topic Re: GP for many external clients in General Topics

GP for many external clients

mslcadmin — Tue, 16 May 2017 12:46:21 GMT

Does anyone have a good solution/setup for providing external clients with VPN access? Not regular users/company employees.

We need to be able to provide these external clients access to different resources internally. IE webpages, server access using RDP etc. We would like to tie this into AD also. I would prefer not to have to create a gateway/portal for each and every vendor/client. Almost need a way to do some sort of mapping based on AD username or groups using one gateway/portal.

Thanks

Re: GP for many external clients

Raido_Rattameister — Tue, 16 May 2017 12:51:21 GMT

How many is many and what blocks you using single gateway and limit access with Security Policies?

Re: GP for many external clients

mslcadmin — Tue, 16 May 2017 13:56:29 GMT

Maybe 30-50 right now and can/will probably grow.

I'm new to Palo, so there might be away as you suggested single gateway, just not sure how to do it. Any documentation etc on it?

Currently we have GP setup for our employess using machine certs, AD and a few other checks. But I don't want to touch that as it is working nicely.

Thanks

Re: GP for many external clients

Raido_Rattameister — Tue, 16 May 2017 17:45:56 GMT

Hey if your internal users use cert and 3rd parties not then set up 2 gateways.

In portal config you can point users in 3rd party Active Directory group to 3rd party gateway.

Place tunnel interface of 3rd party into seperate zone to make security policy setup easier.

Allow traffic from 3rd-party-globalprotect zone only to limited destinations. Based on source user you can permit specific users to specific resources.