topic Re: Restricting specific AD groups to only specific IP addresses on Globalprotect VPN in General Topics

Restricting specific AD groups to only specific IP addresses on Globalprotect VPN

GregoryClark — Wed, 13 Nov 2019 15:53:57 GMT

So I'm going to preface this with the fact that I am not a network admin. Ours quit, so I was basically thrown this stuff. I have only ever done webfiltering on the palo alto.

I got global protect vpn setup using the help of a system engineer. We do the LDAP stuff for webfiltering and for vpn access. Users have to be a member of a specific group to be able to connect. That all works fine.

Problem is now they want me to set it up so that specific groups (other then just standard vpn users) are able to connect, but can only access certain things, mainly specific ip addresses.

How do I do that? Sorry for the vagueness. I've been thrown to the wolves and don't really know what I'm doing.

Re: Restricting specific AD groups to only specific IP addresses on Globalprotect VPN

Mick_Ball — Wed, 13 Nov 2019 16:15:30 GMT

If you have the groups selected in group mapping "Group Include List" then simply add this group to the source user section of a policy.

I may have assumed too much here but if so then just let us know and we can go back a step or 2.

Re: Restricting specific AD groups to only specific IP addresses on Globalprotect VPN

Mick_Ball — Wed, 13 Nov 2019 16:16:29 GMT

or 5, or 7.

Re: Restricting specific AD groups to only specific IP addresses on Globalprotect VPN

Mick_Ball — Wed, 13 Nov 2019 16:41:58 GMT

If your ok with groups then you could do the following

User Groups.....

GP user group. this group has all GP users in it. (you already use this for GP for connection)

GP server group. this group contains all users allowed to access servers.

GP FTP group. this group allows users to access ftp.

then create address objects for server IP's and FTP IP's.

so GP portal will allow GP user group to connect.

Policy 1. allow GP server group access to server IP's

Policy 2 allow GP FTP group access to FTP IP's

Policy 3 allow GP user group access to all common factors, DNS, Internet etc...

Re: Restricting specific AD groups to only specific IP addresses on Globalprotect VPN

OtakarKlier — Wed, 13 Nov 2019 23:19:19 GMT

Hello,

Let us know how we can help! Here is a link to the admin guide for using user-id.

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface-help/user-identification/device-user-identification-group-mapping-settings.html

A lot of us use it extensively and can certainly help you out. The hardest thing is to remember the order of your policies so that it takes affect without getting denied.

Super high level steps:

Create your AD group in AD

Add AD group to PAN

Create policy that uses the AD group and specify destination such as Mick pointed out.

Regards,