topic Re: Global Protect PAN-OS 8.0 IP pools in General Topics

Global Protect PAN-OS 8.0 IP pools

GeorgiosFakis — Mon, 02 Sep 2019 07:24:12 GMT

Hi all ,

What is the workaround when you want to assign same IP pool but different access routes to groups or users on the same gateway ?

So let's say that on the gateway I have 2 or more groups like Group1 and Group2 but I have one IP pool to assign IPs when they are connected but in Group2 I want split tunnel and define specific access routes where Group1 I need to have full tunnel ?

I get this : dynamic ip pool overlapping

Re: Global Protect PAN-OS 8.0 IP pools

BatD — Mon, 02 Sep 2019 08:18:14 GMT

@GeorgiosFakis I haven't tested with 8.0, but in 8.1 and later you can use the "Client IP pool" tap at agent level, which applies to all groups.

Re: Global Protect PAN-OS 8.0 IP pools

GeorgiosFakis — Mon, 02 Sep 2019 08:32:56 GMT

Yes, that's true , in PAN-OS 8.1 you can do that but in 8.0 you cannot .Looking for a solution on 8.0 before I go to 8.1 next year.

Re: Global Protect PAN-OS 8.0 IP pools

Mick_Ball — Tue, 03 Sep 2019 06:03:53 GMT

Hows about splitting the scope into 2.

or increase mask to /23

default users 192.168.0.10-192.168.0.250

splitvtunnel. 192.168.1.10-192.168.1.250

Re: Global Protect PAN-OS 8.0 IP pools

GeorgiosFakis — Tue, 03 Sep 2019 07:17:55 GMT

I agree , but I have 32 groups that need split tunneling and I have 9 gateways so it means 9x32=288 subnets

Re: Global Protect PAN-OS 8.0 IP pools

Mick_Ball — Tue, 03 Sep 2019 09:46:35 GMT

OK gotya... but..

I'm not quite sure of what your end result needs to be... does each of your 32 groups require a different split tunnel config.

or would one split tunnel suit all (or most).

Re: Global Protect PAN-OS 8.0 IP pools

GeorgiosFakis — Tue, 03 Sep 2019 09:49:02 GMT

Each group different split tunnel .I think is one way to go to version 9 .

Re: Global Protect PAN-OS 8.0 IP pools

Mick_Ball — Tue, 03 Sep 2019 11:23:52 GMT

perhaps you are correct but it's killing me why you would need 32 different split tunnel configs ?

Re: Global Protect PAN-OS 8.0 IP pools

GeorgiosFakis — Wed, 04 Sep 2019 11:35:34 GMT

Because I have 32 set of AD groups that they have different split tunnel networks