@hshawn wrote: Assuming you are using pre-logon with always on? If so... This is funcionality that was added in PANOS 9.0 More precisely, this was added with GP 5.0. This feature also works with PAN-OS 8.0.x. With user-logon (as right now configured by @MikeC ) this is already possible with 4.1.x. @MikeC There are quite a few things that you need to consider. Mainly the question of how much security you need? I am asking this because with your current configuration it is already (easily) possible to circumvent the VPN connection - a User only needs to block connections to your VPN Gateway and he is able to connect wherever he wants without the VPN. This problem can be solved with the enforce option as you mentionned, but enabling this option also requires a change from user-logon to pre-logon, because otherwise the network connections in the internal network are blocked until the user is logged in (access is blocked until the internal host detection is done and this check takes place when GP becomes active). For the public wifis and captive portals you can configure a timeout where access to these captive portals is allowed for the specified time and as soon the user loggs in to the caprive portal or accepts terms of service GP kicks in and asks for the MFA authentication.
... View more
