Restrict GP gateway selection to specific user groups via panorama

Showing results for 
Search instead for 
Did you mean: 

Restrict GP gateway selection to specific user groups via panorama

L0 Member

Due to some internal department/company shuffling we have a requirement to authenticate a specific subset of our user base via ldap only, bypassing our existing SAML setup. Reading other forum posts and Palo docs I've learned that once you enable SAML on a gateway that's pretty much all you can use, so I'm looking at setting up a secondary gateway for these specific users.


The issue I'm running into is that since Panorama is not able to directly query the Active Directory LDAP servers for group info I am unable to select any AD groups in the gateway agent configs section.





I was hopping that copy/pasting the entire ldap structure for the cn would allow it to show up properly on the managed firewall.




but that just shows up as a string on the actual firewall.



Does anyone have info on how to push this out through Panorama, or is this even possible?


L7 Applicator

Have you not selected a master device in your device groups.   or perhaps this does not work for gateways.





Or  hows about you just copy the group name from a firewall and paste into Panaorama.

We do have a master firewall set in Panorama and are currently pulling in groups for use in network policies. The system just does not appear to want to pull in the groups for GP settings.

L7 Applicator

OK i was not aware as only use panorama for objects and policies. 


Would copy and paste from a policy not work...  not ideal i know...

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!