SSL VPN - DHCP Relay and Deny lists

[jdorland]

Is there a way to configure the SSL VPN to rely on DHCP relay instead of using it's own internal IP pool?  I thought enabling it on the public interface might work, but I don't really like the thought of anyone in that same segment getting one of our private IP addresses.

Also, is there a way to explicitly deny a user or group access to the SSL VPN even if they are a member of an allowed group?

[swhyte · Accepted solution]

You asked:

Is there a way to configure the SSL VPN to rely on DHCP relay instead of using it's own internal IP pool?

Currently, there is no way to do this on the Paloalto device.

You asked:

Also, is there a way to explicitly deny a user or group access to the SSL VPN even if they are a member of an allowed group?

Yes you can. Simply make note of the zone that you have placed the tunnel interface for the ssl vpn. Then you can  create deny policies with that zone as the destination zone and identify corresponding source zones, source users, source ips that you would like to deny access to the ssl vpn portal......basically, the same way that create any other deny policy.