About mdsgn1

Hi Everyone!   Im not sure if this is more a Global Protect or Pan-OS topic, but here goes:   Our setup: I have implemented SAML authentication with our PanOS devices to be used on Global Protect. It works great, our corporate laptops authenticate with certificate + SAML, but now I want to have the same SAML authentication on another portal that is intended to be used for BYOD devices. That portal is configured to allow only one type of auth, in this case - SAML.   The problem: With the default/documentation SAML setup, after authenticating on Azure SSO, the redirect goes to the first portal, the one meant for corporate laptops, that has certificate + SAML, and obviously that fails for BYOD devices with the missing certificate error. Is there a way to configure it so, that multiple reply URLs can be used? So it redirects to the correct portal?  I know Azure SSO supports idp-initiated sso, but how to use it with Pan-OS?   Any ideas are appreciated ... View more

Hello!   On all our endpoints we are using XDR with firewall(Uses built in Windows firewall) and Palo Alto GlobalProtect VPN connecting to PanOS devices at our office. We use split tunneling for the VPN, that means that only specified traffic goes through VPN tunnel to access internal resources and Active Directory services, the rest stays out of it. We also have different profiles for Internal and External network types, with a lot more restriction on the External.   The issue is that due to most traffic being outside the tunnel, we want XDR Firewall to consider being an external network when connected to VPN. But the check that determines what type of network profile to apply does that with an LDAP connectivity test and a DNS resolve test for some internal domain. Both of these tests pass when connected to VPN.   So far the only idea I have had is blocking LDAP connections in our office firewall when the traffic comes from VPN, but that seems like a bad solution. So maybe someone has experience with how to best solve this?   If the DNS check would be rather ping, than resolve, then it would be an easy trick to just block pinging to that name for VPN subnet, but that is not the case. ... View more