Hardware reference guide

82 GlobalProtect Administrator’s Guide
Define Deployment Policies Set Up the GlobalProtect Mobile Security Manager
supports a variety of LDAP directory servers, including Microsoft Active Directory (AD), Novell eDirectory,
and Sun ONE Directory Server. See Integrate the Mobile Security Manager with your LDAP Directory for
instructions on setting up user and group matching.
About HIP Matching
You define which device attributes you are interested in monitoring and/or using for policy deployment by
creating HIP objects and HIP profiles on the Mobile Security Manager:
 HIP Objects—Provide the matching criteria to filter out the host information you are interested in using
to enforce policy. For example, if you want to identify a device that has a vulnerability you might want to
create HIP objects that would match each device state that you consider to be a vulnerability. For example,
you might create one HIP object that matches devices that are jailbroken/rooted, another that matches
devices that are not encrypted, and a third that matches devices that contain malware.
 HIP Profiles—A collection of HIP objects that are to be evaluated together using Boolean logic such that
when HIP data is evaluated against the resulting HIP profile it will either match or not match. For example,
if you want to deploy configuration profiles only to devices that do not have a vulnerability, you might create
a HIP profile to attach to your policy that matches only if the device is not rooted/jailbroken and is
encrypted and does not have malware.
For instructions on setting up HIP matching, see Define HIP Objects and HIP Profiles.
About HIP Notification
By default, end users are not given any information about policy decisions that were made as a result of
enforcement of a HIP-enabled deployment policy. However, you can enable this functionality by defining HIP
notification messages to display when a particular HIP profile is matched and/or not matched.
The decision as to when to display a message (that is, whether to display it when the device matches a HIP
profile in the policy or when it doesn’t match it), depends largely on the policy and what a HIP match (or
non-match) means for the user. That is, does a match mean that the corresponding configuration profiles are
pushed to the device? Or does it mean that the device will not receive a configuration profile until it is
compliant?
For example, consider the following scenarios:
 You create a HIP profile that matches if the device OS version is greater than or equal to a specific version
number. In this case, you might want to create a HIP notification message for devices that do not match the
HIP profile instructing the device users they must upgrade the device OS in order to receive the corporate
configuration profiles.
 You create a HIP profile that matches if the device OS version is less than a specific version number. In this
case, you might instead create the message for devices that match the profile.
The Mobile Security Manager policies you deploy enable you to ensure that the devices accessing your network
are in compliance with your acceptable use and security policies, provide a mechanism for pushing as well as
simplifying the deployment of configuration settings, certificate, and provisioning profiles required to access
your corporate resources.