Global Protect Pre-deployment with AlwaysOn and Network Connection Enforcement

[mmantilla]

Hi all, We are currently deploying global protect but we are not using Portal to install Global Protect in the users Workstations, instead we are using SCCM. There are multiple configuration options that can be deployed with the installation but we have not been able to find a solution to deploy Global Protect with AlwaysON enabled and als Network Connection Enforcement unless the user first connects to the Portal/GW and download the configuration. Can you please point me in the right direction or send me an article that I can follow so that when we deploy Global Protect with SCCM the computer is automatically locked down and the user only has access to the network if they are connected to the GP Portal/GW? Any solution/answer is greatly appreciated. Thank you,

[BPry · Accepted solution]

You're going to want to pre-deploy the required registry keys so that GlobalProtect is actually configured properly. Look at HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\, specifically PanSetup and Settings on a device that has already connected. Exactly what keys you'll need in your environment I'm not positive, I generally work backwards and figure it out each time I'm tasked with this since people always have slightly different options configured.

[mmantilla]

Thank you very much. With this you are confirming that indeed is possible and that this is managed by the registry keys as the rest of the options. I am going to have to start researching backwards. I believe there is still some work in documentation required by Palo Alto in this subject.