topic Re: Limiting GP Access to a domain group in GlobalProtect Discussions

Limiting GP Access to a domain group

MichaelMedwid — Wed, 06 Oct 2021 14:48:04 GMT

I have a portal/gateway working with Active Directory. Now I'd like to limit access to only members of a certain
AD group. What is the best way to enforce that? Thank you.

Re: Limiting GP Access to a domain group

Mick_Ball — Wed, 06 Oct 2021 19:24:51 GMT

Hi @MichaelMedwid , are you asking to limit access to the portal/gateway connection or to restrict certain specific network access once connected.

Re: Limiting GP Access to a domain group

MichaelMedwid — Wed, 06 Oct 2021 19:54:02 GMT

I am just asking about go/no-go. If you belong to AD group say GPVPN-USERS then you get access. And if not you're out of luck.

But that's a good idea as to limiting resources which can be reached based on one's group membership. If you have a resource on that I'm interested too.

Re: Limiting GP Access to a domain group

Mick_Ball — Thu, 07 Oct 2021 07:44:46 GMT

In both the portal agent and gateway agent configs you just add the domain group or individual users into the config selection criteria. This will prevent GP connection.

to allow limited access to specific users or groups then simply add a security policy from GP zone to resource and add user or group to same policy.