GP Always on VPN - Except if on internal LAN?

[welly_59]

Is there a way to implement this? I have seen the internal host detection option but as far as I can see that is only to choose whether you connect to an internal or external gateway.

I want all remote site users to go through the Palo Alto, but I can achieve that by routing alone. I dont see what I would be achieving by forcing vpn while on internal lan if all users are being sent to the Palo Alto for internet breakout anyway.

I have an external gateway and users are connecting with on-demand. Just looking for a way that I can move to always on, except while on site

[Remo]

@welly_59

You were already at the right place of the configuration. With the internal host detection the client first tries to resolve the entered IP address. If the IP address resolves to the configured domainname the the client assumes it is in the internal network. After that the client takes the configured action: if an internal gateway is specified a connection is set up to this internal gateway (normally only for user-id of sending HIP information). If you dont have an internal gateway the client simply doesn't do anything while staying internally.

[welly_59]

Ah excellent. So if I enable internal host detection, and do not configure an internal gateway, then it will only connect if external.

That’s just what I was looking for!