GlobalProtect - Multiple Client Settings

[PT1559]

Following a change to move from LDAP (Local Domain Controllers) to Azure SAML with MFA enabled we are experiencing an issue with the use of multiple Client Settings Configs on a single Gateway.

We use the users section to identify a subset of users that only require RFC1918 IP ranges to traverse the VPN and all remaining users will hit the secondary config for all traffic to traverse the VPN.

Previously we would identify the users on the first config with the the following format - DOMAIN\USER.NAME

However since the change I believe users will be identified by the email address format - USER.NAME@DOMAIN.COM

I have changed this section to specify the email address format, however this is still not working and all users are hitting the secondary Config instead.

I have restarted the Management Server and rebooted the device.

I have also deleted the old LDAP configuration.

Please advise if you have run into this issue before and if you were able to find a resolution.

Thank you

[Claw4609]

Are you matching individual users or are you matching groups in your config? If you look in your firewall logs what is the user-id information coming across as? With Azure SAML would recommend setting up Palos Cloud Identity Engine 

Cloud Identity Engine (paloaltonetworks.com)

Configure the Cloud Identity Engine as a Mapping Source on the Firewall (paloaltonetworks.com)

[PT1559]

Hi,

This is done by individual username.

In the GlobalProtect logs the authentication is logged with the email address, however when the email address is specified on the configuration, this is still ignored and the secondary "ANY" configuration is used.

In Traffic logs, any traffic passing through the firewall via GlobalProtect the User-id showing in logs would be domain\user.name.

Thank you.