topic Always-ON VPN in the internal network. in General Topics

Always-ON VPN in the internal network.

SThatipelly — Tue, 10 Jul 2018 17:40:48 GMT

Hello,

I am looking to configure an always-on VPN with full tunnel access and enable"Enforce Global protect for Network access".

This basically means that users have to connect GP portal to access network when logging in to their machine when off-prem. Giving us the ability to filter the traffic 24x7 even when off-prem. But, I am now facing a challenge where I need to have them connected to wired network when internal and donot want them to intiate vpn tunnel.

I'd gone through numerous internal host detection docs but all say that if reverse dns is successful,it will try to connect to Internal gateway and then external. But I need a scenario where it has to stop trying VPN process when connected to LAN.

Please provide me your inputs on thisissue.

TIA

Re: Always-ON VPN in the internal network.

welly_59 — Tue, 10 Jul 2018 18:08:24 GMT

If you do not configure an internal gateway, but enable internal host detection, then it will not connect to the external gateway and it will achieve what you are trying to accomplish

Re: Always-ON VPN in the internal network.

SThatipelly — Tue, 10 Jul 2018 20:09:20 GMT

@welly_59 Thank you so much for the quick response. How does an agent lookup the hostname& IP? From all the docs, it seems like the IP is reverse-DNS queried for the hostname. Is there any way I can make the agent to do the other way around meaning Hostname should be resolved to specific IP? That way I can forge the response with firewall sinkhole capability and make only specific zone/traffic to be considered as internal.

Apologies If my question seem unclear.

Re: Always-ON VPN in the internal network.

BPry — Tue, 10 Jul 2018 20:54:06 GMT

@SThatipelly,

Internal Host Detection relies soly on a reverse DNS lookup for the internal host. If the agent is unable to find the internal host the agent assumes that it's outside the network and establishes a tunnel to the external gateway. There isn't a way to modify this behavior.