Anyone ever use “internal host detection” on GP?

[junior_r]

Hi,

Anyone ever use “internal host detection” on GP? For some reason it does not try to do the test. I checked the GP services log and did not find an entry there. I am trying to force "enforce GlobalProtect for Network Access" when users are cocnneced to the internet.

Thanks

[Mick_Ball]

Works ok for me, 

globe displays little house, more like a dogs kennel when connected to lan.

not using enforce option, just always on.

i did have to allow globalprotect connection frm lan to wan for users to get GP config for the first connection attempt.

[junior_r]

Hi,

On the Always on option did you get a one time password to work with LDAP? I am not sure how to get OTP working as Windows logon screen only allows user name and password and with SSO enabled it will only carry username and password.

Thansk

[Mick_Ball]

I am confused by your reply...  never seen otp with ldap...

could you explain in more detail your authentication process.

[junior_r]

HI,

Want I want is Global Protect to be set to User-Logon. CLient logs on to Windows 7 SSO takes creds and supplies it to Portal. Then for Gateway it promotes user for RADIUS RSA OTP. I can get this to work without SSO, but I want to use User-Logon SSO. I want it so i promotes user for PIN when they login to the PC. If its added to the main windows logon page then there can be an issue when they are on the local network and GP is not needed.

Thanks

[Mick_Ball]

Still not quite sure what you are trying to achieve.

you cannot mix sso with otp. Sso will only use windows credentials.

our users do enter a pin before logon to windows but this is via bitlocker disk encryption.

globalprotect cannot modify the windows logon process.

[junior_r]

ok thanks you have answered my question cannot have a mix of both SSO and OTP. Have you gotten "enforce GlobalProtect for Network Access disable when on internal network" and "Internal Host Detection" to work on user-connect method? It is not working for me. When I check the GPS*log it does not show it trying to do the DNS resolution on the internal name I provided. 

[junior_r]

I have a client that wants to use OTP and always on but I am guessing this is not possible.

[Mick_Ball]

Are you saying that the GP client just connects as normal or does it not connect at all.

I only ask this because the GP client needs to make connection when first installed to obtain the settings for internal host detection.

[Mick_Ball]

Otp and always on... i dont see why not. But make sure for otp that you configure authentication overide in both portal and gateway config or the gateway will try to use the same otp and fail.

You may be better off by adding this as a new post.

[junior_r]

I did connect to portal to pull down new configuration, but it seems "internal host detection" does not work with on-demand method

[Mick_Ball]

Ok it may just be that it’s not needed for on demand mode, i suppose you’d need to ask yourself why would you even try to connect when on the local network. In that case i suppose it only works for always on to prevent auto connecting on lan.

somebody else may have the answer here but I’m going to try it on monday/tuesday so if you find the answer, please update this post.

[junior_r]

Ok will do.. Pretty much requirment is OTP and to enforce global protect to connect from external network. Internal network does not GP. This works fine with LDAP and user-logon. It does not work with on-demand.

Thanks

[Mick_Ball]

to confirm...

internal host detection does not work with "on demand".

i suppose the intention for this is to prevent "always on " from auto connecting when not needed as the user will have no intervention.