Block User Internet connectivity if not connected to Global Protect

[efellows]

Hi,

I've already setup a Global Protect for a client, I've also went through all possible guides and discussion here and never found a word on that.

My client wants to block all internet connectivity for users having the GP Agent if it is not connected. They are looking at this as a measure to enforce centralized Internet access , therefore security policies and etc.

This is because even if you configure GP Agent to connect automatically and disable all user interaction of the Agent it is pretty easy for a user at Home to make GP Agent not able to connect to the Portal/Gateway.

For example block the traffic on the home Wi-Fi router.

So is it possible to do that with the GP Agent?

[panos · Accepted solution]

hi,

Hope this will help you

Forced VPN Connection with GlobalProtect

[efellows]

So can I assume that this is a full and correct conclusion based on the suggested thread:

If a user is at home, and for some reason, the VPN with HQ does NOT come up (for whatever reason), there is no way to prevent him to access the internet using his local internet line.
(The GlobalProtect client does not enforce a security policy on the local PC)