According to the documentation, we can configure a ping to a destination or HTTP/S GET done every 30 seconds.
We looked at this feature for a fully segmented network behind a Quantum cluster doing the full Threat Prevention policing already.
We want to adjust some settings to avoid redundant use on some blades and extra processing time for users, for this we are looking at a connected/disconnected policy.
Here are the challenges we found:
- The documentation doesn't speak much about ICMP behaviour, what is the frequency of pings and when is the system considered to be disconnected or connected again
- For users behind VPN using split-tunnelling, we need some extra configuration like blocking ping to the inside destination in the firewall policy which looks a bit like a DIY approach
- For our larger deployments with hundreds of endpoints, we are creating a sort of DDOS setup to an inside system
- The client says Online when it can reach Internet but it's not clear for end-users or administrator if we are operating in connected or disconnected mode and its tracking
- We need to set up at least two destinations to avoid having all clients to switch to disconnected should for instance the probed system require a reboot or similar which doubles the traffic.
Our clients would prefer a posture-based approach policy, like membership of subnet X and domain Y with DNS server being Z and assign them to a connected or disconnected status, which would then also address the situation of VPN users in split-tunneling.
