topic Re: Why can I still access the company's internal network after the GP client is disconnected？ in GlobalProtect Discussions

Why can I still access the company's internal network after the GP client is disconnected？

Lyman.Li — Wed, 19 Apr 2023 07:18:11 GMT

After the client terminates the connection of GPAgent, ipconfig shows that the IP address before the disconnection is still obtained (the address allocated in the correct IP address pool). At the same time, it is still possible to communicate with the intranet server (the result of ping).
It gives me the feeling that although the display connection has been interrupted, the actual connection has not been interrupted. Unless you manually switch the network signal (change wifi), or restart the computer.
We have checked the configuration of VMFW and found that there is no relevant configuration. In other words, this phenomenon is not expected, so I want to investigate the cause and solution.

Re: Why can I still access the company's internal network after the GP client is disconnected？

BPry — Thu, 20 Apr 2023 01:09:12 GMT

@Lyman.Li,

I image that you're only seeing this on a single machine? This wouldn't be a setting on the firewall that would make a client behave like this, if you configure an on-demand connection or allow the agent to be disabled it should sever the connection. When it doesn't the most likely situation is that the service and agent communication isn't working properly on the client in question.

What agent version is this client running?

Re: Why can I still access the company's internal network after the GP client is disconnected？

Lyman.Li — Fri, 21 Apr 2023 03:04:58 GMT

Thanks for your answer,
In fact, I don't have this situation only on one terminal, I have this situation on all terminals.
Client Connect Method is set to User-logon (Always On),
Allow user to disconnect GlobalProtect App (Always-on mode) is Allow
We have tried two client versions 6.0.4 and 6.0.5

Re: Why can I still access the company's internal network after the GP client is disconnected？

hpatel11 — Fri, 21 Apr 2023 19:09:57 GMT

You have enforcer on? You can try internal Host dectection.

Re: Why can I still access the company's internal network after the GP client is disconnected？

iscott — Mon, 11 Mar 2024 20:39:58 GMT

Hi,

Were you able to know the reason? I'm having the same issue.

Regards,

Indira Scott