#Global Protect enabling Always on

[k.pillai]

Hi Team , I am planning to implement Always on Global protect client 6.0 , so would like to know the best practices in implementations and how can i plan the implementation phase ? 

User-logon (Always On)

Most standard corporate users

Pre-logon (Always On)

Domain-joined laptops needing remote AD login, GPOs, scripts

Is it advisable to configure internal gateway for the internal users , now the current setup is  internal host detection >> No tunnel.

Please share best practices in Agent App for always on .

Thanks KK   

[JayGolf]

Hi @k.pillai ,

As far as deciding on an internal gateway, it really depends on your goals and current visibility for internal users. I would think about a few things:

Is there east-west visibility within the internal network (does internal traffic traverse your firewall/firewalls today?)

What type of applications or services do internal users access? Is any of that considered sensitive?
Are there any security tools currently leveraged within the environment? 

Any compliance requirements? 

If internal traffic isn't inspected today or if monitoring and threat prevention capabilities are important, then an internal gateway with always-on vpn can definitely be valuable.

Hope this helps!