topic refresh connection option in GP agent allowing users to disconnect GP in General Topics

refresh connection option in GP agent allowing users to disconnect GP

Deepak_K — Sat, 16 May 2020 14:04:12 GMT

We disallowed users to disable global protect app in Portal > app configuration setting , but still due to refresh connection option user able to disconnect GP and using local internet for browsing.

We don't want to disable GP icon from system tray due to password change policy.

Also enforce global protect for network resource option in app setting, didn't work properly.

Please suggest any alternative solution in this case ?

Re: refresh connection option in GP agent allowing users to disconnect GP

upelister — Sat, 16 May 2020 15:51:20 GMT

Hello,

Network Enforcement should be on Portal Configuration for all users,
- You can verify in registry "Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings" you should see a "enforce-globalprotect" entry with value "yes".
  - This Registry key can be deployable via Group Policy Object.
On Gateway Config;
- "0.0.0.0/0" should be used.
- "No direct access to local network" checkbox should be on.
Global Protect client should be on recommended version for all clients. As my info its 5.0.9-15

Re: refresh connection option in GP agent allowing users to disconnect GP

BPry — Sun, 17 May 2020 02:11:47 GMT

@Deepak_K,

The refresh connection option simply "refreshes" the connection (IE: The user disconnects and reconnects automatically). I'd be curious to know how this is allowing your users to simply ignore the VPN and browse locally if you have configured an always-on VPN connection. By design, that option shouldn't be doing anything that would allow a user to bypass the VPN.

Re: refresh connection option in GP agent allowing users to disconnect GP

Deepak_K — Thu, 21 May 2020 13:47:29 GMT