Global Protect - Internal Detect - WIFI/LAN

[Jake.Ryan]

hello

I am testing our rollout of mobile user vpn with pre-logon and always on

currently we are on-prem with on-demand so its complete change in user experience

but with one of out test users we found today when they are at home using they are using a device that displays company wifi so they connect to this and they are detected as internal which is good

this use then comes to the office (most likely just closing the laptop lid) and docks their laptop so this moves to cable - when this happens the internet detect fails - the DNS query is successful but it seems to still connect to the portal and then the user is treated as if they are external and receive their MFA logon

if they refresh connection it then changes to internal - yes this is a repair but not something I can share out to 4000+ users as a workaround without negative feedback

I caught the end of a forum post which said: 

FYI. be aware that if you are testing by switching from wifi to LAN then internal detection will not work and you will need to refresh the GP client manually for this to happen.

is this something fixed in another release compared to GP version 5.1.8?

[andreypan]

Have a look at Automatic Restoration of VPN Connection Timeout setting here:

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-web-interface-help/globalprotect/network-global...

You can try to set Automatic Restoration of VPN Connection Timeout to 0