topic Re: SAML Authentication for GP Portal and GP GW in GlobalProtect Discussions

SAML Authentication for GP Portal and GP GW

Sanjay_Ramaiah — Fri, 20 Jan 2023 10:32:41 GMT

Hi All,

We are planning to enable SAML(OKTA) authentication for GP Portal and GP GW in our environment. Below are my queries.

How to use the Hostnames instead of IP address to connect from the GlobalProtect. Where is the settings to configure a domain instead of IP address. In Cisco Anyconnect we call it as Alias. Not sure what we call in GlobalProtect.

Any example doc setting up the Alias and also the SAML authentication which gives us info on implementation part please.

Regards,

Sanjay S

Re: SAML Authentication for GP Portal and GP GW

Metgatz — Sat, 21 Jan 2023 05:14:53 GMT

Hello @Sanjay_Ramaiah

Example if you have the IP of your Portal/Gateway using the Public IP you can also add a hostname.

Example in your public DNS of your public domain that you manage, create a DNS record type A, against the public IP example:

vpnglobal.mypublicdomain.com -----> 200.200.200.200.200

This on one side:

Now regarding the certificate you use, it must be able to have the domain name to correctly recognize the connection.

Example: SAN type certificate:

that can have the IP: 200.200.200.200.200 ( although there are many public CAs that no longer allow the IP ) and the hostname vpnglobal.mypublicdomain.com. If it is self-signed the issue is similar.

Now in the Global Protect config:

You go to Network/GlobalProtect/Portals/Your config then Agent your config External - External Gateway and there you add your FQDN i.e. your hostname so that it is recognized valid when making the connection.

Regards

Re: SAML Authentication for GP Portal and GP GW

Sanjay_Ramaiah — Wed, 15 Feb 2023 07:35:14 GMT

Thank you Metgatz for the info.

I will work on this and update the post with the outcome.

Regards,

Sanjay S