global protect: keeping clientless vpn users seperate from remote access (vpn client) users


ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

L0 Member

global protect: keeping clientless vpn users seperate from remote access (vpn client) users

Here's what I need:

Employees using the global protect client, and vendors logging into clientless vpn and getting the apps I assign them.

I do not want any vendor to be able to access the vpn client.


Here's where I am:

I have a GP portal and gateway assigned to the outside interface. Remote access (employees) authenticates to radius server (ACS) and the people using the client can log in and work fine. Using the same GP portal I set up clientless and published apps and that works.



1. In the app publishing setup it has a section for authorizing who is authorized for which app group. Default shows my domain and "All Users" group in AD. Where is it getting that? If I'm using radius for authentication, the radius server authenticates and looks at a specific folder in AD but the palo wouldn't know that. I thought maybe it was using LDAP auth profile or something so I put in the full AD path (cn,ou,dc..etc) but that didn't work at all.


2. I don't know how to differentiate the employees and vendors if the radius server (ACS) policy is based on where the authentication traffic comes from. Both employee and vendor requests would originate from the same place and it won't know which is which.



I'm using ACS as a radius server but it then talks to our RSA server. We use dual factor authentication for anyone using VPN.

No straight LDAP authentication is allowed. However LDAP authorization after the 2 factor radius authentication would be fine.


Is there a design guide covering using remote access along side clientless access but keeping them seperate? Seems like this would be a very common design.


L4 Transporter



Thank you for contributing to the Education Help Center discussion board.  Since this is non-courseware, certification or Learning Center related technical question, I recommend contacting the Support team for assistance.


Hope this helps. 



Additional Contact Information

Please refer to the following contacts for general support related inquiries.

Request Contact Us


I need general information and an overview of Education programs offered by Palo Alto Networks, such as course descriptions and datasheets.

Community page

Learning Center

I have a question about using the Palo Alto Networks Learning Center.



I have a question about instructor-led training or an Authorized Training Center (ATC).


Onsite Training

I have a question about an onsite class at my location.



I have a question about Palo Alto Networks Certification exams.



I have a question about Palo Alto Networks Cyber Security Academy.