#Global Protect VPN

[VishwasAkbilwam]

Hi,

We are migrating to Global Protect VPN and we are looking to configure separate VPN profile for different departments like IT and Non-IT, contractors etc. 

I would like to check, for each Global Protect VPN profile for different departments, can we configure different authentication method for portal and gateways?

Is it possible to have different authentication methods to the same portal for different VPN profiles? For example, for our IT users we would like to have SSO authentication for portal where as for contractors working remotely we would like to have Radius authentication to the portal and gateway. 

Can we configure like above i explained?

Thanks

Vishwas

[TomYoung · Accepted solution]

Hi @VishwasAkbilwam ,

It sounds like you have 2 questions:  (1) separate authentication and (2) separate profiles.

For both, you will need to do LDAP group mapping.

For authentication, you can populate the Advanced tab under the Authentication Profile to only allow 1 group.  In this way, you will tie your groups to authentication methods.  For your portal and gateway, you can have an authentication sequence that goes through each authentication profile.  This should work as you desire.

For profiles, I assume that you mean client configuration.  You can populate the Agent tab under the gateway with multiple configs tied to the same LDAP user groups.  It is not necessary under the portal unless you want different gateways for different groups.  If the only purpose for different client configurations is for different security policies, this is not necessary.  Use one client config for all and use the same LDAP groups in your security policy to provide different access.

It is very important when matching users to groups that the format is consistent.  Please see this post -> https://live.paloaltonetworks.com/t5/general-topics/user-id-consistent-naming/m-p/522876.

Thanks,

Tom

[VishwasAkbilwam]

Thank you Tom, this is really good information.

I will try the solution.