topic Re: Restrict Global Protect access to company managed devices in GlobalProtect Discussions

Restrict Global Protect access to company managed devices

LCMember30141 — Wed, 23 Apr 2025 20:44:50 GMT

What would be the best way to go about restricting Global Protect VPN access to company managed laptops and iPads?

Re: Restrict Global Protect access to company managed devices

kiwi — Thu, 24 Apr 2025 14:28:38 GMT

There are a few ways to go about that in my opinion. I'm sure there are other options as well.

Use HIP checks. GlobalProtect can collect host information and send it to the firewall. You can create security policies that only allow VPN access if the device meets specific criteria.

Require a client certificate (issued by your internal CA for example) installed only on managed devices for GlobalProtect authentication.

Use your MDM to deploy the GlobalProtect app with pre-configured settings and restrict VPN usage only to enrolled devices.

Kind regards,

-Kim.

Re: Restrict Global Protect access to company managed devices

LCMember30141 — Mon, 28 Apr 2025 13:10:43 GMT

Thank you, Kim. I am in the process of setting up the appropriate HIP objects and profiles now.