Global Protect and User-ID

[GeorgePalo]

I want to make my GP portal more secure by adding User-ID to my GP inbound rule so that only users in the AD group can authenticate.

At the moment source user is just set to 'any' and the VPN is working fine.

When I add the group as in the attached image it breaks. I'm guessing there are some extra configuration steps i'm missing here...

Note that the group mapping is working fine in other rules once users are authenticated. I'm just wondering if I can utilise user-id at the first step in the authentication process.

[BPry · Accepted solution]

@GeorgePalo,

Ya by default this wouldn't work. The problem is that your firewall doesn't know who the user is when a user is attempting to connect from untrust to your GlobalProtect portal/gateway. So the SSL_VPN_IN is never going to be matched and you'll always hit the Block-In entry. For this to work, you would need to tie it with an authentication rulebase entry to feed unidentified users attempting to access GlobalProtect and have them login so that they actually have a user-id mapping on their public IP so they match your SSL_VPN_IN entry. 

I honestly don't recommend you try do anything like this. Let your GlobalProtect Portal do it's job of authenticating the users. If you want to secure it as much as possible, restrict access to regions that you expect/allow users to work from and setup an automatic block for the source address after X number of GlobalProtect authentication failures. 

[GeorgePalo]

Yeah that makes sense.

Do you have any more information about how to set the number of authentication failures before lockout on the portal?

Thanks,

[Mick_Ball]

As an alternative you can use the portal agent to only allow selected users to connect, 

if you are not in the AD group you will get this message,,