topic Re: Global Protect Best Practices in General Topics

Global Protect Best Practices

markk96 — Thu, 30 Oct 2014 21:00:30 GMT

I have deployed Global Protect with Single Sign on and have internal host detection. I have everything working and connecting fine, I have one portal and 3 gateways.

What I have seen is that some internal clients are connecting to an internal gateway, either by choosing to, or by accident. I have not setup an internal gateway and now I am thinking I should. Any guides or suggestions?

Re: Global Protect Best Practices

HULK — Thu, 30 Oct 2014 21:32:56 GMT

Few related DOC for your reference:

GlobalProtect

Global_Protect_PAN_OS5.pdf

How to Configure Internal GlobalProtect Only

How Often does GlobalProtect Client Try to Connect to the Gateway for Internal-Only GlobalProtect?

Thanks

Re: Global Protect Best Practices

hshah — Thu, 30 Oct 2014 22:28:22 GMT

Hi Mark96,

Is "Internal Host Detection" checked in setup. Refer following snapshot for it. If its checked than uncheck it, it should not connect.

Regards,

Hardik Shah

Re: Global Protect Best Practices

markk96 — Thu, 30 Oct 2014 23:00:17 GMT

Yes it is checked and when the laptop docs the icon shows it is internal, but a user can right click and manual connect to a gateway and it will connect. Sorry I stated the issue wrong, an internal client and connect to an external gateway. I need to prevent that from happening.

Re: Global Protect Best Practices

hshah — Thu, 30 Oct 2014 23:17:39 GMT

Hi Mark,

Following solution will work in GPC 2.1. User can not modify any IP in portal config.

1. open regedit.exe

2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings\

3. Right Click > New > String Value > can-change-portal > Value "No"

Or you can try disabling "Advance view".

Regards,

Hardik Shah