07-12-2026 10:38 PM
Hi everyone planning to set up an Internal Gateway so we can log User-ID and an internal host detection to automatically disable VPN when in the office. We are planning to set up an internal gateway strictly for a test OU to ensure that the changes we make won't disrupt the business. I set up a loopback address from a reservered dhcp(we use Palo as our dhcp server), and pretty much copied the settings from our External gateway bar the tunnel settings in the Internal Gateway.
Under config selection criteria, do we just add in the test ou?
Afterwards, under the Portal tab, should I make a new Agent? Or can i just add it to our existing agent(Which has the external gw) configuration and add in an internal host detection and the gateway that i created?
We only want to that specific OU to use the Internal Gateway for now just in case we make a mistake and there's internet issues. While people who are't in that OU won't be affected.
07-13-2026 07:40 PM
If your portal config does not have an OU set, i'd go with a copy of the portal's agent config that contains the OU.
Place that new agent config at the top, and then configure the 'internal' tab with your internal host detection and internal gateway ip/fqdn. That way you can test it without impacting 'production' until you're ready to roll it out (else all your users will get the internal gateway config but will not be allowed to connect because of the OU on the gateway agent config)
on the internal gateway, disable the 'tunnel mode' option and then create a client settings config containing the OU
that'll do the trick
07-14-2026 12:03 AM
Hi Tom, thanks for the guide. To avoid a full split-brain DNS scenario and prevent our users from losing routing to our external Cloudflare records, would you recommend we just create a pinpoint Forward Lookup Zone for the exact FQDN (e.g., gp-internal.domain.com)? Do i even need fqdn for this setup? Or can I just input the loopback IP address for both Internal host detection and Internal Gateway?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
