GlobalProtect - Multiple Gateways on One IP Address

[BTG-charlie]

Good day,

Our PA-500 is currently on PANOS 7.0.5-h2. We want to configure GlobalProtect - Multiple Gateways using the same IP Address. Is this possible?

We tried to follow the instructions here:    http://dsg0.com/t/palo-alto-networks-globalprotect-with-multiple-gateways-on-one-ip-address/122       but we are getting an error that the GlobalProtect client cannot connect to XX.XX.XX.XX:1111 or XX.XX.XX.XX:2222 or XX.XX.XX.XX:3333.

Any help would be great. Thanks!

BTG-charlie

[BPry]

Any reason why you are trying to follow that guide in particular? This was more of a 'hack' to get around the licensing requipments up until 7.0.0. 

Really I think that at this point you should be looking to customize your network settings on the client configuration if you are doing this for security reasons. You can assign different users different IP pools and create security policies and access routes based on the username recieved from the portal. Therefore you could have Employees recieve 172.16.1.0 and Contractors at 172.16.2.0 and IT staff at 172.16.3.0 and just build out rules based on that, all while utilizing one gateway. 

[OtakarKlier]

Or AD groups instead of IP ranges, but either will work.

[BTG-charlie]

Hi BPry and Otakar.Klier,

We aim to configure different Authentication Profiles option (LDAP & RADIUS) to the same set of users. We also aim to provide SplitTunnel config and FullTunnel config to the same set of users. The aim is to produce a total of 4 available Gateway choices to users as follows:

          a.   LDAP - SplitTunnel

          b.  LDAP - FullTunnel

          c.  RADIUS - SplitTunnel

          d.  RADIUS - FullTunnel

All of the 4 configuration above will apply to the same set of users and will only be available to One IP Address.

Is this possible?

[BrianRa]

BTG-charlie,

The creating of these profiles is possible all within the same Global Protect Portal and Global Protect Gateway.  We are doing this.

Domain users - full tunnel, limited internal network access, HIP checks, OS based

Domain admins - full tunnel, all internal networks access, HIP checks, OS based

Domain vendors - split tunnel, specific internal network access, no HIP checks, OS based

Firewall user vendors - split tunnel, specific internal network access, no HIP checks, OS based

Mobile domain users - split tunnel, specific internal access, HIP checks, iOS based

(each of these groups is provided a separate 1918 space IP range for easier Security Policy management)

The only part that you stated that worries me is doing different connection types with the same users.  We are basing this on OS type and user credentials (security groups, firewall groups, or specific users).  You will not be able to have one user that can log in using the same computer/device and the same user credentials to different VPN groups/profiles on the same IP using one portal/gateway or multiple portals/gateways.  A HIP check will also not help with this as it is a pass/fail criteria and does not allow you to move down to the next connection in the list.

If you go to Network -> Global Protect -> Portals -> GP_Profile -> Agent -> this is where you will create all the profiles I listed above.

The same is the case for Network -> Global Protect -> Gateways -> GP_Profile -> Agent -> Client Settings -> match the profiles created in the Portals.

Once both of those are created you will use Security Policies to control the access that the VPN clients get.  Again we do this based on VPN IP, Domain Security Groups, Firewall Groups, Users, and HIP checks.

Hope that is helpful.

Brian