topic Re: Restrict GP gateway selection to specific user groups via panorama in GlobalProtect Discussions

Restrict GP gateway selection to specific user groups via panorama

jjsimpson — Thu, 13 May 2021 19:38:44 GMT

Due to some internal department/company shuffling we have a requirement to authenticate a specific subset of our user base via ldap only, bypassing our existing SAML setup. Reading other forum posts and Palo docs I've learned that once you enable SAML on a gateway that's pretty much all you can use, so I'm looking at setting up a secondary gateway for these specific users.

The issue I'm running into is that since Panorama is not able to directly query the Active Directory LDAP servers for group info I am unable to select any AD groups in the gateway agent configs section.

I was hopping that copy/pasting the entire ldap structure for the cn would allow it to show up properly on the managed firewall.

but that just shows up as a string on the actual firewall.

Does anyone have info on how to push this out through Panorama, or is this even possible?

Re: Restrict GP gateway selection to specific user groups via panorama

Mick_Ball — Fri, 14 May 2021 09:55:44 GMT

Have you not selected a master device in your device groups. or perhaps this does not work for gateways.

Or hows about you just copy the group name from a firewall and paste into Panaorama.

Re: Restrict GP gateway selection to specific user groups via panorama

jjsimpson — Fri, 14 May 2021 20:48:28 GMT

We do have a master firewall set in Panorama and are currently pulling in groups for use in network policies. The system just does not appear to want to pull in the groups for GP settings.

Re: Restrict GP gateway selection to specific user groups via panorama

Mick_Ball — Sat, 15 May 2021 07:01:04 GMT

OK i was not aware as only use panorama for objects and policies.

Would copy and paste from a policy not work... not ideal i know...

Re: Restrict GP gateway selection to specific user groups via panorama

jjsimpson — Tue, 06 Jul 2021 17:59:39 GMT

Following back up here, I was on the right path with the full LDAP string in the users section.

tl;dr use the full LDAP query in the user/group setting in GP and DON'T enter the AD domain name in the group mapping settings.

Panorama does not pull the user/group info from LDAP in the GP section so a copy/paste of the LDAP query has to be manually entered. This can be pulled from the Policies tab as MickBall suggested.

The piece that was tripping me up is that we are using SAML for authentication and the user group mapping that was setup prior to myself working in the system had a manually defined domain in the user domain field using the FQDN.

Turns out this was not allowing the firewall to properly match the user account to the group for non-policy mappings. So policies would work just fine, but GP portal and gateway mapping never worked. Removing the domain altogether allowed not only the proper groups to be matched but also enabled Panorma to pull in all of the groups from AD.