User-ID and Internal Gateway

[seag]

Hello guys,

I want to implement GlobalProtect with Internal and External Gateway. Internal gateway will be used for User-ID and External Gateway for Remote Access.

Is there a way to prevent users from disconnecting GP when inside corporate network and allow them to disconnect when outside corporate network ?

Thanks !

Regards

[OtakarKlier · Accepted solution]

Hello,

I can think of several things:

• Configure your policies with user-id's and active directory groups. That way if they disable it and try to get to internal resources, etc, they are limited to what they can get to.
• Force everyone to VPN in, a step closer to zero trust. I wrote and article on it.
  • https://skrzsecurity.net/zero-trust

I'm sure there are other options.

Regards,

[BPry · Accepted solution]

@seag,

The connection method is setup on the portal and not the gateway, so that becomes a bit more convoluted. If using an MDM you can kind of work around that by modifying registry keys conditionally, but not something I would really recommend. Either option that @OtakarKlier mentioned would be workable solutions.

I would highly recommend at this point that you just enforce a VPN connection at all times on issued devices and just not allow someone to disable the agent. I've rarely come across valid use cases for being allowed to disable the VPN on an issued device when out of the office.

If this is a BYOD environment then you could easily just do the first option that @OtakarKlier brought up. There's some aspects that you'd have to think about when it comes to your DHCP lease times and User-ID timeout values, but that would effectively allow what you want.

[seag]

@OtakarKlier 

Indeed...That will "force" them to connect.

Good article by the way !

@BPry 

Yes, you configure the connection method on the portal. I was thinking about creating another "Agent Config" on the portal with a different "Config Selection ". But you cannot choose a source IP or Network as criteria.

Your recommendation to always enforce VPN connection at all times when it is not a BYOD environment makes sense.

Thank you guys !

Regards,