topic Re: Restrict VPN Users to certain applications in General Topics

Restrict VPN Users to certain applications

jcalvert — Fri, 08 Jun 2018 17:21:21 GMT

Is there a way to restrict some VPN users to only be able to access some applications (ports / servers)?

Re: Restrict VPN Users to certain applications

Raido_Rattameister — Fri, 08 Jun 2018 19:20:32 GMT

Absolutely.

Palo is using positive enforcement model - everything that is not permitted is blocked by default.

Are your VPN using landing in dedicated VPN zone?

Best practice would be to permit based on users/groups what they need.

If you allow any then you have to block things that you don't want those specific users to access.

Re: Restrict VPN Users to certain applications

Retired Member — Fri, 08 Jun 2018 19:38:49 GMT

User ID and AD Groups is how we do it.

The rule look like this take for example SSL only

NAME, SRC Zone=GlobalProtect, Source Address=IP Range of the GP Clients, Src User: DOMAIN\Group name, DestZone= Internal, Dest Address = Group things they need to access, Application=SSL, Service = Port if necessary. ALLOW

Re: Restrict VPN Users to certain applications

jcalvert — Fri, 08 Jun 2018 21:18:48 GMT

This is very helpful. We haven't implemented UserID yet, any way to do this with local users?

Re: Restrict VPN Users to certain applications

Raido_Rattameister — Fri, 08 Jun 2018 21:49:53 GMT

I assume that by VPN you mean GlobalProtect.

Sure you can use local users. GlobalProtect will identify users and you can see them in Monitor > Traffic under Source User Tab.