How to disconnect remote users at a specific hour

[FassaSRL]

Goodmorning,

I need to disconnect one or more users from Global Protect VPN at a specific hour.

I try to explain, I don't want that after 7pm the remote suppliers can work on my net. I can't use the scheduled policy rules becouse the sessions started before 7pm (for example Remote desktop or ultraVNC) will stay active.

So I have thought to disconnect the users from Global Protect, and i can use the command "request global-protect-gateway client-logout" or API.

But is it possible to create a scheduled script that runs at a specific hour and, for example, from Monday to Friday, to do that? And is it possible to parameterize this script?

I thought to use "show global-protect-gateway current-user" and save in some variables the "Computer Name", "domain", ... and then passing them to "request global-protect-gateway client-logout".

Have I other easier ways to solve my need?

Thanks

Massimiliano

[Raido]

I would use API.

https://firewall-ip/api

API  > Operational Commands > clear > session > all > filter > source-user

And then you can even use Windows Task Manager and let your favorite browser to open URL below at 7pm that will kill those sessions. Link below does not include API key that you need to generate first and add it to the URL. API key is used to authenticate the request.

https://firewall-ip/api/?type=op&cmd=<clear><session><all><filter><source-user></source-user></filter></all></session></clear>

[vsys_remo]

Are you using the gp gw both for internal and external users or do you have seperate gw's?

[FassaSRL]

I'm using the same GP gateway for internal and external users.

[FassaSRL]

Hello,

in the "session" I haven't the GP connections so I can only clear the opened session but the user should re-open a new one.

[vsys_remo]

As I see you have different possibilities:

1. You split your gateways. so you have one for your internal and one for your external users. This way you could simply disconnect ALL users which are connected to the gateway for external users at a specific time while you only allow the access in the security policy to that gateway with a recurring schedule. just make sure that you disconnect the users after the schedule ends
2. Apply a recurring schedule to all securitypolicies for your external users and disconnect the users you need to which are connected to your shared global protect gateway.
3. As @Raido proposed clear all the open sessions for the specific users while also adding a schedule to the security policies for the external users

In method 1 the users will not be able to open again the VPN connection. In method 2 and 3 the users are able to connect the vpn but will not be able to open the sessions to the internal systems.

@all : How would a sceduled deny/reset rule behave? Would existing sessions be remached to this by schedule activated security policy or will they stay alive even such a rule becomes active?