Hi, if you have the agent communication settings for the CSA set to auto-determine the path, then a client will first try to connect to the Core directly and if that fails attempt to use the CSA.
So the only way you could have a client on VPN downloading from the vendor is either to have them always use the CSA (perhaps look at using adaptive settings to modify the agent settings based on what subnet they are on?) or have it that VPN clients cannot actually see the Core directly.
MarXtar Ltd/MarXtar Corporation
Ivanti One Development Partner
Try MarXtar State Management for Ivanti to Better Understand and Manage your Assets