topic Re: Prevent Globalprotect from connecting when user on internal network in General Topics

Prevent Globalprotect from connecting when user on internal network

SteveVernau — Wed, 25 Mar 2020 11:56:49 GMT

We want to prevent Globalprotect from connecting when user is on the internal network. We have the client set to manual connect/disconnect but users can be stupid and connect anyway.

We don't have an internal gateway, and dont want any ssl tunnel when user is on internal network.

We tried putting in an ip address of a reachable lan server in the "internal host detection" box and left the "internal gateways" list blank but didnt seem to work.

We also tried removing the DNS entry of the gateway from internal DNS zone (we have split-horizon DNS) but that was more trouble than it was worth due to caching of NX records leaving users unable to connect to VPN until zone TTL expiry when they jumped off the LAN network and tried to connect shortly after.

What is the correct way (by correct I mean best practice) to prevent clients from connecting to GP from internal network (keeping in mind we do not have internal GP gateway and do not want any VPN running when users are on LAN)

Re: Prevent Globalprotect from connecting when user on internal network

ZachBiles — Wed, 25 Mar 2020 14:24:29 GMT

From what I understand, the only thing needed is that internal detection IP and name. I would check and make sure your reverse lookup is working to whatever you have set for DNS for your clients. Make sure it's responding with the hostname you specified in the internal host detection section in your portal configuration. I think I read something about it having to be all lowecase (can't seem to find that info again so it may be irrelevant). The biggest thing I think is that it's a reverse lookup IP>name, so if you don't have a PTR record it's not going to work properly.

Re: Prevent Globalprotect from connecting when user on internal network

Mick_Ball — Wed, 25 Mar 2020 17:09:21 GMT

yes as per @ZachBiles .

check the GlobalProtect logs.

this is how it looks when working correctly. (Albeit "Always On") in this case... but the process will be similar.

(T19360) 03/25/20 16:43:23:581 Debug(11593): GetNetworkTypeDS

(T19360) 03/25/20 16:43:23:581 Debug(11596): No ipv6 internal host detection.

(T19360) 03/25/20 16:43:23:581 Debug(1816): IP 10.250.1.56

(T19360) 03/25/20 16:43:23:581 Debug(1835): host prxweb.yourdomain.co.uk

(T19360) 03/25/20 16:43:23:581 Debug(1852): DnsQuery returns 0

(T19360) 03/25/20 16:43:23:581 Debug(1867): Resolved 56.1.250.10.in-addr.arpa for internal host detection with return value 0

(T19360) 03/25/20 16:43:23:581 Debug(1891): The host name is prxweb.yourdomain.co.uk

(T19360) 03/25/20 16:43:23:581 Debug(5932): --Set state to Discovery complete

(T19360) 03/25/20 16:43:23:581 Debug(9839): SetVpnStatus called with new status=1, Previous Status=1

(T19360) 03/25/20 16:43:23:581 Debug(4112): UpdatePrelogonStateForSSO() - User-logon tunnel state = Connected

(T19360) 03/25/20 16:43:23:581 Debug(4797): NetworkDiscoverThread: network type is internal.

(T19360) 03/25/20 16:43:23:581 Debug(4803): NetworkDiscoverThread: Discover internal network.

(T19360) 03/25/20 16:43:23:581 Info ( 360): Gateway count is 0 for internal network.

Re: Prevent Globalprotect from connecting when user on internal network

hdauncey — Thu, 20 Aug 2020 15:57:26 GMT

Has anyone been able to figure this out? We have internal detection working with the PTR record but users can still manually connect to the gateways. Is there a way to prevent the users from connecting to the gateways manually when they are internal?

Thanks

Re: Prevent Globalprotect from connecting when user on internal network

gurjarn — Fri, 06 Aug 2021 12:40:33 GMT

Is this an Always-ON conn? or On-Demand?

Internal detection doesn't not work with OD

Re: Prevent Globalprotect from connecting when user on internal network

ZachBiles — Fri, 03 Sep 2021 13:54:24 GMT

Maybe a simple security rule not allowing this traffic to get out to the gateway from your internal network?

Re: Prevent Globalprotect from connecting when user on internal network

OtakarKlier — Fri, 03 Sep 2021 21:10:38 GMT

Hello,

Another thought would be, why disable it? Let the internal clients connect to an internat GP Portal/Gateway so that way you have zero trust between hosts on the LAN.

Just a thought, I know there are other factors.

Cheers!

Re: Prevent Globalprotect from connecting when user on internal network

ksauer507 — Fri, 03 Dec 2021 21:17:26 GMT

Because when on site it says in the lower right Gateway External-Gateways
The network connection is unreliable and GlobalProtect reconnected using an... (then it's cut off and not fit on the screen).