Global Protect Best Practices

[markk96]

I have deployed Global Protect with Single Sign on and have internal host detection.   I have everything working and connecting fine, I have one portal and 3 gateways.

What I have seen is that some internal clients are connecting to an internal gateway, either by choosing to, or by accident.  I have not setup an internal gateway and now I am thinking I should.   Any guides or suggestions?

[HULK]

Few related DOC for your reference:

GlobalProtect

Global_Protect_PAN_OS5.pdf

How to Configure Internal GlobalProtect Only

How Often does GlobalProtect Client Try to Connect to the Gateway for Internal-Only GlobalProtect?

Thanks

[hshah]

Hi Mark96,

Is "Internal Host Detection" checked in setup. Refer following snapshot for it. If its checked than uncheck it, it should not connect.

Regards,

Hardik Shah

[markk96]

Yes it is checked and when the laptop docs the icon shows it is internal, but a user can right click and manual connect to a gateway and it will connect.    Sorry I stated the issue wrong, an internal client and connect to an external gateway.   I need to prevent that from happening.

[hshah]

Hi Mark,

Following solution will work in GPC 2.1. User can not modify any IP in portal config.

1. open regedit.exe

2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings\

3. Right Click > New > String Value > can-change-portal > Value "No"

Or you can try disabling "Advance view".

Regards,

Hardik Shah