Advanced Internal Host Detection

Software Support: Starting with GlobalProtect™ app 6.1. Requires content release version 8615-7549.

OS Support: Windows 10, ARM64-Based Windows 10, macOS 11 and later releases, and ARM-Based macOS 11 and later releases, and Linux, iOS, and Android.

You can now configure advanced internal host detection through the portal if you want to add an extra security layer during internal host detection by the GlobalProtect app. With the advanced internal host detection, the app validates the server certificate of the internal gateways in addition to performing a reverse DNS lookup of the internal host to determine whether the app is inside the enterprise network.

Enabling the advanced internal host detection stops malicious actors from spoofing the reverse DNS server response during the internal host detection and thereby prevents unauthorized access to the endpoints in the enterprise network. When you enable the advanced internal host detection through the portal and the user logs in to the GlobalProtect app, the workflow looks as follows:

When a user attempts to log in with advanced internal host detection enabled, the GlobalProtect app is considered as inside the enterprise network only when:

• The reverse DNS lookup of an internal host using the specified IP address to the hostname is successful during the internal host detection process.
• The app successfully validates the server certificate of at least one of the configured internal gateways.

If the advanced internal host detection fails, the endpoint is considered as outside the network and the app performs a network discovery to connect to the best available external gateway.

By default, advanced internal host detection is disabled.

1. Ensure that the GlobalProtect internal gateway is configured.
2. Ensure that the internal host detection is configured through the portal.
3. Enable advanced internal host detection.
   1. Select NetworkGlobalProtectPortals.
   2. Select the portal configuration to which you are adding the agent configuration, and then select the Agent tab and select the desired agent configuration.
   3. Select App. The App Configurations area displays the app settings with default values that you can customize for each agent configuration.

   4. In the App Configurations area, set Enable Advance Internal Host Detection to Yes to add an additional security layer during the internal host detection by the app.
   5. Click OK and commit the changes.
4. View the logs to verify that advanced internal host detection is configured through portal.
   1. Verify the GlobalProtect logs for advanced internal hosting detection for GlobalProtect app troubleshooting. To view the logs:
      • From the firewall hosting the portal, select MonitorLogsGlobalProtect.
      • Filter for advanced internal host detection to view the following events on the GlobalProtect logs page.
        • Advanced Internal Host Detection successful
        • Advanced Internal Host Detection failed
      You can also view the advanced internal host detection related events in the PanGPS logs.
   2. Verify the advanced internal host detection events in the PanGPS logs. The PanGPS log displays the following events when:
      • Advanced Internal Host Detection is enabled.
        Advanced IHD is yes
      • Advanced Internal Host Detection is not enabled.
        Advanced IHD is no
      • Advanced Internal Host Detection setting does not exist in portal configuration.
        Advanced IHD is not enabled
      • Advanced Internal Host Detection fails and GlobalProtect falls back to external network discovery.
        Advanced IHD failed. Fallback to external network discovery.
      • Advanced Internal Host Detection is enabled and Internal Host Detection is resolved to internal network.
        Skip setting network discovery ready for Advanced IHD.
      • Server certificate validation is successful for at least one internal gateway.
        Set network ready to internal network for Advanced IHD.