About Brian_Shoemaker

Everything discussed here is within the Portal section (versus Gateway) of GlobalProtect.  It looks like it uses a client authentication for the initial portal authentication.  Then it chooses/loads the Agent configuration based upon user identification/authorization, leveraging local user db/LDAP Security Group/etc.   Whatever user group that user is a part of dictates which Agent config will load.  Within that Agent config for that particular group, it will list the gateways available to choose from and specify if the user can manually choose their gateway or if it will automatically select one. You can move the Agent configurations up or down in the list.   So you can choose which user identification it will use first, based on the first group match.  If I'm part of a VPN Users AD security group, but I am also a part of an IT Services group that has another gateway providing greater network access, I can move the IT Services to the top, so my authentication hits that match first and I get the IT Services gateway vs the VPN Users gateway, which would be a group that would have more limited access.   Here is a screenshot where I had to change Priority to Manual Only - even though On-Demand is checked at the bottom, the Priority supersedes that checkbox.  So unless both places are set to Manual it will automatically try to choose the highest priority gateway.     ... View more

I've read that article and it exp how to set a preferred gateway in the client.  The problem is that the end users are never prompted to specify a Gateway of choice in the first place.  Once they authenticate to the portal, they aren't given an option. It is set to allow users to select their Gateway On-Demand, but instead, it just connects directly to the first gateway.   This is from the article about setting a preferred gateway, but it's actually the behavior I want - to have them prompted each time. Before this feature in place, if users need to connect to a specific gateway to access certain resources or connect from a particular geographical location, they must manually switch to that gateway each time they establish the GlobalProtect connection. With this enhancement, users can now automatically connect to a preferred gateway regardless of priority and response time. ... View more