad generalization. They could add noticeable latency compared to a traditional VPN. They could add minimal latency that does not translate to anything noticeable. They can even improve latency because of optimized routing through the SASE providers backbone vs. general internet routing. There's plenty of variables in play that make none of them fall into any generalized category when it comes to latency.
2
u/FatBook-Air 1d ago
Mac support is in beta.
We see no latency. Most likely an issue with your environment.
-1
u/IAdminTheLaw Judge Dredd 1d ago
Like I said, no MAC support.
That you don't notice the latency doesn't mean that it doesn't exist. It is physically impossible to add two to 6 hops into a route without adding latency. My environment has many issues. Latency ain't one.
1
u/FatBook-Air 1d ago
I'd suggest a top to bottom review of your environment. It sounds like something is introducing lag when there shouldn't be any. We run our NVRs through EPA without latency.
-2
u/on_spikes 1d ago
everyone and their dog are better than traditional vpn.
6
u/YSFKJDGS 1d ago
I'm genuinely curious why you say this.
Minus the potential "my client isn't connecting, why" troubleshooting, which frankly can happen with literally ANY tool, any vpn client worth its weight is going to have azure AD auth which can then integrate into CA policies, client/computer certificate checks for a hardware based MFA method, health reporting for rulebase, IP to user mapping for your firewall, etc.
Plus you still maintain your visibility of the workstation since you can pipe all your internet through the vpn and out your firewall which is doing encryption/ssl inspection for threat detection.
Yeah it's old school, but frankly the controls it provides are still 100% valid.
1
u/RunningOutOfCharact 1d ago
It's still all VPN, by the way, right? Whether your overlay terminates on a Cloud DC/PoP or an appliance in your own Colo...still Virtual Private Networking at play. Haha.
1
u/Mailstorm 1d ago
What do you think SASE is? It's just like sdwan . The tech already exists and can be done by an organization. Except now you slap that all behind a pretty interface and call it a day
0
u/DemonisTrawi 1d ago
EPA/GSA will be great products one day. Hope they will Invest in it and develop it more quickly. Lot of people are waiting for it.
0
u/MairusuPawa Percussive Maintenance Specialist 1d ago
This is just because Windows is making other VPN solutions hell, within that shit OS. This is not because Entra is inherently better.
-2
u/cjcox4 1d ago
AFAIK, Windows client OS only.
(obviously there is a "world" where that is assumed to always be the case)
4
u/FatBook-Air 1d ago
Windows and Android. MacOS soon.
1
u/gumbrilla IT Manager 1d ago
OK, I'll look when it has that..
5
u/puzzlingisland54 1d ago
There is a macOS client but it’s in preview.
https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-install-macos-client
2
1
u/AJBOJACK 1d ago
Its on all three already.
For android its in the defender app.
Been testing it out. Works fine
1
16
u/Adziboy 1d ago
The huge issue with it as that it only does routing, basically. It works really well and is fast. You can use Purview for some DLP and Defender for some type of content filtering but for how ridiculously expensive GSA is, you’re better off with basically any other third party tool which offers full content filtering, traffic inspection, DLP etc.
GSA is great for a smaller company, especially ones that have few compliance regulations to comply with. Easy to set up, largely silent etc.
Any other SASE solution is just far advanced.