ASK: GP with 2 network access

[cragasyah]

Hi All,

Anyone have tried to create 2 network access within PAN-GP on PANOS 6.1?

So, basically I want to create 2 PAN-GP Profile, one with split-tunnel, another one without split tunnel.

Already read some article, said that I'll need PAN-GP license and 2 External IP.

So, have someone tried this? Thanks in advance

[reaper]

you won't need the license if you're on PAN-OS 7.0 or later : About GlobalProtect Licenses

you'll need 2 gateways if you want your users to be able to switch between split/non-split manually, but if you want to base the split/non-split on user group membership (eg. users dont get split, admins and support staff get split) you can simply add 2 'Client Settings' profiles in the gateway and set a usergroup for each

or you can have each gateway act for a specific user group, if you want to add additional features to each gateway (MFO, SSO, always-on, HIP, ...)

[cragasyah]

Hi Reaper, thank you for your advise.

I'm using PAN-OS 6.1, and currently i only have CLI access instead GUI. With CLI access, in 6.1, i can't create two clients, hehe .. but let me try your advise, and update here once resolved.

Once again, thank you

[cragasyah]

Confirmed. PANOS 6.1 has a limitation with multiple 'profile' at Global Protect. Started with PANOS 7.0.1, GP support multiple 'profile' at their Global Protect