How to disconnect remote users at a specific hour

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

How to disconnect remote users at a specific hour

L1 Bithead

Goodmorning,

I need to disconnect one or more users from Global Protect VPN at a specific hour.

I try to explain, I don't want that after 7pm the remote suppliers can work on my net. I can't use the scheduled policy rules becouse the sessions started before 7pm (for example Remote desktop or ultraVNC) will stay active.

So I have thought to disconnect the users from Global Protect, and i can use the command "request global-protect-gateway client-logout" or API.

But is it possible to create a scheduled script that runs at a specific hour and, for example, from Monday to Friday, to do that? And is it possible to parameterize this script?

I thought to use "show global-protect-gateway current-user" and save in some variables the "Computer Name", "domain", ... and then passing them to "request global-protect-gateway client-logout".

 

Have I other easier ways to solve my need?

 

Thanks

Massimiliano

 

5 REPLIES 5

Cyber Elite
Cyber Elite

I would use API.

 

https://firewall-ip/api

API  > Operational Commands > clear > session > all > filter > source-user

 

 

And then you can even use Windows Task Manager and let your favorite browser to open URL below at 7pm that will kill those sessions. Link below does not include API key that you need to generate first and add it to the URL. API key is used to authenticate the request.

 

https://firewall-ip/api/?type=op&cmd=<clear><session><all><filter><source-user></source-user></filter></all></session></clear>

 

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

L7 Applicator
Are you using the gp gw both for internal and external users or do you have seperate gw's?

I'm using the same GP gateway for internal and external users.

Hello,

in the "session" I haven't the GP connections so I can only clear the opened session but the user should re-open a new one.

 

 

As I see you have different possibilities:

  1. You split your gateways. so you have one for your internal and one for your external users. This way you could simply disconnect ALL users which are connected to the gateway for external users at a specific time while you only allow the access in the security policy to that gateway with a recurring schedule. just make sure that you disconnect the users after the schedule ends
  2. Apply a recurring schedule to all securitypolicies for your external users and disconnect the users you need to which are connected to your shared global protect gateway.
  3. As @Raido_Rattameister proposed clear all the open sessions for the specific users while also adding a schedule to the security policies for the external users

In method 1 the users will not be able to open again the VPN connection. In method 2 and 3 the users are able to connect the vpn but will not be able to open the sessions to the internal systems.

 

@all : How would a sceduled deny/reset rule behave? Would existing sessions be remached to this by schedule activated security policy or will they stay alive even such a rule becomes active?

  • 6533 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!