topic Re: Can we continue to check domain and antivirus if GP license expired in General Topics

Can we continue to check domain and antivirus if GP license expired

Deepak25 — Sun, 24 Jul 2022 13:17:34 GMT

In Global Protect HIP check we have allowed only specific domain machine and specific antivirus. Firewall will continue to check domain and antivirus if Global Protect license is expired ?

Any impact if GP license expired ? Do we require to remove HIP profile from rules in such case ?

Re: Can we continue to check domain and antivirus if GP license expired

aleksandar.astardzhiev — Sun, 24 Jul 2022 20:27:31 GMT

Hi @Deepak25

As you can see from official documentation GlobalProtect license is required for "performing HIP checks"

https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-overview/about-globalprotect-licenses

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClG0CAK

I haven't personally expirience expired GP license, but I would expect that GP will contiue to gather HIP data and will submit it to the firewall, but since the license has expired firewall will ignore it and will not use that data to build HIP profile for any of the connected users. Because of this all GP users will not match any of the security rules that are enforcing HIP.

Re: Can we continue to check domain and antivirus if GP license expired

BPry — Mon, 25 Jul 2022 21:30:52 GMT

@Deepak25,

You won't actually receive HIP data when the license expires. It isn't just that the HIP data can't be used within policy, the firewall and the agent stop exchanging the data when it becomes unlicensed.