topic GLOBALPROTECT split navigation in General Topics

GLOBALPROTECT split navigation

apazmino — Mon, 28 Aug 2023 20:10:31 GMT

Hi everyone.

Currently I have a request. When vpn user is accessing throught globalprotect is necessary that fullfill two thing: If device is corporate (domain) he can use internet resource enterprise internet. But, when device is personal he must navigate with their own personal internet resources.

Can I reach this with HIP profile and split tunneling, but how could I merge this features?.

Thanks team.

B.R

Andrew

Re: GLOBALPROTECT split navigation

Remo — Mon, 28 Aug 2023 21:26:48 GMT

You could achieve this by using a machine certificate check in the config selection criteria in portal agent settings (if your domaindevices have a corporate cerificate installed). Another possibility is to use a custom device check where you look for a specific registry key/value. After that you assign the corporate devices another globalprotect gateway than the personal devices. On one gateway then you can configure the full tunnel for the corporate devices and split tunnel for the personal devices on the other globalprotect gateway.

Re: GLOBALPROTECT split navigation

apazmino — Mon, 28 Aug 2023 22:31:38 GMT

Thanks Remo, I parse all options presented by you. However, concern is that in a medium-large size environment navigation using entreprise resources and traverses the firewall can overload the network. Thanks for your contribution.. B.R

Re: GLOBALPROTECT split navigation

Remo — Mon, 28 Aug 2023 22:42:17 GMT

When I think again, it is probably even easier if you use a dedicated portal also for the personal devices. This way you have everything clearly separated and you don't have to deal with device checks. Simply use cert authentication on the domain portal and something without certs on the other ones to make sure that personal devices are not able to use the domain portal/gateway.

I hope this will help you with the implementation of this request 🙂