Restricting Global protect VPN access to specific countries

[fwmike]

@TechnologySvcs , did you get this working?

I require this capability in a new GP deployment and would like to avoid putting another device upstream to restrict the portal and gateway access by region.

Thanks

[Sunugopal]

fyi, in my case it did not work at that time. I haven't tried again.

But i believe it is possible to restrict Global protect access to your public ip address using security policy rules.

Try creating two rules as mentioned below.

RULE1

--------

source zone : outside

source address : IN  (for eg. India, add required countries)

destination zone : outside

destination address :  x.x.x.x (your public ip) 

applications : panos-global-protect, panos-web-interface, ssl, 

service : application-default

action: allow

RULE2

--------

source zone : outside

source address : any

destination zone : outside

destination address :  x.x.x.x (your public ip) 

applications : panos-global-protect, panos-web-interface, ssl, 

service : application-default

action: deny

[MickBall]

@fwmike , Hi.

yes, gateway selection visa regions does work for both windoze and ios.