topic Re: Globalprotect and SAML in General Topics

Globalprotect and SAML

GnContente — Thu, 03 Feb 2022 19:26:51 GMT

Hi all,

After enabling SAML authentication on the globalprotect vpn I can no longer assign vpn attributes to different users such as the IP pool and include routes. Mapping users is out of questions since my organisations has 5000+ users.

I am in a situation where the only solution would be to configure one vpn per firewall. A scenario that I am trying to avoid.

I haven't been able to find documentation on how to configure multiple gateways behind the same public ip address. Is this even possible with PA? If so, how can it be done?

Considering what I am asking for cannot be done. What would be the best design strategy in this case?

TIA

Re: Globalprotect and SAML

reaper — Mon, 07 Feb 2022 12:55:18 GMT

how come you can no longer assign different IP pools? this is probably due to a user-ID (upn) mismatch with group mapping (samaccountname) ?

if you try to fix this by changing the group mapping to accomodate for the SAML username format, you should be able to assign multiple profiles in the same gateway

if you are unable to fix it that way, you can still use port forwarding (PAT) to multiple loopback interfaces

Re: Globalprotect and SAML

GnContente — Mon, 07 Feb 2022 13:58:39 GMT

Please apologise for my ignorance, according to PA usernames are matched based on the user attributes that the firewall reads from the LDAP-compliant directory. Group mapping requires a LDAP server.

Thus i conclude this cannot be done with SAML

PAT is whatt i am looking for as a solution, however i havent figure out how can configure multiple gateways using PAT and loopback interfaces. It would be nice to have an example as reference.