global protect: keeping clientless vpn users seperate from remote access (vpn client) users


Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.

L0 Member

global protect: keeping clientless vpn users seperate from remote access (vpn client) users

Here's what I need:

Employees using the global protect client, and vendors logging into clientless vpn and getting the apps I assign them.

I do not want any vendor to be able to access the vpn client.


Here's where I am:

I have a GP portal and gateway assigned to the outside interface. Remote access (employees) authenticates to radius server (ACS) and the people using the client can log in and work fine. Using the same GP portal I set up clientless and published apps and that works.



1. In the app publishing setup it has a section for authorizing who is authorized for which app group. Default shows my domain and "All Users" group in AD. Where is it getting that? If I'm using radius for authentication, the radius server authenticates and looks at a specific folder in AD but the palo wouldn't know that. I thought maybe it was using LDAP auth profile or something so I put in the full AD path (cn,ou,dc..etc) but that didn't work at all.


2. I don't know how to differentiate the employees and vendors if the radius server (ACS) policy is based on where the authentication traffic comes from. Both employee and vendor requests would originate from the same place and it won't know which is which.



I'm using ACS as a radius server but it then talks to our RSA server. We use dual factor authentication for anyone using VPN.

No straight LDAP authentication is allowed. However LDAP authorization after the 2 factor radius authentication would be fine.


Is there a design guide covering using remote access along side clientless access but keeping them seperate? Seems like this would be a very common design.


L4 Transporter



Thank you for contributing to the Education Help Center discussion board.  Since this is non-courseware, certification or Learning Center related technical question, I recommend contacting the Support team for assistance.


Hope this helps. 



Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!