Block GlobalProtect VPN while internal

[tony.dinh]

We currently have Global Protect connect method as "Always On". Is it possible to not connect while internal?

Thanks

[pankaku · Accepted solution]

You can deny the traffic goging to the portal address when the host are on internal side. Create a security policy like

trust to untrust destination ip (portal address) action deny.

[VinceM · Accepted solution]

Hi,

When configuring your GP, you can specify "Internal host detection". Provide IP and internal DNS name.

If resolution is correct, vpn will never go up or will use internal gatewy if you want.

Hope help.

V.