topic GlobalProtect client pre-/post-connect commands? in General Topics

GlobalProtect client pre-/post-connect commands?

robert123 — Mon, 29 Jul 2013 13:49:22 GMT

Hello,

Do someone know, if i can set pre- or post-connect commands at the GlobalProtect client?

Background:

i want to start a service after a successful VPN connect via DOS command (sc.exe).

thanks

regards

Robert

Re: GlobalProtect client pre-/post-connect commands?

kprakash — Mon, 29 Jul 2013 14:35:59 GMT

Good Morning Robert.

We do not have a set of commands as such that we can use in order to connect to a service. Global Protect has the three features of on demand, user logon and pre logon, along with the single sign on feature. The client tries to connect to the portal and the gateway automatically. It uses an algorithm to locate the closet gateway, along with the most preferred one based on the gateway metric. We can also force the client to connect manually to a gateway.

The closest thing that you can come upto is using the "on-demand" feature.

You may want to talk to your SE to see if they can help you with writing a script for connecting to the gateways based on your requirements.

BR,

Karthik RP

Re: GlobalProtect client pre-/post-connect commands?

robert123 — Tue, 30 Jul 2013 15:24:47 GMT

Good afternnon Karthik,

i don't looking for a fixed defined command list. We are using GlobalProtect with the feature on-demand and i want to start a special program after the successfull vpn logon.

Is it possible to start a script after logon (on-demand mode)?

Who can help me in this case or do documentation/manuals exist, how to write/run a script?

Thanks

robert

Re: GlobalProtect client pre-/post-connect commands?

sspringer — Tue, 30 Jul 2013 16:17:02 GMT

Hi Robert,

There is no documented process for starting a script after successful connection with GlobalProtect.

I was able to find a feature request open to add support for this very feature. Please contact your Account Team and request them to vote on FR ID: 1580 on your behalf.

That said, we do have the DevCenter which is a dedicated place for sharing scripts and tools - you may get some better feedback and ideas.

Perhaps one way to accomplish the same goal, have the batch script monitor an IP address only reachable over GlobalProtect, once ICMP replies are received then run desired command. Although, I am not a Windows guru and there could be unforeseen fallout for such a script.

Cheers,

Stefan

Re: GlobalProtect client pre-/post-connect commands?

robert123 — Wed, 31 Jul 2013 05:51:54 GMT

Hello Stefan,

Thanks for your answer and help.

This is my first contact with the PaloAlto discussion board and i like it.

cheers

Robert