Is it possible to force a specific user to use SSL over IPSEC to setup a tunnel to Globalprotect

[DaxVC]

One user of our company has an issue connection to the GlobalProtect Gateway using IPSEC, but there is also no fallback to SSL.

His ISP carrier is using "Carrier Grade NAT" and this is likely the cause of his issue.

I know that we can force SSL connections on the Gateway, but this is a global setting and will be affecting all users, I just want this specific user to use SSL instead of IPSEC....( is there a client side setting allowing this ?)

[Mick_Ball]

Hmmmm.... yes and no... or no and yes...

We have a similar issue and the easy answer to you question is “NO”.

however... we are quite fortunate in having gateway subscription and plenty of ip’s to hand... so we have a portal config that uses gateways for ssl only..

probably not what you are after but there is no other option as ipsec is a global setting per gateway.

How  many gateways do you have.. you could just make a couple of them ssl only..... do you prefer ipsec to ssl? If not then remove ipsec altogether....

HTH.

[DaxVC]

Thanks for the clear answer.

We also have plenty of IP's left but we are not goign to waste these precious IP's for a solution for only 1 user at this moment 🙂

We will figure something out...( block IPSEC traffic on the client forcing to use SSL instead or so )

[engmohamin]

Hi

How can I block IPSEC traffic on the my windows 10 to force client to use SSL

Thanks 

[panos]

Hi,

I think you do not need to do this on client

There is an option in global protect portal / agent/ rule (which you can write a rule for specific user) - apps tab  - Connect with SSL Only

Make this yes for only this user

Regards