Global Protect with WiFi and Lan

[A.Kydyrbaev]

All our users have Global Protect installed in Always On mode and Internal Host Detection, Enforce Global Protect Connection. When they are in the office and connect to the local network via cable, Internal Host Detection is triggered and they connect to the local network without creating a tunnel. WiFi in the office is configured as guest WiFi. Moreover, if Guest WiFi and Ethernet are enabled on the computer, and when connected with a cable, Ehternet Global Protect defines the connection as an Internal Connection without creating a tunnel. But in this case, all traffic begins to go through WiFi directly to the Internet past Palo Alto and there is no access to local sites. I have to turn off WiFi to allow traffic to go through Palo Alto. How can this problem be solved? Attackers can take advantage of this situation. On the Internet they suggest solving this problem by assigning lower metrics to the ethernett adapter than the WiFi adapter. But this is not a solution to the problem with a large number of computers.

[JayGolf]

Hi @A.Kydyrbaev ,

Hi @A.Kydyrbaev ,

You could try considering setting up a GPO to handle that work for you so you won't have to do it per device. If not, you might have to look into some sort of NAC or endpoint management tool.