GlobalProtect
Configure an Always On VPN Configuration for Chromebooks Using the Google Admin Console
Table of Contents
Configure an Always On VPN Configuration for Chromebooks Using the Google Admin Console
Chromebooks support Always On VPN through
extended support for the GlobalProtect app for Android. In an Always
On VPN configuration, the secure GlobalProtect connection is always
on. Traffic that matches specific filters (such as port and IP address)
configured on the GlobalProtect gateway is always routed through
the VPN tunnel. By enabling your end users to run the GlobalProtect app
for Android on their Chromebooks, you can ensure that they are always connected
to GlobalProtect and have access to always on security.
- The GlobalProtect app for Android is supported only on certain Chromebooks.
- Chromebooks that do not support Android applications must continue to use the GlobalProtect app for Chrome. However, these Chromebooks will not support Always On VPN.
- If the GlobalProtect app for Android is installed on a Chromebook for Always On VPN capability, the GlobalProtect app for Chrome should not be installed on the same Chromebook.
Use
the following steps to configure an Always On VPN configuration
for Chromebooks using the Google Admin console.
The following steps are applicable only if you Deploy the GlobalProtect App for Android
on Managed Chromebooks Using the Google Admin Console. Workspace ONE does not currently
support Always On VPN configurations for the GlobalProtect app for Android on
managed Chromebooks.
- From your Palo Alto Networks firewall, Set Up Access to the GlobalProtect Portal.
- Define the GlobalProtect Agent Configurations.
- Customize the GlobalProtect App.
- To configure the GlobalProtect connection to be always on, set the Connect Method to User-logon (Always On).
![]()
- To prevent users from disabling the GlobalProtect app, set the Allow User to Disable GlobalProtect App option to Disallow.
![]()
- Enable transparent authentication for GlobalProtect.To prevent users from skipping GlobalProtect authentication prompts and thereby bypass the GlobalProtect connection upon disconnecting from GlobalProtect, configure one of the following options for transparent authentication:
- Enable users to authenticate to GlobalProtect transparently using client certificate authentication.
- Enable the GlobalProtect app to save both the username and password for transparent login.
- From your portal agent configuration (), select Authentication.
- Set the Save User Credentials option to Yes.
![]()
- Click OK twice to save the portal agent configuration.
- Commit your changes on the firewall.
- Prevent
Chromebook users from bypassing GlobalProtect using Chrome OS VPN
settings.
- Log in to the Google Admin console as an administrator.
- Deploy the GlobalProtect App for Android on Managed Chromebooks Using the Google Admin Console on all managed Chromebooks.
- Blocklist the Chrome settings (chrome://settings)
to prevent users from modifying any VPN settings:
- Select .
- In the Content > URL Blocking area, enter chrome://settings in the URL Blocklist text box.
![]()
- SAVE your changes.
