Global Protect Config from Outside Organization

[DEBARJD]

We are currently using Global Protect with the Portal and Gateway on the same firewall and interface, using SAML authentication through Okta with forced MFA.  We have a requirement to allow an outside contractor to connect to our VPN for access to a very specific resource.  Their authentication method is going to be unique and likely not use SAML....probably LDAP + CAC card.  What is the best way to achieve this?  My first thought was to create a secondary authentication profile on the portal, then at the gateway assign these users a unique IP range which I can control.  That doesn't seem like a great solution, as the first authentication profile brings up the embedded browser to authenticate to Okta.  Do I create second portal and gateway using a loopback interface on the same firewall and direct them there?  Any suggestions would be appreciated. 

[Claw4609 · Accepted solution]

Hello,

If you use SAML auth your can't use another authentication method on the same portal/gateway. Why not just set them up with a vendor/guest account in your Okta and have them log in with that and your MFA? Whats the need for then to authenticate against a different source? Does the Vendor want you to have your VPN authenticate against their authentication system?