topic Re: How to retrieve and use Data Collection for Global Protect? in General Topics

How to retrieve and use Data Collection for Global Protect?

JohnQuile — Thu, 09 Apr 2020 03:42:16 GMT

Q: I'm using a PA-3020; is there any default data collection gathered with the GlobalProtect VPN client/agents, or do you have to provide custom registry keys to scan for Windows?

And where can you actually find the information being gathered?

Re: How to retrieve and use Data Collection for Global Protect?

vathreya — Thu, 09 Apr 2020 03:55:57 GMT

Hi JohnQuile,

Can you specify the use-case? I'm not sure I follow your question.

Regards,

Varun

Re: How to retrieve and use Data Collection for Global Protect?

JohnQuile — Thu, 09 Apr 2020 04:00:55 GMT

Sorry, well one example would be if I wanted to block a user from VPN. It says to go to Monitor > Logs > HIP Match and get a HostID.

But this log section is all empty.

When I go to Network > GlobalProtect > Portals, open the portal and look at Agent > config > Data Collection there is a checkbox on "Collect HIP Data" checked.

So I'm not sure where the "Collect HIP Data" stuff is going, or what I can even really do with it beyond blocking a VPN client. Perhaps I want to only allow VPN with up to date AntiVirus. I'm guessing this HIP data comes into play on that as well? But I'm not seeing the connections (in the context of documentation) on how.

Re: How to retrieve and use Data Collection for Global Protect?

Mick_Ball — Thu, 09 Apr 2020 08:13:50 GMT

you will need to add HIP objects or/and HIP profiles under Objects-GlobalProtect.

you will need the additional gateway license to use these in a policy but not sure if you need that just to see them under the Monitor-HIP Match.

Re: How to retrieve and use Data Collection for Global Protect?

JohnQuile — Thu, 09 Apr 2020 15:25:08 GMT

HI sorry but how do I know if I have gateway license? Don't I have that already if I have a portal and GlobalProtect license?

Re: How to retrieve and use Data Collection for Global Protect?

vathreya — Thu, 09 Apr 2020 16:06:24 GMT

Hi John,

Can you check if you've already activated your license? Please go through this link: https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/getting-started/activate-licenses-and-subscriptions.html

Regards,

Varun

Re: How to retrieve and use Data Collection for Global Protect?

OtakarKlier — Thu, 09 Apr 2020 21:20:27 GMT

Hello,

If you have your VPN users in a different zone, you can also use User-ID to block the users you dont want to VPN in. They can connect but cant go anywhere.

Just a thought.