Global Protect Hip check doubt

[Alpalo]

Hello,

We are implementing HIP for our company, the case is that we already have several HIP objects and profiles working properly.

My question is, if we have identified a machine that does not pass the hip check as we want, is it possible that the vpn is cut? or we can only limit access through security policies?

Greetings.

[BPry]

@Alpalo,

Depends on how you have things configured. GlobalProtect by itself will never sever a connection simply because a HIP profile isn't identified properly; any performance impact would be due to how you have your rulebase configured to behave when the profile is/isn't matched. 

Personally we have some profiles that, when matched, will restrict all communication from/to the client via a matching security rulebase entry that's then identified by a script calling the API that will in turn disconnect the client. GlobalProtect and the firewall by itself however doesn't have the capability to disconnect a client when a profile is matched.