Restrict Global Protect access to company managed devices

[LCMember30141]

What would be the best way to go about restricting Global Protect VPN access to company managed laptops and iPads?

[kiwi]

Hi @LCMember30141 ,

There are a few ways to go about that in my opinion. I'm sure there are other options as well.

Use HIP checks.  GlobalProtect can collect host information and send it to the firewall. You can create security policies that only allow VPN access if the device meets specific criteria.

Require a client certificate (issued by your internal CA for example) installed only on managed devices for GlobalProtect authentication.

Use your MDM to deploy the GlobalProtect app with pre-configured settings and restrict VPN usage only to enrolled devices.

Kind regards,

-Kim.

[LCMember30141]

Thank you, Kim.  I am in the process of setting up the appropriate HIP objects and profiles now.