GlobalProtect access policies

[jeffrowan]

If I want different GlobalProtect VPN users to have access to different resources, do I need to create separate Gateways and have the GP license?

[sdurga]

Hi Jeff,

If you need different users to access different resources then please create different separate gateways and this doesn't require a GP license.

Thanks,

Sandeep T

[jeffrowan]

Okay, thanks.  So when I create a separate Gateway, should I be able to select the same interface and IP address for it?  I haven't been able to do that.  It's not an available choice.  I select the same interface but am not able to use the same IP address.  Basically I want the same configuration but with a smaller group of host to which the traffic will tunnel for different groups of users.  Is there any documentation that shows this kind of  configuration?  Thanks.

[sdurga]

This is expected. You cannot have two gateways with same IP address,you need two IP's. In your case I cannot think of anything which you can give different access to different hosts with one gateway. You can do this with two gateways but you are hitting the IP address problem with this option. 

[jeffrowan]

Okay, just so I'm clear about this.  I have one PAN firewall using one Untrust interface with an IP address.  The GlobalProtect VPN gateway configuration I have allows users to access an A.B.C.D/16 network on the Trust side of the firewall. 

But you're saying that there's no way to have another set of users use the GlobalProtect VPN to access a more limited set of hosts within that network, say A.B.C.D/24 or A.B.C.D/32.  Do I have that right?  Thanks again.

[sdurga]

I missed a whole point of the users !!my bad. You can do it with source users.

Create a Global protect gateway allow a A.B.C.D/16 network for all users.

Now create security policies based on users and in security policies you can allow certain users to reach certain hosts.