topic Re: Is it possible to force a specific user to use SSL over IPSEC to setup a tunnel to Globalprotect in General Topics

Is it possible to force a specific user to use SSL over IPSEC to setup a tunnel to Globalprotect

DaxVC — Tue, 16 Jul 2019 13:51:26 GMT

One user of our company has an issue connection to the GlobalProtect Gateway using IPSEC, but there is also no fallback to SSL.

His ISP carrier is using "Carrier Grade NAT" and this is likely the cause of his issue.

I know that we can force SSL connections on the Gateway, but this is a global setting and will be affecting all users, I just want this specific user to use SSL instead of IPSEC....( is there a client side setting allowing this ?)

Re: Is it possible to force a specific user to use SSL over IPSEC to setup a tunnel to Globalprotec

Mick_Ball — Tue, 16 Jul 2019 20:21:30 GMT

Hmmmm.... yes and no... or no and yes...

We have a similar issue and the easy answer to you question is “NO”.

however... we are quite fortunate in having gateway subscription and plenty of ip’s to hand... so we have a portal config that uses gateways for ssl only..

probably not what you are after but there is no other option as ipsec is a global setting per gateway.

How many gateways do you have.. you could just make a couple of them ssl only..... do you prefer ipsec to ssl? If not then remove ipsec altogether....

HTH.

Re: Is it possible to force a specific user to use SSL over IPSEC to setup a tunnel to Globalprotec

DaxVC — Wed, 17 Jul 2019 05:55:19 GMT

Thanks for the clear answer.

We also have plenty of IP's left but we are not goign to waste these precious IP's for a solution for only 1 user at this moment 🙂

We will figure something out...( block IPSEC traffic on the client forcing to use SSL instead or so )

Re: Is it possible to force a specific user to use SSL over IPSEC to setup a tunnel to Globalprotec

engmohamin — Tue, 14 Sep 2021 09:00:00 GMT

How can I block IPSEC traffic on the my windows 10 to force client to use SSL

Thanks

Re: Is it possible to force a specific user to use SSL over IPSEC to setup a tunnel to Globalprotect

Retired Member — Tue, 14 Sep 2021 13:03:57 GMT

Hi,

I think you do not need to do this on client

There is an option in global protect portal / agent/ rule (which you can write a rule for specific user) - apps tab - Connect with SSL Only

Make this yes for only this user

Regards