topic Re: How to use multiple authentication profiles for Global Protect VPN in General Topics

How to use multiple authentication profiles for Global Protect VPN

kkrause — Thu, 26 Feb 2015 20:43:29 GMT

I have a need for our employees to use LDAP in the authentication profile for VPN connectivity, but I also have outside third parties that need remote VPN connectivity as well. I want them to use local database user accounts. How can I do this? It seems that a given portal can only use 1 authentication profile type.

I only have 1 external interface with 1 IP address assigned. Is the solution to use loopback interface?

Thanks,

Ken

Re: How to use multiple authentication profiles for Global Protect VPN

kattaullah — Thu, 26 Feb 2015 22:04:58 GMT

Hello Kkrause

Authentication profiles can be combined in an authentication sequence. If a user is not found on one of the LDAP servers in the first authentication profile it will attempt the next one, which should result in a successful authentication attempt as a whole on the firewall. This is configured under Device > Authentication Sequence:

This sequence can now be used for any purpose, such as Global Protect authentication:

Hope that answers your question.

Regards

Khan

Note: Please mark any correct or helpful reply.

Re: How to use multiple authentication profiles for Global Protect VPN

hshah — Thu, 26 Feb 2015 23:30:36 GMT

Hi Kkrause,

You can refer following document. Its for four LDAP profiles. Instead you can have one Local Database and one LDAP.

Using More than Four LDAP Servers in a Palo Alto Networks Configuration

Let me know if that helps.

Regards,

Hardik Shah

Re: How to use multiple authentication profiles for Global Protect VPN

kkrause — Fri, 27 Feb 2015 14:07:36 GMT

Thanks for the response. I implemented the Authentication Sequence and I can see in my logs that the VPN authentication attempt is occurring on both the local profile and the LDAP profile. However I have a username/password issue for this particular user account that I need to resolve. I'm absolutely 100% sure that the username and password I'm testing with is correct and the account is enabled....so I'll check again

Re: How to use multiple authentication profiles for Global Protect VPN

kkrause — Fri, 27 Feb 2015 14:08:58 GMT

Thanks for the response and additional documentation. It seems that the Authentication Sequence will take care of my needs.

Re: How to use multiple authentication profiles for Global Protect VPN

hshah — Fri, 27 Feb 2015 15:58:54 GMT

Hi KKrause,

Its top-down approach, first it check first method of authentication, if it doesnt authenticate than it go to next one. Let me know if this helps.

Regards,

Hardik Shah

Re: How to use multiple authentication profiles for Global Protect VPN

kkrause — Fri, 27 Feb 2015 21:35:13 GMT

I found my password problem. I had changed the Portal to use Auth Sequence but not the gateway. Once I put that in place I can now VPN with my AD users and with my local database users. Oh, the joy of learning a new platform!

Thanks to all for the help.