About TheBest

Hello, Yes, we needed to associate the tunnel interface with its own zone rather than the trusted zone.  As you stated, this modification now allows additional and needed granularity.  There are still two comments/questions, though not critical: 1.  I was obliged to add a Client Configuration in the GlobalProtect portal, citing an AD group and external gateway IP.  Without this, I was getting this error after compiling:  Config commit phase 1 aboreted (Module: device) missing both client config and satellite config (Module: sslvpn) Commit failed 2. I can still connect to the portal FQDN and authenticate with ANY account in the AD to download the GlobalProtect client.  Thanks to the new rules, it is now not possible to authenticate with ANY account in the AD from GlobalProtect - it is necessary to have an account in the designated allowed group.  In any case, shouldn't the authentication be denied when connecting to the portal FQDN and before being able to download the globalprotect MSI? Best regards ... View more

Hi, OK, so it appears that the AD group in the agent configuration would be mainly to target a group for a specific configuration of the agent.  Therefore, this parameter has nothing to do with security and access filtering.  Still, using this method, I don't think its possible to target a specific group for a newer version of GP client.  I think the only way may be to deploy the MSI via GPO. Your idea is a good one but won't work currently with my configuration.  The security zone for the VPN tunnel is already "Trust".  This explains why we have no granularity and clearly reduces security.  However, the physical interface connection to the internet is in the zone "Untrust".  It looks like there is a 1:1 relationship between the physical interface and a zone.  So, it looks like I would have to change the VPN tunnel zone from "Trust" to "Untrust" and then add the policy as you suggested, right?  Otherwise, is it possible to have multiple zones linked to one physical interface?  In that case the interface to the outside would include "Untrust" and a new zone "GP-VPN"? Thanks for your valuable help! ... View more