Global protect for multiple schools - suggested setup

[William Hamilton]

Kia ora, I assist a few different schools and have Google Chrome profiles setup for each school.  I am testing the Global Connect VPN - I am predominantly a MacOS user and one concern is the "Admin" access it requests to the machine AND access to non-school Google Drives.  I use this machine for non-school clients, and it feels like a bit of an over reach.

• Is there a suggested method of setting up profiles for multiple schools in Global Gateway?
• Is there a way to switch the app off when not needed without uninstalling it?

Off to do some more reading

tia

W

[d.keen...@gc.ac.nz]

Although this is not Global Connect, I do see a solution to that particular problem.

We were originally using ZeroTier, but their licensing changed to something which we were not happy with.

Since then, we have moved to NetBird, which is much more capable and speedier by miles; self-hosting a docker compose setup freely on a Debian/Ubuntu instance is simple.

https://netbird.io/

It still offers the ability to run a global GAN, and the policy rules are more than sufficient to isolate schools individually right down to per-device and the port+traffic types.

(Client is hands-off when installed, so frictionless for staff/students/devices.)

Regards,

David Keenleyside, BSc CS & IS, CTech

ITP Associate

EFF Member

ICT Technician

Glenfield College

PO Box 40176 (Kaipatiki Rd)

Glenfield, Auckland City 0629

Ph:       +64 9 444 9066 ext 677

DDI: +64 9 441 9779

Email:    d.keen...@gc.ac.nz

https://itp.nz/CTech/NZ160799

https://www.linkedin.com/in/david-keenleyside-626871/

The Three O’s of Backup: Online, Offline, Off-site.

The Three RA’s of Cloud: Run Anywhere, Run Anytime, Run Agnostic.

“When you're working as part of a team, one of the things to expect is that you should share information freely with your colleagues and that they'll share information freely with you.” - Google

[William Hamilton]

Thanks David, I said in my email "Connect" but it is "Protect". https://support.n4l.co.nz/s/article/Installing-GlobalProtect-App-Apple-Mac which is the VPN solution being used by N$L and being pushed out to schools via one of their current projects

I will have to take a look at NetBird for other activities, I use WireGuard and Tailscale at the moment and enjoy both.  Thanks for that suggestion

W

--
You received this message because you are subscribed to the Google Groups "Techies for schools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-sch...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/techies-for-schools/ca61562a-17a9-41f6-a315-4f12bf581adcn%40googlegroups.com.

[Pete Mundy]

Considering the code's recent history, I think your concerns are valid. I choose not to run it on my own devices and I request to set up pinholes through the firewall to a well-protected internal service instead.

You may find this video an interesting watch:

"Black Hat USA 2025 | Use and Abuse of Palo Alto's Remote Access Solution"

https://www.youtube.com/watch?v=6IGmNLs4tk8

Pete

--
You received this message because you are subscribed to the Google Groups "Techies for schools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-sch...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/techies-for-schools/CAAjujsoae6wOnkwDBG3UTs50YfH-GBzN0ynAeLviieD%3DRf%2Btsw%40mail.gmail.com.

[William Hamilton]

Thanks Pete, as always great response to the group.  Interesting video, one day I would like to justify a trip to Black Hat!

W

To view this discussion visit https://groups.google.com/d/msgid/techies-for-schools/CAJtKfy4wUpX1G7%3DdV04q7Q9-%2B5yC13Tkggkmr7qTRpf9GyfoQw%40mail.gmail.com.

[Sean]

Pete, I'm using globalprotect for outside contractors to connect to controllers, etc. After watching the video, I'm not sure if that's a good idea.

On Monday, March 16, 2026 at 1:53:52 PM UTC+13 william....@gmail.com wrote: