policy to only allow specific Host-ID auth thru GlobalProtect.

[logmpang]

i'm seeing bad guys trying to bruteforce my GlobalProtect VPN and I want to stop that.

I want to achieve only specific laptop Host-ID can go thru GlobalProtect authentication and bad guys when they trying to auth with wrong account/pwd should not able to or GlobalProtect shall not prompt 'wrong account/password'.

Can I do this via policy?

[TomYoung]

Hi @logmpang ,

The common solution to this issue is to deploy certificates to the hosts and require certificate AND username/password for GlobalProtect.  The GlobalProtect client will check for the certificate 1st.  If it does not exist, an error will be displayed instead of the username/password prompt.  You can use the same certificate for each client or a unique certificate for each client.

Make sure that you configure "No (User Credentials AND Client Certificate Required)" under the client authentication entry on the portal.

Thanks,

Tom