Can a GlobalProtect VPN connection be disconnected automatically if a HIP check fails? How can access be restricted upon a HIP check failure?

• GlobalProtect Agent: All versions

• PAN-OS: All versions

No, a failed HIP check will never disconnect or terminate a user's GlobalProtect VPN connection. This is the intended design behavior of GlobalProtect and PAN-OS.

How HIP Enforces Security:

1. Connection Establishment: The user successfully connects to the GlobalProtect VPN portal and gateway.

2. HIP Data Collection & Submission: Once connected, the GlobalProtect Agent collects host details (such as OS updates, antivirus status, or disk encryption) and sends a HIP report to the gateway.

3. Policy Enforcement: The gateway evaluates the HIP report against configured HIP Match profiles and Security Policies:

   • If the HIP check passes (matches): The traffic matches allowed Security Rules, and the user is granted access to protected network resources.

   • If the HIP check fails (does not match): The traffic falls through to restrictive or default-deny Security Rules. The user remains connected to the VPN, but their traffic is blocked from reaching internal resources.

To restrict access when a HIP check fails, configure your Security Policies to require specific HIP profiles for access to internal networks.