topic Re: How to disable Global Protect inside Firewall in General Topics

How to disable Global Protect inside Firewall

jmad328is — Mon, 05 Aug 2013 22:22:35 GMT

Hi All,

I am looking for a way to have the GP client client NOT connect when I am inside the firewall of at a remote site with a VPN tunnel. Basically I would like to make a rule that says do not connect when connected to certain subnets.

Is there a way to do that?

Thanks!

Re: How to disable Global Protect inside Firewall

sraghunandan — Mon, 05 Aug 2013 23:07:15 GMT

So are you looking for a way to block access to the gp gtwy from certain subnets, you can create a rule with the source zone from where the traffic is coming from to the gp ip and set the action to block.

For example if your gp gateway is on the untrust and the subnet is on the trust, you can write a rule from trust to untrust with source ip as ur subnet/dest ip as gp gateway.

Please let me know if this is what your looking for.

Re: How to disable Global Protect inside Firewall

mbutt — Tue, 06 Aug 2013 06:45:22 GMT

If you configured internal gateway on the GP client. It will automatically detect you on the internal LAN. and on the GP client it will show up as internal instead of connected. This way it will not create a tunnel for the client.

Some useful docs for Global Protect configuration

https://live.paloaltonetworks.com/docs/DOC-2904

https://live.paloaltonetworks.com/docs/DOC-2020

https://live.paloaltonetworks.com/docs/DOC-3930

Hope this helps.

Thanks

Re: How to disable Global Protect inside Firewall

jmad328is — Wed, 07 Aug 2013 12:57:24 GMT

Thanks Mbutt. I created that internal GW and it took care of the issue!

Re: How to disable Global Protect inside Firewall

ksalustro — Wed, 27 Jun 2018 18:48:43 GMT

What settings do you give the inside gateway? I'm confused on how the GP agent "knows" it's on the inside network. Is it based on whether or not the internal gw name resolves to an IP? Or the IP is reachable? Or something else?