Block Global Protect from certain countries with an exception group

[puttyTrick]

Hi,

Is there any guidance available to implement the ability to block global protect access from specific Countries for most users, but provide the ability to allow some approved users to access Global protect from the blocked countries , say via an AD group or similar that provides an approved exception.  Note this would be with Pre-Logon already enabled.

Really appreciate any pointers. Thanks

[OtakarKlier]

Hello,

The only way I can think of this would not be very dynamic or sustainable:

1: Security policy that allows vpn connections

2. Security policy that blocks those countries.

Users would need to call in first to get their IP whitelisted but could be very dangerous since most hotels will use a single or several public IP's so more than that one user could attempt to connect etc.

Honestly, there is a reason you have those countries blocked, why are users going there and taking work equipment?

Regards,