Restrict VPN Users to certain applications

[jcalvert]

Is there a way to restrict some VPN users to only be able to access some applications (ports / servers)?

[Raido_Rattameister]

Absolutely.

Palo is using positive enforcement  model - everything that is not permitted is blocked by default.

Are your VPN using landing in dedicated VPN zone?

Best practice would be to permit based on users/groups what they need.

If you allow any then you have to block things that you don't want those specific users to access.

[BillyeMoore]

User ID and AD Groups is how we do it. 

The rule look like this take for example SSL only

NAME, SRC Zone=GlobalProtect, Source Address=IP Range of the GP Clients, Src User: DOMAIN\Group name, DestZone= Internal, Dest Address = Group things they need to access, Application=SSL, Service = Port if necessary.  ALLOW

[jcalvert]

This is very helpful.  We haven't implemented UserID yet, any way to do this with local users?

[Raido_Rattameister]

I assume that by VPN you mean GlobalProtect.

Sure you can use local users. GlobalProtect will identify users and you can see them in Monitor > Traffic under Source User Tab.