Assign Fixed IP Address to Global Protect Users with ldap+radius

[N2Z2]

Hi all,

I've tried to assign a static ip address to global protect connection using this kb https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UkxCAE but it doesn't work.

The support says that if we have ldap auth for username/password and radius authentication for 2fa it can't work.

If this method really can't work, I've set the registry key as explained here https://docs.paloaltonetworks.com/globalprotect/4-1/globalprotect-app-new-features/new-features-rele...

But this static ip is defined on the client, so the firewall could have already set this ip to another user.

Is correct to define an ip pool different from the network of the static ip address? It seems working but just to know if anyone has done this configuration before.

For example:

- ip pool 192.168.100.0/24

- fixed ip address 192.168.101.1

I think that 

- if a user doesn't have the registry key, it will take an address of the pool 192.168.100.0/24

- if a user has the key set, can take the address set in the registry key without having override problem

Is that correct?

Thanks!