topic Re: VPN with two subnets in General Topics

VPN with two subnets

YParreno — Wed, 02 Sep 2026 14:46:39 GMT

Hello,

We are using globalprotect for users to connect to our network, but recently we have another set of users that we would like to put them on a separate network. We created another profile on the Gateway specifying that if certain users, we have connection with SAML, should receive the IP address of the secondary subnet. We moved this profile to the top, to be the first one. However is not working, they still receiving the IP from the other subnets configured long time ago. if any help, i would appreciate.
#vpngateways #globalprotect

Re: VPN with two subnets

JayGolf — Thu, 03 Sep 2026 00:14:35 GMT

Hi @YParreno ,

Can you explain what you mean by creating another profile on the gateway? Do you mean that you created a new client auth profile for these new users and specified the auth profile to be SAML? And then create a Client Agent config profile? Also, for the existing client auth profile, what type of auth are you using there?

Re: VPN with two subnets

YParreno — Thu, 03 Sep 2026 20:05:22 GMT

Hello Jay,

thanks for responding. I meant under GP>Gateways>agent>Client_Settings> i created another client and move it up to the top so it can be checked first. I have it configured to check if the user that connects is x person to give an IP from that IP pool. the other client settings under is for everybody else to use another set of IP addresses(this has always worked fine). ON the GP>portals, authentication profile, it's the same SAML for both client settings.

Just to mentioned this works fine with the original client settings, i connect with the x username no problem, but somehow it's ignoring the first client settings and it's giving me IP address from the second client settings.

thanks again.

Re: VPN with two subnets

reaper — Fri, 04 Sep 2026 11:06:25 GMT

you'll need to check if the username (or group mapping) you've added _exactly_ matches the username as it is received by globalprotect

eg, if the usermapping is registered as user@domain and you added domain\user as matching condition for the second profile, the profile will not match for the user and they will fall down to the next profile