GlobalProtect says "Connected" to quickly........

[Shawverr]

Someone can stop me if it's meant to do it this way, but if feels like a bug that needs fixed.

GlobalProtect 5.0.4-16

PanOS 9.0.1

HIP Checks in place

Scenario:

Using HIP checks to limit scope of connectivity to internal network.

Issue:

Let's say that one of my HIP checks is to look and make sure that widget.exe is running on a PC.  I connect to GlobalProtect and it says "connected" and then it does the HIP check.  I get my pop up and it says "congrats connected, you're not an idiot and know how to set this up".

Now let's say that I disable widget.exe and reconnect. Again, I connect to GlobalProtect and it says "connected" and then it does the HIP check.  I get my pop up and it says "You need to have widget.exe running".

My issue is that It still says "connected" as pictured and above and I still get an IP address from the pool.  I'm not actually connected and can't get into any internal resources, but this still feels bad.  Additionally it gives the end user a false sense that they are connected when in fact they are not.

[BPry]

@Shawverr,

So yes and no.

You need to actually connect to the gateway before the agent does the HIP check, so the 'Connected' message is valid well before you pass HIP checks and are actually granted network access. It might be a case to suggest updating the status of the 'Connected' message to align more with the thought of being connected to internal resources instead of just connected to the gateway though. 

[Shawverr]

@BPry Yeah, it feels like it should (or you should have the option) to "disconnect" anyone who doesn't pass the HIP check.