Enhanced Always-On VPN for Android

Before you begin, set up your GlobalProtect gateways and portal.

Define the GlobalProtect Agent ConfigurationsforAndroidendpoints:

To deliver this configuration to Android endpoints only, select
Android
as the applicable OS in the agent configuration.
Customize the behavior of the GlobalProtect agent.
Set
Connect Method
to either of the two
Always On
options (either user-logon or pre-logon). Note that if you use an on-demand connect method, this method will override any
Always On
settings you configure from your third-party mobile endpoint management system.

Configure an Android for Work profile from AirWatch:

From AirWatch, select
Devices
Profiles & Resources
Profiles
Add
Add Profile
Android
.
Select
Android for Work
to deploy your profile to a device enabled for Android for Work.
Configure the general settings for your profile and assign the smart groups to which the profile applies.
Configure the additional Android for Work settings such as
Restrictions
or
Passcode
.
Save & Publish
your changes.

Copy the base configuration to use as a template for your GlobalProtect VPN configuration.

Select
Devices
Profiles & Resources
Profiles
.
Select the radio button for your Android for Work profile and then select the </> XML button at the top of the profiles table.
Locate and copy the characteristic section of the configuration. The section contains a configuration type identifying its purpose, for example, restrictions.

Close the dialog to exit the XML view.

Add the GlobalProtect VPN configuration to your Android for Work profile.

Select the name of your Android for Work profile.
Select
Custom Settings
Add Version
Configure
.
Paste your base configuration and remove any parameters that applied to your base configuration.
Add the following parameters after the opening characteristic declaration for your VPN configuration:
<characteristic uuid="1234567-1703-45bd-9807-************" type="com.airwatch.android.androidwork.app:com.panw.globalprotect">
	<parm name="profile_name" value="Android VPN Configuration" type="string" />
	<parm name="action" value="0" type="string" />
	<parm name="url" value="192.168.1.100" type="string" />
	<parm name="route_type" value="1" type="string" />
	<parm name="authentication_type" value="2" type="string" />
	<parm name="EnableAlwaysOnVPN" value="True" type="boolean" />
	<parm name="LockDown" value="True" type="boolean" />
	</characteristic>
where:
type
—Type of VPN profile, in this case GlobalProtect.
profile_name
—A descriptive name to identify the profile. For example, Android VPN Configuration.
url
—FQDN or IP address of the GlobalProtect portal. For example, myportal.mydomain.com
authentication_type
—Specify value="1" to use certificate authentication. Specify value="2" to use password authentication. Specify value="3" to use both password and certificate authentication.
EnableAlwaysOnVPN
—Specify True to enable Always On VPN or False to disable Always On VPN and let the user manually initiate the connection.
LockDown
—Specify true to enable lock-down mode with Always On VPN. This option allows network traffic only after GlobalProtect establishes a connection. Set this option to false to disable lock-down mode so that GlobalProtect is not required to connect to send network traffic.
Save & Publish
your changes.

To verify the Android device received the updated profile and GlobalProtect successfully connects, open the VPN settings on the endpoint and view the connection status. You should see an Always-on active connection.