How to enforce GlobalProtect Connection for Network Access on iPhone with GP 5.0 App

[Jochen.Reinecke]

Hey Guys,

i'm currently testing the GlobalProtect App 5 with iOS Deviecs and Airwatch MDM. Everything works great, but it seems like that it isn't important which setting i've selected in the Portal > Agent > App (Settings). I've tried to enforce GlobalProtect for Network Access on iPhone but i can still deselect "connect on demand", so it is possible to access the Internet without GP.

Any Ideas? Does the Agent Settings effect? Anything else to configure espacially in AirWatch?

Thanks and best regards,

Jochen

[MickBall]

since day one of GP on IOS  it has not been possible to force GP...

the user always has the option to disable VPN in the settings menu regardless of app settings.

I use a global proxy to prevent internet browsing when not connected via GP as never found any other way of enforcing this. 

[OtakarKlier]

Hello Mick,

Would be able to get into a bit more detail on the global proxy and how you force mobile devices to use it? I would like to hear how others are solving this solution.

Regards,

[MickBall · Accepted solution]

Of course Mr Klier.
In brief...
we have just under 2k users with ipads. These are managed via mdm.
The global proxy is set via mdm so users cannot change or remove it
It points to a proxy.pac file on tinternet.
The proxy server is 1.2.3.4, this obviously does not exist so any web browsing fails with proxy error...
However....
There are exceptions in the pac file that allows direct access (no proxy) to our portals and gateways.

This allows GlobalProtect to bypass global proxy settings and connect as normal..

There is another statement within the pac file that says “ if connected to corporate network then go direct” (no proxy) so users browse as normal when connected via our internal to external firewalls.

This for some reason also works with captive portal wifi connections... it does something clever to allow captive portal auth prior to applying global proxy. Nothing to do with the pac file, its just an ios thing...

Not everyones cup of tea but has proved a winner for us over many years....

Happy to provide an example pac file if needs be...

We also use similar for windoze devices as the force global protect option just does not play with our users and crams helpdesk with calls regarding the captive portal timeout thingy...

[vsys_remo]

@MickBall

Nice solution for the iOS devices. Need to keep that in mind 😉

I am also interested in the way you solved the problem on windows. The way I used here is set the captive portal timeout to 1 hour and use simple http websites as default websites in the users browsers. The notifications of global protect are not very useful (not to say useless), but this way the user only has to open the browser to be redirected to whatever captive portal there is. This http website does nothing else than redirecting to the https company website, but as it is http it does not break the captive portal redirect.