Restrict GP gateway selection to specific user groups via panorama

cancel
Showing results for 
Search instead for 
Did you mean: 

Restrict GP gateway selection to specific user groups via panorama

L1 Bithead

Due to some internal department/company shuffling we have a requirement to authenticate a specific subset of our user base via ldap only, bypassing our existing SAML setup. Reading other forum posts and Palo docs I've learned that once you enable SAML on a gateway that's pretty much all you can use, so I'm looking at setting up a secondary gateway for these specific users.

 

The issue I'm running into is that since Panorama is not able to directly query the Active Directory LDAP servers for group info I am unable to select any AD groups in the gateway agent configs section.

 

jjsimpson_0-1620934233088.png

 

 

I was hopping that copy/pasting the entire ldap structure for the cn would allow it to show up properly on the managed firewall.

 

jjsimpson_1-1620934447675.png

 

but that just shows up as a string on the actual firewall.

jjsimpson_2-1620934681139.png

 

Does anyone have info on how to push this out through Panorama, or is this even possible?

1 ACCEPTED SOLUTION

Accepted Solutions

L1 Bithead

Following back up here, I was on the right path with the full LDAP string in the users section.

 

tl;dr use the full LDAP query in the user/group setting in GP and DON'T enter the AD domain name in the group mapping settings.

 

Panorama does not pull the user/group info from LDAP in the GP section so a copy/paste of the LDAP query has to be manually entered. This can be pulled from the Policies tab as MickBall suggested.

 

The piece that was tripping me up is that we are using SAML for authentication and the user group mapping that was setup prior to myself working in the system had a manually defined domain in the user domain field using the FQDN. 

 

jjsimpson_0-1625594103563.png

 

Turns out this was not allowing the firewall to properly match the user account to the group for non-policy mappings. So policies would work just fine, but GP portal and gateway mapping never worked. Removing the domain altogether allowed not only the proper groups to be matched but also enabled Panorma to pull in all of the groups from AD.

 

 

View solution in original post

4 REPLIES 4

L7 Applicator

Have you not selected a master device in your device groups.   or perhaps this does not work for gateways.

MickBall_0-1620986133333.jpeg

 

 

 

Or  hows about you just copy the group name from a firewall and paste into Panaorama.

We do have a master firewall set in Panorama and are currently pulling in groups for use in network policies. The system just does not appear to want to pull in the groups for GP settings.

L7 Applicator

OK i was not aware as only use panorama for objects and policies. 

 

Would copy and paste from a policy not work...  not ideal i know...

L1 Bithead

Following back up here, I was on the right path with the full LDAP string in the users section.

 

tl;dr use the full LDAP query in the user/group setting in GP and DON'T enter the AD domain name in the group mapping settings.

 

Panorama does not pull the user/group info from LDAP in the GP section so a copy/paste of the LDAP query has to be manually entered. This can be pulled from the Policies tab as MickBall suggested.

 

The piece that was tripping me up is that we are using SAML for authentication and the user group mapping that was setup prior to myself working in the system had a manually defined domain in the user domain field using the FQDN. 

 

jjsimpson_0-1625594103563.png

 

Turns out this was not allowing the firewall to properly match the user account to the group for non-policy mappings. So policies would work just fine, but GP portal and gateway mapping never worked. Removing the domain altogether allowed not only the proper groups to be matched but also enabled Panorma to pull in all of the groups from AD.

 

 

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!