topic Re: GlobalProtect multiple authentication profiles? External contractors, ldap users with certs in General Topics

GlobalProtect multiple authentication profiles? External contractors, ldap users with certs

typovy — Tue, 25 Jun 2024 16:52:05 GMT

Hi 🙂

Im looking for solution. I need to configure global protect to:

And im stuck to be honest. Im coming from cisco networking where i can create multiple profiles with separate configurations.

Is it possible to create it on palo with only one GPPortal and one GPGateway?

I configured authentication tab like below and it successfully login ldap users and check for certificate but it dont work for local users. I understand that is because those 2 client authentication methods dont work as i though and i need authentication sequence.

So i made a sequence but now if i set "Allow authentication with user credentials or client certificate" to no (because i want to check ldap user cert) local users cant log in because they dont have cert. I feel little bamboozled 😕

Re: GlobalProtect multiple authentication profiles? External contractors, ldap users with certs

BPry — Tue, 25 Jun 2024 20:18:19 GMT

@typovy,

Any reason why you're trying to limit yourself to one portal and one gateway? Personally I would recommend having contractors completely separate from your normal users. I isolate them to their own zone completely with a dedicated portal and gateway to utilize going forward. It makes it so I don't have to worry about a misconfiguration granting access to contractors when it shouldn't, and then you don't need to worry about competing authentication settings at all.

Re: GlobalProtect multiple authentication profiles? External contractors, ldap users with certs

typovy — Wed, 26 Jun 2024 07:04:04 GMT

We have only one public IP address and we didn't want to overcomplicate it too much with loopback interfaces.