Someone can stop me if it's meant to do it this way, but if feels like a bug that needs fixed.
HIP Checks in place
Using HIP checks to limit scope of connectivity to internal network.
Let's say that one of my HIP checks is to look and make sure that widget.exe is running on a PC. I connect to GlobalProtect and it says "connected" and then it does the HIP check. I get my pop up and it says "congrats connected, you're not an idiot and know how to set this up".
Now let's say that I disable widget.exe and reconnect. Again, I connect to GlobalProtect and it says "connected" and then it does the HIP check. I get my pop up and it says "You need to have widget.exe running".
My issue is that It still says "connected" as pictured and above and I still get an IP address from the pool. I'm not actually connected and can't get into any internal resources, but this still feels bad. Additionally it gives the end user a false sense that they are connected when in fact they are not.
So yes and no.
You need to actually connect to the gateway before the agent does the HIP check, so the 'Connected' message is valid well before you pass HIP checks and are actually granted network access. It might be a case to suggest updating the status of the 'Connected' message to align more with the thought of being connected to internal resources instead of just connected to the gateway though.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!