Global Protect After Prelogin the switch to user is not changing IP networks

[CobaltixIT]

We are using machine and user certificates from a windows server 2016 CA. to authenticate when using Global Protect.

• Step one is the prelogin connections and it works as intended.  The IP address is assigned on 10.1.1.0/24 network.
• Once the user logs into the computer it is configured as always on VPN then switch to user certificate for the user VPN.  The expected behavior is the endpoint gets a new IP address in 10.1.2.0/24 network. Everything is working except that the IP address never changes. The first network is very restricted while the second one has access to the needed resources. I need to find out while the user context is showing as switched it never switches IP addresses (changes from prelogin to username@domain.local)

[MP18]

@CobaltixIT 

Do you want that when user login to prelogon then it has one subnet and when they login they should have different IP address?

for this you need to have IP address pool for pre log on and then you need second ip pool for actual user login.

also which connection method you have prelogon and always on?

Regards

[JoergSchuetter]

Hello @CobaltixIT 

You might be able to achieve the same result (limited access vs. more access) by filtering the user (pre-logon vs "domain\domain users" on the firwall (VPN gateway).

[Mick_Ball]

Thats kinda whats supposed to happen. If you require different ip pool then @MP18 has the answer with different pools via the gateway configs. One range for pre logon and another for users.

i prefer to keep the same address and set policies to suit the user names.  I have limited access for pre-logon and almost full access for domain\users as suggested by @JoergSchuetter .