GlobalProtect Always on Network Connection Forced

JoeBailey — Thu, 30 Jan 2025 13:35:13 GMT

We are in the testing phase for GP Always on. I currently have forced network connection with internal host detection and it is working fine.

I did a quick search and did not find the configuration tweaks that would account for Always On / Forced Connection when the portal is unavailable.

Use case...I have a user travelling abroad. When they are at their destination , they will send me their public ip to whitelist for GlobalProtect access. If she was in the Always On /Forced Network connection policy...does that mean that her lap would basically be bricked as far as network. She is in a geo blocked country...so no access to Portal without a whitelist entry on my part. I am sure there is a configuration combination that would allow for this...I want to make sure that the users' Office 365 apps will at least work so they can communicate even if the GP app cannot reach the portal.

Thank you

Re: GlobalProtect Always on Network Connection Forced

BPry — Fri, 31 Jan 2025 01:35:02 GMT

@JoeBailey,

Correct. Do you have email hosted on-premise or are you using Exchange Online? You'll want to exclude the FQDNs as specified HERE. If you're using Exchange Online due to the number of dependencies required you'll want to look at Microsoft's 365 lists and select what FQDNs you'll need to allow from HERE.

Personally when we encounter these sort of issues when people travel we don't allow them to bring their issued device. Depending on the country we either just send them with an unmanaged device for simple email access, or we send them with a cheaper device that is disposed of after they return.

topic GlobalProtect Always on Network Connection Forced in GlobalProtect Discussions

GlobalProtect Always on Network Connection Forced

Re: GlobalProtect Always on Network Connection Forced