Allow only certain users through VPN Security Policy

cancel
Showing results for 
Search instead for 
Did you mean: 

Allow only certain users through VPN Security Policy

L2 Linker

Hi All,

How can I allow only certain users to use this policy from below? I am not able to do so at the moment using a local database (is it not achievable with a local database?). Currently, only when choosing 'any' will allow traffic through.

paragkarki143_0-1652249613154.png

@BPry 

1 ACCEPTED SOLUTION

Accepted Solutions

Cyber Elite
Cyber Elite

@paragkarki143,

Can you describe you actual configuration a bit more? Do the users authenticate too VPN with the local users? If they utilize the local users to authenticate to the VPN, as long as you have user-id enable on your VPN zone (and do make sure you do), then this should work without any issues. 

From what you've described you either aren't authenticating to the VPN as these local users so they aren't mapping, or you simply don't have your VPN security zone User-ID enabled (or included in your include networks). 

View solution in original post

2 REPLIES 2

Cyber Elite
Cyber Elite

Hi @paragkarki143 ,

Just to clarify:

- Users are able to connect to GlobalProtect (GP clients says "connected"), but no traffic is allowed?

- Stupid question but - you are sure that the local users are addedd to the local user group?

 

I would suggest to check the following:

- Connect the user with GP

- Connecting with SSH to FW, use the following command to list ip-to-user mapping.

> show user ip-user-mapping

- Find what IP address is associated with the test user that is currently connected to GP and check details for this IP

> show user ip-user-mapping ip <ip-address>

- Do you see anything listed under Grourp(s) in the output?

 

 

Cyber Elite
Cyber Elite

@paragkarki143,

Can you describe you actual configuration a bit more? Do the users authenticate too VPN with the local users? If they utilize the local users to authenticate to the VPN, as long as you have user-id enable on your VPN zone (and do make sure you do), then this should work without any issues. 

From what you've described you either aren't authenticating to the VPN as these local users so they aren't mapping, or you simply don't have your VPN security zone User-ID enabled (or included in your include networks). 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!