topic Re: Radius Group for GP authentication in General Topics

Radius Group for GP authentication

Sanjay_Ramaiah — Wed, 24 Jan 2024 10:03:49 GMT

Hi All,

We need to setup a specific user group in Radius should only access the GP. No other users should access GP. Currently authentication method set for GP is Radius and in the same radius we need a specific group of users only to authenticate.

May i know how i can acheive this please? Do i need to setup something like Data Redistribution server config or anything?

Regards,

Sanjay S

Re: Radius Group for GP authentication

BPry — Wed, 24 Jan 2024 23:00:57 GMT

@Sanjay_Ramaiah,

In the authentication profile just add the group/user(s) that you want to allow into the allow list, if the user is not in that group they'll be denied. I'd go a step further and ensure that on your GlobalProtect Gateway under Agent -> Client Settings that you again only have the group/user(s) that you intent to allow. This way you need a misconfiguration in both places to actually have unexpected access to GlobalProtect.

Re: Radius Group for GP authentication

Sanjay_Ramaiah — Thu, 25 Jan 2024 12:43:16 GMT

Thank you @BPry this is what i thought, but i have this doubt, if I just update the user group how will Palo firewall knows where to fetch the User Group details from? Or in the Radius configured, instead of All users do i need to give User Group info there as well?

Regards,

Sanjay S

Re: Radius Group for GP authentication

Sanjay_Ramaiah — Tue, 06 Feb 2024 15:40:15 GMT

Any suggestion on the above please? Do i need to configure any Data Redistribution or LDAP server to get that groups checked?