topic Re: GlobalProtect Authentication with both Active Directory and local accounts in General Topics

GlobalProtect Authentication with both Active Directory and local accounts

Naelwan — Thu, 10 Aug 2017 16:06:58 GMT

Hello,

I'm deploying a GlobalProtect VPN and I'm facing a problem in the Authentication.

I have both LDAP and Local authentication profile that are configured and I want to be able to connect with either an account in the Active Directory or the local database.

The problem is in the Gateway configuration, in the Authentication tab, I put both of my authentication profiles but only the 1st one is used. If the 1st is the local Authentication profile, I'm able to connect only with local accounts. If the 1st one is the LDAP Authentication profile, only with Active Directory accounts.

Is there something I am doing wrong or is it just the normal behavior of the Gateway ?

Nael

Re: GlobalProtect Authentication with both Active Directory and local accounts

Raido_Rattameister — Thu, 10 Aug 2017 16:10:53 GMT

Device > Authentication Sequence

Apply sequence as auth profile.

Re: GlobalProtect Authentication with both Active Directory and local accounts

Remo — Thu, 10 Aug 2017 16:12:49 GMT

Hi @Naelwan

If you use an authentication sequence it is possible to use both local and AD.

In the authentication sequence you can add the local and the LDAP authenticarion profile. These profiles will then be checked, as the name already says, in sequence. So if you have AD first, then this will be checked. If there is no user with the entered name or the password is wrong, then the second, local profile, will be checked to authenticate the user.

Re: GlobalProtect Authentication with both Active Directory and local accounts

Naelwan — Thu, 10 Aug 2017 17:07:10 GMT

Thanks @Raido_Rattameister & @Remo !