Is it possible to turn off the Globalprotect HIP check report if HIP checks are not used?

nikoolayy1 — Mon, 03 May 2021 13:35:55 GMT

Hello to All,

From what I read even if the "Collect HIP Data" is turned off on the Globalprotect portal the HIP "hipreportcheck" message is still send by default every hour from the client workstation to the Globalprotect gateway as a keepalive option?

https://docs.paloaltonetworks.com/globalprotect/8-1/globalprotect-admin/host-information/configure-hip-based-policy-enforcement.html

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UqgCAE&lang=en_US%E2%80%A9&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

If I have issues that the clients sometimes don't generate and send "hipreportcheck" messages I can as workaround to increase the "Inactivity Logout" to more than 3 hours ? I think that will be better than changing the HIP report interval to more than 1 hour. Still is there an option to turn this off and only to use the "Disconect on Idle"?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLXiCAO

Re: Is it possible to turn off the Globalprotect HIP check report if HIP checks are not used?

BPry — Mon, 03 May 2021 19:06:59 GMT

@nikoolayy1,

You can't completely disable this feature, as it is used as a keep-alive sort of metric to determine if the client is actually active or not. Increasing your inactivity logout value will workaround a client issue, but really you should be checking to see what the issue is with the client not sending a hip report.

topic Is it possible to turn off the Globalprotect HIP check report if HIP checks are not used? in General Topics

Is it possible to turn off the Globalprotect HIP check report if HIP checks are not used?

Re: Is it possible to turn off the Globalprotect HIP check report if HIP checks are not used?