Geolocation ip address blocking | Different access for different user groups

[MarkusMix]

Hallo,

I am new in PA matter, coming from Fortinet / Cisco (regarding to Firewall / UTM matter)  and like to know if it is possible to have different geo location ip blocking restrictions / rules for the same service. 

e.g. Access with Global Protect VPN 

- Usergroup A: Only access with GP from Germany

- Usergroup B: Access with GP from whole Europe

Thanks all for reading and thinking about it

Best regards,

Markus

[Mick_Ball]

@MarkusMix  if you take a look at this link then yes it should be doable from V8.

i did have a play but was adding my own regions, seemed  pointless in the end as all our UK wifi is natted to the same IP...

anyhows... take a look here...

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-new-features/globalprotect-features/external-gat...

[MarkusMix]

@Mick_Ball  I´ll test that but this is only for gp.

I guess for special web addresses, which we do host in DMZ, this is not possible, right?

[Mick_Ball]

for a web hosted in your DMZ, yes this is possible without GP.

create a security policy and add the region to the source address. you can also mix this with user groups, zones, applications etc...

[MarkusMix]

User-ID on outside interface?

[Brandon_Wertz]

---

@MarkusMix wrote:

User-ID on outside interface?

---

Is a very risky and dangerous idea.  There have been vulnerabilties in the past about exploiting the user-id process (I think in ver 6 code) and the main factor was an admin had to enable user ID process on an externally facing zone.