topic Re: Split tunnel greyed out in General Topics

Split tunnel greyed out

FarzanaMustafa — Mon, 08 Apr 2019 03:25:41 GMT

Hello,

We are using PANOS 8.1.7 and GP 4.1.8.

We have multi Vsys and one of our VSYS administrator account cannot access GP protect agent split tunnel setup.

It is greyed out.

Is this an account limit or something wrong?

Re: Split tunnel greyed out

Remo — Mon, 08 Apr 2019 06:57:43 GMT

Hi @FarzanaMustafa

Is "Tunnel Mode" enabled on this GP Gateways Agent settings tab?

Re: Split tunnel greyed out

FarzanaMustafa — Mon, 08 Apr 2019 07:11:42 GMT

Hi @Remo

YES.

Re: Split tunnel greyed out

Remo — Mon, 15 Apr 2019 19:56:51 GMT

Hmn ... does your vsys administrator have the permission to change this? Do you have other administrators with thw same permission where this is possible to change?

Re: Split tunnel greyed out

FarzanaMustafa — Mon, 15 Apr 2019 22:53:03 GMT

Hi @Remo

PA TAC assisted us to confirm that this is an expected behaviour.

++ As superuser admin, configured global protect portal and gateway.
++ Also created another vsysadmin.
++ Logged in as the vsysadmin, and was unable to modify Gateway config, specifically anything related to network was grayed out.
++ According to documents:
vsysadmin—Has access to specific virtual systems on the firewall to create and manage specific aspects of virtual systems.
A vsysadmin doesn’t have access to network interfaces, VLANs, virtual wires, virtual routers, IPSec tunnels, DHCP, DNS Proxy, QoS, LLDP, or network profiles.
Person with vsysadmin permission can commit configurations for only the virtual systems assigned to them.
++ As such, any GP config related to above will just be read-only for the vsys admin. This is expected behavior.
++ Reference: https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-admin/virtual-systems/virtual-systems-overview/administrative-roles-for-virtual-systems