GlobalProtect install restrictions

[djh3003]

Hi all

I was wondering if there was a way to restrict who can install the GlobalProtect client ?

As an example, at the moment if any user launches the gateway page can download and install the client on their own computer albeit they need an active account, but the thought of them being able to install it on an infected home computer does worry me. I was thinking is there a way to lock it down to domain joined computers only ?

Thanks

[kiwi]

Hi @djh3003,

You cannot restrict it in such a way.

That said, you  could use client certificates or HIP profiles to prevent untrusted devices from connecting to your network.

Cheers !

-Kiwi.

[Mick_Ball]

@kiwi is correct.

even if you did find a way to restrict this you can easily obtain it from the web.

we use user certs for windows systems and HIP for IPad. as suggested by @kiwi. 

HIP of course will require an additional licence.

[djh3003]

Thanks guys

Do you know if there is much information on using usercerts for globalprotect ?

[Mick_Ball]

Yes tons of it...

start here for an oveview.

https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/authentica...

Are all your users on AD. If so then you could use this for certificate generation and distribution.