About Andrew.Vernon

That traffic isn't even making it far enough to have security rules applied. We have our VPN subnets in their own zone and no intrazone traffic is being logged.    But, looking at the routing table, I only see a /32 for my own GP IP address. Subnets in my split-tunnel address group appear with the agent virtual IP as the next hop. That suggests that I may need to add the client address block to the split-tunnel. ... View more

For the Authentication Enforcement Object (Objects > Authentication), I found creating a shared object (one used across all device groups) made the authentication profiles invisible. When I created the AEO in the device group covered by that particular template stack, the profiles were available to select. This occurred because I was using Panorama for device management. I'd have to walk back through the exercise on a stand-alone device to see if there's a similar distinction between the device level shared context and a specific vsys. (I only have single instances on my firewalls, so nothing really needs to be "shared.") It's not exactly as @reaper suggested, but their suggestion took me to the right place.   I'm skipping the authentication policy step since further reading suggests it may not be needed for GlobalProtect. May have to revisit it after some testing.   So short answer is: Just turn off the "Shared" checkbox when setting authentication enforcement. ... View more