Global Protect Hip check doubt

Alpalo — Mon, 27 Mar 2023 13:43:34 GMT

Hello,

We are implementing HIP for our company, the case is that we already have several HIP objects and profiles working properly.

My question is, if we have identified a machine that does not pass the hip check as we want, is it possible that the vpn is cut? or we can only limit access through security policies?

Greetings.

Re: Global Protect Hip check doubt

BPry — Mon, 27 Mar 2023 14:13:33 GMT

@Alpalo,

Depends on how you have things configured. GlobalProtect by itself will never sever a connection simply because a HIP profile isn't identified properly; any performance impact would be due to how you have your rulebase configured to behave when the profile is/isn't matched.

Personally we have some profiles that, when matched, will restrict all communication from/to the client via a matching security rulebase entry that's then identified by a script calling the API that will in turn disconnect the client. GlobalProtect and the firewall by itself however doesn't have the capability to disconnect a client when a profile is matched.

topic Global Protect Hip check doubt in General Topics

Global Protect Hip check doubt

Re: Global Protect Hip check doubt