global protect: keeping clientless vpn users seperate from remote access (vpn client) users

[daveshreve]

Here's what I need:

Employees using the global protect client, and vendors logging into clientless vpn and getting the apps I assign them.

I do not want any vendor to be able to access the vpn client.

Here's where I am:

I have a GP portal and gateway assigned to the outside interface. Remote access (employees) authenticates to radius server (ACS) and the people using the client can log in and work fine. Using the same GP portal I set up clientless and published apps and that works.

Problem:

1. In the app publishing setup it has a section for authorizing who is authorized for which app group. Default shows my domain and "All Users" group in AD. Where is it getting that? If I'm using radius for authentication, the radius server authenticates and looks at a specific folder in AD but the palo wouldn't know that. I thought maybe it was using LDAP auth profile or something so I put in the full AD path (cn,ou,dc..etc) but that didn't work at all.

2. I don't know how to differentiate the employees and vendors if the radius server (ACS) policy is based on where the authentication traffic comes from. Both employee and vendor requests would originate from the same place and it won't know which is which.

Note:

I'm using ACS as a radius server but it then talks to our RSA server. We use dual factor authentication for anyone using VPN.

No straight LDAP authentication is allowed. However LDAP authorization after the 2 factor radius authentication would be fine.

Is there a design guide covering using remote access along side clientless access but keeping them seperate? Seems like this would be a very common design.

[jamesyim]

Hello,

Thank you for contributing to the Education Help Center discussion board.  Since this is non-courseware, certification or Learning Center related technical question, I recommend contacting the Support team for assistance.

Hope this helps. 

James