topic GlobalProtect install restrictions in General Topics

GlobalProtect install restrictions

djh3003 — Mon, 27 Nov 2017 05:42:20 GMT

Hi all

I was wondering if there was a way to restrict who can install the GlobalProtect client ?

As an example, at the moment if any user launches the gateway page can download and install the client on their own computer albeit they need an active account, but the thought of them being able to install it on an infected home computer does worry me. I was thinking is there a way to lock it down to domain joined computers only ?

Thanks

Re: GlobalProtect install restrictions

kiwi — Mon, 27 Nov 2017 08:10:27 GMT

Hi @djh3003,

You cannot restrict it in such a way.

That said, you could use client certificates or HIP profiles to prevent untrusted devices from connecting to your network.

Cheers !

-Kiwi.

Re: GlobalProtect install restrictions

Mick_Ball — Mon, 27 Nov 2017 08:59:04 GMT

@kiwi is correct.

even if you did find a way to restrict this you can easily obtain it from the web.

we use user certs for windows systems and HIP for IPad. as suggested by @kiwi.

HIP of course will require an additional licence.

Re: GlobalProtect install restrictions

djh3003 — Mon, 27 Nov 2017 22:15:37 GMT

Thanks guys

Do you know if there is much information on using usercerts for globalprotect ?

Re: GlobalProtect install restrictions

Mick_Ball — Tue, 28 Nov 2017 07:06:26 GMT

Yes tons of it...

start here for an oveview.

https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/authentication/set-up-client-certificate-authentication

Are all your users on AD. If so then you could use this for certificate generation and distribution.