I will test the following configurations: Config 1 "Portal Client Config" {
hip-collection {
max-wait-time 20;
collect-hip-data yes;
}
gateways {
external {
list {
GATEWAY {
fqdn GATEWAY;
priority-rule {
Any {
priority 1;
}
}
manual no;
}
}
cutoff-time 5;
}
}
authentication-override {
generate-cookie no;
}
source-user any;
os any;
agent-ui {
max-agent-user-overrides 0;
agent-user-override-timeout 0;
}
internal-host-detection {
ip-address INTERNAL-IP;
hostname INTERNAL-FQDN;
}
gp-app-config {
config {
connect-method {
value pre-logon;
}
refresh-config-interval {
value 1;
}
agent-user-override {
value allowed;
}
client-upgrade {
value disabled;
}
use-sso {
value yes;
}
logout-remove-sso {
value yes;
}
krb-auth-fail-fallback {
value yes;
}
retry-tunnel {
value 1;
}
retry-timeout {
value 1;
}
enforce-globalprotect {
value yes;
}
captive-portal-exception-timeout {
value 3600;
}
traffic-blocking-notification-delay {
value 5;
}
display-traffic-blocking-notification-msg {
value no;
}
traffic-blocking-notification-msg {
value '<div style="font-family:'Helvetica Neue';"><h1 style="color:red;text-align:center; margin: 0; font-size: 30px;">Notice</h1><p style="margin: 0;font-size: 15px; line-height: 1.2em;">To access the network, you must first con
nect to GlobalProtect.</p></div>';
}
allow-traffic-blocking-notification-dismissal {
value yes;
}
display-captive-portal-detection-msg {
value yes;
}
captive-portal-detection-msg {
value '<div style="font-family:'Verdana';"><h1 style="color:green; margin: 0; font-size: 16px;">Loginseite erkannt / Captive Portal Detected</h1><p style="margin: 0; font-size: 14px; line-height: 1.2em;">Bitte klicken Sie auf den
Link, um sich anzumelden und Zugriff auf das Netzwerk zu erhalten: <a href="http://CAPTIVEPORTALREDIRECT">Klicken Sie hier</a><br/>Please click the link to login and to get access to the network: <a href="http://CAPTIVEPORTALREDIRECT">Click here</a></p></div>';
}
captive-portal-notification-delay {
value 5;
}
certificate-store-lookup {
value machine;
}
scep-certificate-renewal-period {
value 7;
}
retain-connection-smartcard-removal {
value yes;
}
enable-advanced-view {
value yes;
}
enable-do-not-display-this-welcome-page-again {
value yes;
}
rediscover-network {
value yes;
}
resubmit-host-info {
value yes;
}
can-change-portal {
value no;
}
can-continue-if-portal-cert-invalid {
value no;
}
show-agent-icon {
value yes;
}
user-switch-tunnel-rename-timeout {
value 0;
}
pre-logon-tunnel-rename-timeout {
value 0;
}
show-system-tray-notifications {
value no;
}
max-internal-gateway-connection-attempts {
value 0;
}
portal-timeout {
value 30;
}
connect-timeout {
value 60;
}
receive-timeout {
value 30;
}
enforce-dns {
value yes;
}
flush-dns {
value no;
}
proxy-multiple-autodetect {
value no;
}
use-proxy {
value yes;
}
wsc-autodetect {
value yes;
}
mfa-enabled {
value no;
}
mfa-listening-port {
value 4501;
}
mfa-notification-msg {
value "You have attempted to access a protected resource that requires additional authentication. Proceed to authenticate at";
}
ipv6-preferred {
value yes;
}
init-panel {
value no;
}
}
}
save-user-credentials 0;
portal-2fa no;
manual-only-gateway-2fa no;
internal-gateway-2fa no;
auto-discovery-external-gateway-2fa no;
mdm-enrollment-port 443;
} Config 2 (on this gateway local network access is disabled) "Portal Client Config" {
hip-collection {
max-wait-time 20;
collect-hip-data yes;
}
gateways {
external {
list {
GATEWAY {
fqdn GATEWAY;
priority-rule {
Any {
priority 1;
}
}
manual no;
}
}
cutoff-time 5;
}
}
authentication-override {
generate-cookie no;
}
source-user any;
os any;
agent-ui {
max-agent-user-overrides 0;
agent-user-override-timeout 0;
}
internal-host-detection {
ip-address INTERNAL-IP;
hostname INTERNAL-FQDN;
}
gp-app-config {
config {
connect-method {
value pre-logon;
}
refresh-config-interval {
value 1;
}
agent-user-override {
value disabled;
}
client-upgrade {
value disabled;
}
use-sso {
value yes;
}
logout-remove-sso {
value yes;
}
krb-auth-fail-fallback {
value yes;
}
retry-tunnel {
value 30;
}
retry-timeout {
value 5;
}
enforce-globalprotect {
value yes;
}
captive-portal-exception-timeout {
value 3600;
}
traffic-blocking-notification-delay {
value 15;
}
display-traffic-blocking-notification-msg {
value yes;
}
traffic-blocking-notification-msg {
value '<div style="font-family:'Helvetica Neue';"><h1 style="color:red;text-align:center; margin: 0; font-size: 30px;">Notice</h1><p style="margin: 0;font-size: 15px; line-height: 1.2em;">To access the network, you must first con
nect to GlobalProtect.</p></div>';
}
allow-traffic-blocking-notification-dismissal {
value yes;
}
display-captive-portal-detection-msg {
value yes;
}
captive-portal-detection-msg {
value '<div style="font-family:'Helvetica Neue';"><h1 style="color:red;text-align:center; margin: 0; font-size: 30px;">Captive Portal Detected</h1><p style="margin: 0; font-size: 15px; line-height: 1.2em;">GlobalProtect has tempo
rarily permitted network access for you to connect to the Internet. Follow instructions from your internet provider.</p><p style="margin: 0; font-size: 15px; line-height: 1.2em;">If you let the connection time out, open GlobalProtect and
click Connect to try again.</p></div>';
}
certificate-store-lookup {
value machine;
}
scep-certificate-renewal-period {
value 7;
}
retain-connection-smartcard-removal {
value yes;
}
enable-advanced-view {
value yes;
}
enable-do-not-display-this-welcome-page-again {
value yes;
}
rediscover-network {
value yes;
}
resubmit-host-info {
value yes;
}
can-change-portal {
value no;
}
can-continue-if-portal-cert-invalid {
value no;
}
show-agent-icon {
value yes;
}
user-switch-tunnel-rename-timeout {
value 0;
}
pre-logon-tunnel-rename-timeout {
value -1;
}
show-system-tray-notifications {
value no;
}
max-internal-gateway-connection-attempts {
value 0;
}
portal-timeout {
value 5;
}
connect-timeout {
value 5;
}
receive-timeout {
value 30;
}
enforce-dns {
value yes;
}
flush-dns {
value no;
}
proxy-multiple-autodetect {
value no;
}
wsc-autodetect {
value yes;
}
mfa-enabled {
value no;
}
mfa-listening-port {
value 4501;
}
mfa-notification-msg {
value "You have attempted to access a protected resource that requires additional authentication. Proceed to authenticate at";
}
ipv6-preferred {
value no;
}
}
}
save-user-credentials 0;
portal-2fa no;
manual-only-gateway-2fa no;
internal-gateway-2fa no;
auto-discovery-external-gateway-2fa no;
mdm-enrollment-port 443;
}
... View more
