topic Re: User-ID and Internal Gateway in GlobalProtect Discussions

User-ID and Internal Gateway

seag — Fri, 08 Nov 2024 16:59:47 GMT

Hello guys,

I want to implement GlobalProtect with Internal and External Gateway. Internal gateway will be used for User-ID and External Gateway for Remote Access.

Is there a way to prevent users from disconnecting GP when inside corporate network and allow them to disconnect when outside corporate network ?

Thanks !

Regards

Re: User-ID and Internal Gateway

OtakarKlier — Fri, 08 Nov 2024 21:42:27 GMT

Hello,

I can think of several things:

Configure your policies with user-id's and active directory groups. That way if they disable it and try to get to internal resources, etc, they are limited to what they can get to.
Force everyone to VPN in, a step closer to zero trust. I wrote and article on it.
- https://skrzsecurity.net/zero-trust

I'm sure there are other options.

Regards,

Re: User-ID and Internal Gateway

BPry — Mon, 11 Nov 2024 22:12:40 GMT

@seag,

The connection method is setup on the portal and not the gateway, so that becomes a bit more convoluted. If using an MDM you can kind of work around that by modifying registry keys conditionally, but not something I would really recommend. Either option that @OtakarKlier mentioned would be workable solutions.

I would highly recommend at this point that you just enforce a VPN connection at all times on issued devices and just not allow someone to disable the agent. I've rarely come across valid use cases for being allowed to disable the VPN on an issued device when out of the office.

If this is a BYOD environment then you could easily just do the first option that @OtakarKlier brought up. There's some aspects that you'd have to think about when it comes to your DHCP lease times and User-ID timeout values, but that would effectively allow what you want.

Re: User-ID and Internal Gateway

seag — Tue, 12 Nov 2024 12:46:26 GMT

@OtakarKlier

Indeed...That will "force" them to connect.

Good article by the way !

@BPry

Yes, you configure the connection method on the portal. I was thinking about creating another "Agent Config" on the portal with a different "Config Selection ". But you cannot choose a source IP or Network as criteria.

Your recommendation to always enforce VPN connection at all times when it is not a BYOD environment makes sense.

Thank you guys !

Regards,