topic Re: Limting Globalprotect client access via IP address in General Topics

Limting Globalprotect client access via IP address

craig.brooker — Thu, 30 Mar 2017 13:54:39 GMT

Is there a way to allow specific GlobalProtect users to only connect from specific public IP addresses? For example say I only wanted to allow user1 to connect from IP address 1.1.1.1, and if user1 connects from any other public IP address, or if user2 is trying to access from 1.1.1.1, to have that access be denied?

Re: Limting Globalprotect client access via IP address

BPry — Thu, 30 Mar 2017 20:00:11 GMT

I can't really think of a clean way of doing this. The only way that you could limit the public IP to my knowledge is limit who can connected to a specified gateway and then assign the required public IP an access policy that would allow only them to get to the gateway IP. This of course would mean that you would have to have a gateway for any user that you wished to limit in this way.

Re: Limting Globalprotect client access via IP address

ansharma — Thu, 30 Mar 2017 20:02:20 GMT

Hi Craig,

No such option exists yet. The only thing (and is broader than what's asked) would be to allow select few IPs in the Security policies but it wouldn't have a user<-->IP pairing.

Regards,

Anurag

Re: Limting Globalprotect client access via IP address

Remo — Sun, 28 May 2017 11:59:17 GMT

As @BPry and also @ansharma there's no clean way to it.

But in addition to the solition of @BPry, there is may be another (really) unconventional way: Captive Portal. You could allow access to the global Protect Gateway only for your specific user, which will be presented the captive portal login form when he tries to connect with a browser. It also depends on the fact if you have the portal on the same device or on another (it would also work on different devices with user-id-redistribution) because this is probably the only valid website where you can put the captive portal in front of (as I assume you only want to limit the GP access and not access to other ressources which are may be in your DMZ)