About ChanDaMan

I'm trying to block unauthorize devices (non-domain machine and not having our approved anti-virus install) to establish a client VPN session into our network via GlobalProtect. The only way right now is to apply HIP check once a VPN connection via GlobalProtect has established to the user traffic. What we see happening with doing HIP check on actual traffic is un-reliable because the GP agent does not report back to the firewall from time to time, afterward, the user traffic get black-hole (deny), but GlobalProtect is still connect. The only way to get out of that is to disconnect and reconnect to GP again. I'm use to on the Cisco ASA able to restrict a user to establish a client VPN session if the host does not match certain criteria (domain check, anti-virus check, patches, etc.).  ... View more