Restricting specific AD groups to only specific IP addresses on Globalprotect VPN
Showing results for 
Search instead for 
Did you mean: 

Restricting specific AD groups to only specific IP addresses on Globalprotect VPN

L1 Bithead

So I'm going to preface this with the fact that I am not a network admin.  Ours quit, so I was basically thrown this stuff.  I have only ever done webfiltering on the palo alto.

I got global protect vpn setup using the help of a system engineer.  We do the LDAP stuff for webfiltering and for vpn access.  Users have to be a member of a specific group to be able to connect.  That all works fine.

Problem is now they want me to set it up so that specific groups (other then just standard vpn users) are able to connect, but can only access certain things, mainly specific ip addresses.

How do I do that?  Sorry for the vagueness.  I've been thrown to the wolves and don't really know what I'm doing.


L7 Applicator

If you have the groups selected in group mapping "Group Include List" then simply add this group to the source user section of a policy.


I may have assumed too much here but if so then just let us know and we can go back a step or 2.



L7 Applicator

or 5, or 7.

L7 Applicator


If your ok with groups then you could do the following


User Groups.....

GP user group.   this group has all GP users in it. (you already use this for GP for connection)

GP server group. this group contains all users allowed to access servers.

GP FTP group. this group allows users to access ftp.


then create address objects for server IP's   and FTP IP's.


so GP portal will allow GP user group to connect.


Policy 1. allow GP server group access to server IP's

Policy 2 allow GP FTP group access to FTP IP's

Policy 3 allow GP user group access to all common factors, DNS, Internet etc...


Cyber Elite
Cyber Elite


Let us know how we can help! Here is a link to the admin guide for using user-id.


A lot of us use it extensively and can certainly help you out. The hardest thing is to remember the order of your policies so that it takes affect without getting denied.


Super high level steps:

Create your AD group in AD

Add AD group to PAN

Create policy that uses the AD group and specify destination such as Mick pointed out.



Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!