GLOBALPROTECT split navigation

[apazmino]

Hi everyone.

Currently I have a request. When vpn user is accessing throught globalprotect is necessary that fullfill two thing: If device is corporate (domain) he can use internet resource enterprise internet. But, when device is personal he must navigate with their own personal internet resources. 

Can I reach this with HIP profile and split tunneling, but how could I merge this features?. 

Thanks team.

B.R

Andrew 

[Remo]

You could achieve this by using a machine certificate check in the config selection criteria in portal agent settings (if your domaindevices have a corporate cerificate installed). Another possibility is to use a custom device check where you look for a specific registry key/value. After that you assign the corporate devices another globalprotect gateway than the personal devices. On one gateway then you can configure the full tunnel for the corporate devices and split tunnel for the personal devices on the other globalprotect gateway.

[apazmino]

Thanks Remo, I parse all options presented by you. However, concern is that in a medium-large size environment navigation using entreprise resources and traverses the firewall can overload the network. Thanks for your contribution.. B.R

[Remo]

When I think again, it is probably even easier if you use a dedicated portal also for the personal devices. This way you have everything clearly separated and you don't have to deal with device checks. Simply use cert authentication on the domain portal and something without certs on the other ones to make sure that personal devices are not able to use the domain portal/gateway. 

I hope this will help you with the implementation of this request 🙂