topic how to enforce user to connect to GP internal GW in GlobalProtect Discussions

how to enforce user to connect to GP internal GW

C.Gao140612 — Thu, 23 Jan 2025 05:48:03 GMT

Hi Expert,

I have setup an internal GP GW to get user-id, which works fine. But now the question is how to enforce users to connect to it once in office. On GP portal, I set <Enforce GlobalProtect for user access> to Yes , but it is not working. Tried both

<pre-logon always on> and <user-logon always on>.

Please let me know any way can get it resolved.

Re: how to enforce user to connect to GP internal GW

reaper — Thu, 23 Jan 2025 20:34:30 GMT

make sure the internal gateway has tunnel mode enabled, else the agent won't connect to it:

Re: how to enforce user to connect to GP internal GW

C.Gao140612 — Fri, 24 Jan 2025 01:06:38 GMT

Thanks a lot for the reply. So this is internal GW with tunnel mode. And I just need to setup a tunnel interface and if need to configure the ip pool ? Or the client just use the DHCP assigned internal ip address.

Re: how to enforce user to connect to GP internal GW

trewale — Fri, 24 Jan 2025 13:12:16 GMT

Create an IP pool and also do the split tunneling including all internal network subnets and fqdn's. This will make GP to only forward office network traffic through it's virtual Network adapter and the rest outside internet traffic will be passed through physical Network adapter.

Re: how to enforce user to connect to GP internal GW

arusharma — Mon, 27 Jan 2025 02:55:18 GMT

I think you referring to Internal host detection where users always connect to the internal gateway when in the office. To achieve this you need a PTR record configured on the firewall that must be resolved for internal users.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/globalprotect/network-globalprotect-portals/globalprotect-portals-agent-configuration-tab/globalprotect-portals-agent-internal-tab

Let me know if this is the requirement or if I have misunderstood your query.

Re: how to enforce user to connect to GP internal GW

C.Gao140612 — Mon, 27 Jan 2025 18:56:47 GMT

Hi Arusharma, the internal gw is working fine , but question is how to enforce users to connect to GP internal GW by default when they are in office.

Already opened a TAC case, but suggested to use HIP, I do not think that is related.

Re: how to enforce user to connect to GP internal GW

OtakarKlier — Mon, 27 Jan 2025 20:47:41 GMT

Hello,

Restrict the default LAN IP that is received by the client to only be able to connect to a few things:

https://skrzsecurity.net/zero-trust#:~:text=get%20to%20it.-,Architecture,-%3A

Regards,