Global Protect HIP Check and AD Computer Account

[BusanaB]

Hello,

I'm currently trying to restrict Global Protect users from logging into the Portal or Gateway with unauthorized devices.

In our setup, all devices that are allowed to connect (mobile, laptops, desktops, etc.) are listed in an Active Directory OU (computer account).

I have been unable to find any information on how to configure this restriction in the official documentation or through online resources.

Is it possible to implement this limitation?

Thanks,

[TomYoung]

Hi @BusanaB ,

One method you could use is to verify the domain retrieved under host info:

If the domain matches the HIP object, then it is a device in the domain.

Thanks,

Tom

[GOMEZZZ]

Hi,

The most secure way of checking this I using certificates, checking if the connecting client is using a certificate distributed by your companies PKI.

https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/authentication/set-up-client...

You can even deploy separate certificates per device type using extended key usage and check on the specific OID. (Microsot PKI)

On top of the client cert user or machine cert you add SAML/LDAP/RADIUS authentication.

Or you can do the check for allowed on you authentication backend RADIUS (NPS/ISE).  But this will not disallow users from connecting to portal and trying to authenticate on it.  Can only be achieved with certificates.