question about global protect

[Radmin_85]

Let us assume that you have users in your company and they have company comps with global protect client installed

They take their notebooks home.is it possible somehow by global protect to forbid connect to home internet without using GP?OR is it possible to make any configuration so hat user can not disconnect the global protect.?for example by clearing credentails and so on

[rmfalconer]

You can use the always-on feature to force GP to connect so that all traffic flows through your company controlled network. Is that what you're looking for?

[Mick_Ball]

the always on option only enforces traffic down the VPN once connected. so if the user cannot connect either by mistake or on purpose then the internet will be available to that user so long as they prevent GP from connecting,

you need to use the "enforce globalprotect for network access" and set to "yes"

this will block all traffic until the GP client has connected.

that has answered your question but please note...

 this will cause an issue for networks with captive portal authentication such as hotels libraries etc.

the app has a setting that will allow the above setting to be delayed so that the user can authenticate to the captive portal/public wifi and then GP connects.

this is ok for IT peeps but most of our users forgot about the timing issue. i don't use it.

I use a proxy.pac file that only allows direct traffic to the portal and gateways, all other traffic is sent to a duff proxy.

when GP connects the pac file is aware that a local resource is available and then sends all traffic direct, this of course is then sent down the tunnel by GP client.

the users still experience public captive portal issues so for this I have created an icon on desktop that browses to the vpn url.

this is allowed by the pac file and the captiver portal kicks in. user auths, gp recognises change in network and proceeds to connect.

this works well for both windows and IPad,