topic Does changing GlobalProtect VPN to Always On require reinstalling? in General Topics

Does changing GlobalProtect VPN to Always On require reinstalling?

JohnQuile — Thu, 26 Mar 2020 22:48:15 GMT

I have about a hundred users remote but they don't always need to VPN. However depending on how long WFH goes, I may need them to VPN for things like WSUS windows updates.

Rather than assume everyone will follow instructions to connect to VPN (I still will), is there a way to force their connection to always connect, even if our current setup requires them to login via Okta/SAML?
If so, would that require re-deploying the client? Or would it just update that upon their next connection to the VPN?

Re: Does changing GlobalProtect VPN to Always On require reinstalling?

BPry — Fri, 27 Mar 2020 00:11:08 GMT

@JohnQuile,

Changing to Always-On doesn't require you to re-install the agent, it will simply update it's configuration in the background the next time it connects to the portal. Short answer is this will work perfectly fine, here is a KB article about getting it setup.

Re: Does changing GlobalProtect VPN to Always On require reinstalling?

garry_shape — Fri, 27 Mar 2020 00:54:11 GMT

@BPry
Is there a way to prevent the Always On from connecting from the internal network?

Re: Does changing GlobalProtect VPN to Always On require reinstalling?

Mick_Ball — Fri, 27 Mar 2020 05:39:12 GMT

Yes. Use the internal host detection within the portal config.