topic Re: GlobalProtect - Block internet access if user does not authenticate in GlobalProtect Discussions

GlobalProtect - Block internet access if user does not authenticate

Pasquale01 — Mon, 22 Mar 2021 20:56:52 GMT

Is it possible to block internet access if user does not authenticate through the GP client? We don't want any access to the web on the laptop unless they fully authenticate through Okta/GP (SAML). Would Pre-logon solve this?

Thanks

Re: GlobalProtect - Block internet access if user does not authenticate

Sarc845 — Tue, 23 Mar 2021 12:42:38 GMT

Hi PPerrotta,

You can setup a policy denying unknown users in the security policy with the action of block:

Using Global Protect your user identification should work just fine so no need to worry about users not being identified when connecting to the vpn.

Make sure your source zone and source addresses are from the VPN otherwise you might block traffic like printers etc unless you use the api to identify those devices.

++ Edit

You might have to allow your users to go to your okta tenant <domain>.okta.com above the deny policy to allow them to authenticate if you are using internal gateways as well

Re: GlobalProtect - Block internet access if user does not authenticate

Pasquale01 — Tue, 23 Mar 2021 13:14:05 GMT

Thanks for the feedback.. but that is all post-authentication. We are in a locked-down environment so we cant use SSO or Always on, maybe pre-logon is an option. What we want is if a user doesn't authenticate on the VPN they shouldn't be able to browse the web. Users now just skip the authentication and use it for personal browsing then connect when they need access to the corporate network. So ultimately we want to stop that behavior.

Thanks

Re: GlobalProtect - Block internet access if user does not authenticate

BPry — Tue, 23 Mar 2021 13:19:10 GMT

@Pasquale01,

Sounds like you're just looking for the "Enforce GlobalProtect Connection for Network Access" feature in your agent.

Re: GlobalProtect - Block internet access if user does not authenticate

Sarc845 — Tue, 23 Mar 2021 13:21:33 GMT

@Pasquale01

BPry is correct, you can configure this in the Portal settings under the Agent Configurations.