topic Re: VPN CLIENT GLOBAL PROTECT, MANAGED WITH LDAP GROUPS in General Topics

VPN CLIENT GLOBAL PROTECT, MANAGED WITH LDAP GROUPS

FWTECNOFORM — Mon, 08 Apr 2019 13:41:13 GMT

Hello, I have a problem.

I just inherited a palo alto firewall.

I noticed that given a specific certificate and given the global protect client, every user of the ldap server can connect to the vpn.

I would like that only users in specific ldap groups could enter.

Let's say the groups come from active directory.

"domain"\user_group_allowed

"domain"\user_group_allowed_limited

how can I do that?

right now everyone on "domain" can open a vpn tunnel.

Could it be that what I'm looking for is under:

Device > Authentication Profile > Advanced > Allow list

and that I should Add the ldap groups there instead of "All" ?

Kindest Regards

Re: VPN CLIENT GLOBAL PROTECT, MANAGED WITH LDAP GROUPS

Mick_Ball — Mon, 08 Apr 2019 12:27:32 GMT

firstly, configure device\server profile\ldap with the required permissions

then, configure device\user identification\group mapping settings.

here you can add the groups that you want to use.

then, network\portals and in the agent\configs you can add the 2 groups, one to each config.

this will allow users in both groups to use the VPN but you can then add security policies for each group to either restrict or allow access to the network.

Re: VPN CLIENT GLOBAL PROTECT, MANAGED WITH LDAP GROUPS

BPry — Mon, 08 Apr 2019 12:33:53 GMT

@FWTECNOFORM,

Since you're saying that you just encountered the environment I would hold off on any access changes until you get a solid understanding of why it was configured in the way it was. Often in a new environment I see a lot of engineers make "big" changes as far as end-users are concerned, and that can be a massive turnoff from your users.

Find out what the users are connecting to and why. It could be that you simply need to utilizes Agent Configs on your gateway to seperate out the users in groups. One group might just get permission to remote into their computers, or potentially simply access email remotely; another group might rightfully need access to additional resources while working remotely.

Re: VPN CLIENT GLOBAL PROTECT, MANAGED WITH LDAP GROUPS

FWTECNOFORM — Mon, 08 Apr 2019 14:15:46 GMT

"then, configure device\user identification\group mapping settings.

here you can add the groups that you want to use."

Thank you very much.

How can I "then, network\portals and in the agent\configs you can add the 2 groups, one to each config."

should I select the portal

then click agent

then click the config

then under user user groups add the two ldap groups?

Re: VPN CLIENT GLOBAL PROTECT, MANAGED WITH LDAP GROUPS

Mick_Ball — Tue, 09 Apr 2019 07:53:40 GMT

should I select the portal

then click agent

then click the config

then under user user groups add the two ldap groups?

yes you can do that, or you can add config-1 and add group1

then add config-2 and add group2

i do a seperate config most of the time as i also use this to direct different groups to different gateways.

you can also use this to give users different portal configs.

so group-1 (std users) could have the portal nailed down

group-2 (admin users) could have the portal unrestricted and an extra couple of gateways....

if yours is just for network access restrictions then just use the same portal config.

perhaps if you explain what the difference is between groups then i could advise further but please note @BPry 's comments.

Re: VPN CLIENT GLOBAL PROTECT, MANAGED WITH LDAP GROUPS

FWTECNOFORM — Wed, 24 Apr 2019 08:31:44 GMT

Hmm, I'm doing something wrong.

I get this message: "user is not authorized to connect to Global Protect Portal."

Re: VPN CLIENT GLOBAL PROTECT, MANAGED WITH LDAP GROUPS

Mick_Ball — Wed, 24 Apr 2019 08:45:07 GMT

in monitor/system it will show the username that is denied.

then in cli, show user group list

then in cli , show user group name "one of the groups from above" to make sure that user is deffo in that group.

it may be domain info mising so add the following to the portal/agent/config/user/user group to test.

firstly add user on its own fred smith

then if that fails, try domain\fred smith

Re: VPN CLIENT GLOBAL PROTECT, MANAGED WITH LDAP GROUPS

FWTECNOFORM — Wed, 24 Apr 2019 09:24:47 GMT

A: ok firstly, configure device\server profile\ldap with the required permissions

B: that seems fine

A:then, configure device\user identification\group mapping settings.

b:I added to the group include list the group domain\allowed_full

A: here you can add the groups that you want to use.

A: then, network\portals and in the agent\configs you can add the 2 groups, one to each config.

B: network\portals and in the agent\configs user/user group i added the group domain\allowed_full

A: this will allow users in both groups to use the VPN but you can then add security policies for each group to either restrict or allow access to the network.

A:in monitor/system it will show the username that is denied.
then in cli, show user group list
then in cli , show user group name "one of the groups from above" to make sure that user is deffo in that group.
it may be domain info mising so add the following to the portal/agent/config/user/user group to test.
firstly add user on its own fred smith
then if that fails, try domain\fred smith

B: The user is in the group, the check in the cli confirmed it. but I'm still getting "You are not authorized to connect to GlobalProtect Portal.", I can see the error in the monitor/system and it says: GlobalProtect portal client configuration failed. Login from: my_ip, Source region: IT, User name: test.

If I roll back to my previous configuration, user Test can log just fine.

Re: VPN CLIENT GLOBAL PROTECT, MANAGED WITH LDAP GROUPS

Mick_Ball — Wed, 24 Apr 2019 09:33:50 GMT

going back to the beginning...

could you confirm if you are still using certificate authentication.

Re: VPN CLIENT GLOBAL PROTECT, MANAGED WITH LDAP GROUPS

FWTECNOFORM — Wed, 24 Apr 2019 09:35:03 GMT

yes I am.

Re: VPN CLIENT GLOBAL PROTECT, MANAGED WITH LDAP GROUPS

Mick_Ball — Wed, 24 Apr 2019 09:49:19 GMT

have you tried adding both usernames directly to the portal agent.

1, test

2, domain\test

Re: VPN CLIENT GLOBAL PROTECT, MANAGED WITH LDAP GROUPS

Mick_Ball — Wed, 24 Apr 2019 10:52:58 GMT

can you post a screenshot of portal/agent/user/user group, group mapping include, output from show user group name?

Re: VPN CLIENT GLOBAL PROTECT, MANAGED WITH LDAP GROUPS

Mick_Ball — Wed, 24 Apr 2019 11:31:47 GMT

and a screenshot of certificate profile

Re: VPN CLIENT GLOBAL PROTECT, MANAGED WITH LDAP GROUPS

Mick_Ball — Wed, 24 Apr 2019 11:47:44 GMT

And.......

make sure you have the domain name in the certificate profile "user domain" field.

Re: VPN CLIENT GLOBAL PROTECT, MANAGED WITH LDAP GROUPS

FWTECNOFORM — Sun, 07 Jul 2019 13:59:27 GMT

the issue seemed to be a wrong domain name under /device/authentication profile/authentication/user domain.

Re: VPN CLIENT GLOBAL PROTECT, MANAGED WITH LDAP GROUPS

MarkWalters — Thu, 24 Jun 2021 18:38:43 GMT

That was it for me also. @Mick_Ball thank you for walking me through the tshooting steps.