Configuring PA-500 - separate access to to different IP addresses

[milan_avnet]

Hello All,

I hope that you can help me with one, I would say, common task but I'm unable to find right answer to this.

We are using PA-500 and behind it, there is 5 servers. We also using Global Protect for accessing to servers.
I need to setup on PA-500 that one specific user need to access only to one specific server, while all other users can access to all servers. I know that should be simple, but I'm stuck with it. I can't find any similar information either in documentation either here.

Any help would be highly appreciated.

Thanks in advance for any help.
Milan

[BPry]

If you have user identification enabled you can just setup the user as having access to the one server that you actually want them to access by identifying the user in a new rule and putting it above the one in place to allow the GP users access to all of the servers.

Alternatively if you don't have user-id then you could statically give the one user a specific IP address and set a rule that allows that user access to the one server and all other IPs in the GP pool have access to the other servers.