Configure an Always On VPN Configuration for Android on Chromebooks Using the Google Admin Console

From your Palo Alto Networks firewall, Set Up Access to the GlobalProtect Portal.
Define the GlobalProtect Agent Configurations.
From your portal agent configuration (
Network
GlobalProtect
Portals
<portal-config>
Agent
<agent-config>
), select
App
to customize the GlobalProtect app.
To configure the GlobalProtect connection to be always on, set the

Connect Method

to

User-logon (Always On)

.



To prevent users from disabling the GlobalProtect app, set the

Allow User to Disable GlobalProtect App

option to

Disallow

.


Enable transparent authentication for GlobalProtect.
To prevent users from skipping GlobalProtect authentication prompts and thereby bypass the GlobalProtect connection upon disconnecting from GlobalProtect, configure one of the following options for transparent authentication:
Enable users to authenticate to GlobalProtect transparently using client certificate authentication.
Enable the GlobalProtect app to save both the username and password for transparent login.
From your portal agent configuration (
Network
GlobalProtect
Portals
<portal-config>
Agent
<agent-config>
), select
Authentication
.
Set the
Save User Credentials
option to
Yes
.

Click
OK
twice to save the portal agent configuration.
Commit
your changes on the firewall.
Prevent Chromebook users from bypassing GlobalProtect using Chrome OS VPN settings.
Log in to the Google Admin console as an administrator.
Deploy the GlobalProtect app for Android on managed Chromebooks using the Google Admin console on all managed Chromebooks.
Blacklist the Chrome settings (
chrome://settings
) to prevent users from modifying any VPN settings:
Select

Device Management

Chrome management

User Settings

.

In the Content > URL Blocking area, enter

chrome://settings

in the

URL Blacklist

text box.


SAVE
your changes.