GlobalProtect Authentication with both Active Directory and local accounts

[Naelwan]

Hello,

I'm deploying a GlobalProtect VPN and I'm facing a problem in the Authentication.

I have both LDAP and Local authentication profile that are configured and I want to be able to connect with either an account in the Active Directory or the local database.

The problem is in the Gateway configuration, in the Authentication tab, I put both of my authentication profiles but only the 1st one is used. If the 1st is the local Authentication profile, I'm able to connect only with local accounts. If the 1st one is the LDAP Authentication profile, only with Active Directory accounts.

Is there something I am doing wrong or is it just the normal behavior of the Gateway ?

BR

Nael

[Raido_Rattameister · Accepted solution]

Device > Authentication Sequence

Apply sequence as auth profile.

[Remo · Accepted solution]

Hi @Naelwan

If you use an authentication sequence it is possible to use both local and AD.

In the authentication sequence you can add the local and the LDAP authenticarion profile. These profiles will then be checked, as the name already says, in sequence. So if you have AD first, then this will be checked. If there is no user with the entered name or the password is wrong, then the second, local profile, will be checked to authenticate the user.

[Naelwan]

Thanks @Raido_Rattameister & @Remo !