Is there a way to force the GlobalProtect client to not connect if the client sees certificate shenanigans?

[ericgearhart]

What I mean by the title of this discussion is that when the GlobalProtect client goes to initiate an SSL VPN session, instead of prompting the user to "cancel or continue," can the client respond to the user with something like "Invalid certificate detected. Due to security concerns your connection cannot be established at this time. Please call the Security Operations Center at 888-555-1212 for assistance with remote VPN connectivity or with any questions."

I'd rather not ask the user to choose, because it's highly likely they'll just click "Continue," opening themselves up for a Man-in-the-Middle attack.

It's trivially easy to do SSL man in the middle nowadays (http://mitmproxy.org/ is one example) so I'd rather them not connect then possibly have their entire VPN session captured by a 'bad guy.'

[ericgearhart]

Honestly Greg at this point we're looking to buy a pair of ASAs and go the AnyConnect route for remote user VPN access.

If you guys ("you guys" being PA) feel it's useful and a feature that makes sense, I'd ask that you guys go ahead and put in an FR/bug report/whatever for it.

I hate to sound so negative or sour, but GlobalProtect didn't live up to our expectations.