topic Geo blocking after GP login in GlobalProtect Discussions

Geo blocking after GP login

CHKlomp — Mon, 23 Feb 2026 18:23:27 GMT

My customer wants to give access based on user group and geo location.
Once authenticated the source IP is from the GP-tunnel ip-pool.
Can we still determine the source country once the tunnel is setup, or do we need to make that determination, after authentication and before completing the tunnel setup?

Re: Geo blocking after GP login

BPry — Mon, 23 Feb 2026 18:26:46 GMT

@CHKlomp,

If I understand your question correctly, no the source location is not essentially 'passed through' once your connected to GlobalProtect. You would need to have dedicated subnets allocated for each geolocation that you're planning on allowing access from if you're trying to utilize that for criteria in what GlobalProtect clients can access depending on their geolocation.

Re: Geo blocking after GP login

CHKlomp — Mon, 23 Feb 2026 18:47:07 GMT

OK @BPry , that's what I was thinking as well. I hoped I missed something to make selection easier.
As this will need some careful carving out of IP-pools.
Will let some others chime in, before I'll mark your answer as solution.