Hello, Just a quick background on my question... We are beginning to implement Palo Alto firewalls in our data center, and we want to start using them for SSL VPN connections. We have already gone through the basic setup process and have the SSL VPN connection working with our test group, which is mapped via LDAP and User ID. Now that this is set up, we want to tighten security around our setup. Specifically, we want to be able to start restricting what access people have when the VPN through the Palo Altos. For instance, one department should only be able to access a specific subnet, while another department may be able to access none or multiple subnets. I have read into two possible solutions: multiple gateways and security policies. However, I wanted to get your opinion on the matter and determine which is better, which is worse, which one makes more sense, other options I should consider, and any other information or recommendations people may have. Aside from that, I have two related questions as well that goes into VPN setup. Under the VPN gateway in the Client Configuration tab, what does Access Route do? If I specify a subnet in that area, does this mean I can only access that particular subnet when I VPN in? Secondly, not sure if its possible, but can you have multiple gateways with the same IP address, but set it up so that it maps to specific AD groups? Just an idea I was throwing around in my head with the multiple gateway solution to see if I can do that to restrict access that way. Any help is greatly appreciated. Thanks, Mark
... View more
