topic Global protect - multiple gateway on one IP in General Topics

Global protect - multiple gateway on one IP

Elhadi-KAOUA — Tue, 13 Jun 2017 12:28:31 GMT

Hello,

I just migrated from cisco ASA to Palo Alto.

Before, i used Cisco VPN Client (IPSec) and i managed to access to a network or host, or services by username. One security profile by local user.
For this fonctionnality, i used just 1 Public IP and 1 Private IP.

Is it possible to use many security profiles ( Resources Access ) by Global protect gateway or do I have to use one portal on one port (PAT), one dedicated gateway for each security profile?

I wish it's possible. I think, i'm not alone to have many users and many privileges?

Thanks in advance,

Olivier

Re: Global protect - multiple gateway on one IP

Remo — Wed, 14 Jun 2017 16:10:21 GMT

Hi @Elhadi-KAOUA

If I understand it correctly you simply want to restrict the acces for each user. This could be done very easy in the security policy where you're able to create user based rules to give every user only the needed access.

Re: Global protect - multiple gateway on one IP

willembrey-hardware — Wed, 14 Jun 2017 16:47:51 GMT

I have a use case where you would want to enforce no split tunnel and possibly no other internet access while connected with a profile to sensitive internal resources.

Additionally, you would want to offer a second profile with lower privileges with split tunnel for local internet access.

In this instance, the additional restriction for disabling split tunnel only when connecting to sensitive resources does not work with a single user-id and profile with user based rules. You need the ability to choose your access level and it seems the only way is to use different GP gateways - possibly on the same public IP depending how this is supported.

Re: Global protect - multiple gateway on one IP

Remo — Wed, 14 Jun 2017 17:52:10 GMT

Hi @willembrey-hardware

You're right. On the same gateway it is not possible to dynamically change the tunnel configuration when the same user tries to connect to sensitive ressources when he already was connected to ressources where you allow split tunneling. But with this use case it totally depends if you need this for computers under your control or for computers of my be external employees. For external computers where a user has local admin rights it is impossible to force this user for no split tunneling, because with his adminrights the user is able to manually overwrite the routing table and the "no-split-tunnel" configuration is useless.

If you still need to do this you have to set up multiple gateways, so the user is able to choose between different the different ones. I think it is possible to set up different gatways behind one public ip's (the trick is to use NAT and loopback interfaces) but I think then only SSL VPN is possible.