Hi All, Setup - We got 2 PA clusters with a leased line between them, joining two offices of the same company. - Both offices have their own AD, servers, ... - We have GlobalProtect configured on both devices. - We have PanOS User-Id configured (so no agent) on both devices - We have a user based security rule providing a "support" user access to certain devices. => This is all working fine, but only if we use each offices his local GlobalProtect connection. In other words, we can only reach servers in office A if we login to the GlobalProtect of office A. Goal - We now want to be able to GlobalProtect to office A, but reach servers on office B, with user restriction (this last part is the important part). Problem - When we create a rule on the PA of office B, to allow access from connection coming from office A to certain servers, the PA of office B does not know the user since it was authenticated via GlobalProtect on the PA of office A. Hence, we can not create user based security rules. Solution? - Either give the GlobalProtect "support" user a fixed IP (that way we can work IP based instead of user based). But this is not possible I think, only by creating a separate portal + gateway? - Passing on the user-ip mapping from office A to office B. But we only want the user-ip info of the GlobalProtect users (which are local users: same user exist on both devices). Is this possible, and if yes, how do we configure this? Kind regards
... View more
