topic Re: Integrating 2 different LDAP servers in Palo Alto for Global Protect VPN authentication. in GlobalProtect Discussions

Integrating 2 different LDAP servers in Palo Alto for Global Protect VPN authentication.

preetpk — Mon, 25 Oct 2021 11:57:32 GMT

Hi,

We have a requirement as users belonging to 2 different domains (for eg: local.ae & local.co.ae) need to connect via Palo Alto global protect VPN. Is it possible to integrate Palo Alto with 2 different LDAP profile, so that both local.ae & local.co.ae domain users can connect remotely over Global Protect VPN.

Re: Integrating 2 different LDAP servers in Palo Alto for Global Protect VPN authentication.

Abdul-Fattah — Mon, 25 Oct 2021 12:33:06 GMT

Hi @preetpk ,

you can use both profiles in an Authentication Sequence profile, then use this Sequence profile for GP authentication.

Re: Integrating 2 different LDAP servers in Palo Alto for Global Protect VPN authentication.

preetpk — Mon, 25 Oct 2021 12:51:39 GMT

Hi Abdul,

Thanks for the update. Just want to check, if there is any other alternate solution apart from the above, as there is trust between both domain. Is it possible to integrate Palo Alto with on LDAP server & users in other domain also can use the domain trust to get connected via Global Protect VPN.

Re: Integrating 2 different LDAP servers in Palo Alto for Global Protect VPN authentication.

fjwcash — Mon, 25 Oct 2021 17:49:27 GMT

You need to create two separate LDAP Server Profiles (one for each server).

Then you need to create two separate Authentication Profiles (one for each LDAP server).

Then you need to create an Authentication Sequence that lists which order you want to query the LDAP servers.

Then you configure your GlobalProtect setup to use the Authentication Sequence to authenticate clients.

That way, when a client connects to GlobalProtect and puts in their username and password, GlobalProtect will check the LDAP servers in the Authentication Sequence. If there's a working authentication from the first LDAP server, then the client is connected; if not, the second LDAP server is checked. If there's a working authentication from that one, then the client is connected; if not, the connection fails.

You have to treat the LDAP servers as separate entities.