How to disable Global Protect inside Firewall

[jmad328is]

Hi All,

I am looking for a way to have the GP client client NOT connect when I am inside the firewall of at a remote site with a VPN tunnel.  Basically I would like to make a rule that says do not connect when connected to certain subnets.

Is there a way to do that?

Thanks!

[sraghunandan]

So are you looking for a way to block access to the gp gtwy from certain subnets, you can create a rule with the source zone from where the traffic is coming from to the gp ip and set the action to block.

For example if your gp gateway is on the untrust and the subnet is on the trust, you can write a rule from trust to untrust with source ip as ur subnet/dest ip as gp gateway.

Please let me know if this is what your looking for.

[mbutt · Accepted solution]

If you configured internal gateway on the GP client. It will automatically detect you on the internal LAN. and on the GP client it will show up as internal instead of connected. This way it will not create a tunnel for the client.

Some useful docs for Global Protect configuration

https://live.paloaltonetworks.com/docs/DOC-2904

https://live.paloaltonetworks.com/docs/DOC-2020

https://live.paloaltonetworks.com/docs/DOC-3930

Hope this helps.

Thanks

[jmad328is]

Thanks Mbutt.  I created that internal GW and it took care of the issue!

[ksalustro]

What settings do you give the inside gateway? I'm confused on how the GP agent "knows" it's on the inside network. Is it based on whether or not the internal gw name resolves to an IP? Or the IP is reachable? Or something else?