Technical Tip: Unable to match SSL firewall policy when user is part of multiple AD groups and SSL-VPN multi-realm is used

Description

Solution
To overcome the issue of the user not matching the SSL-VPN firewall policy we add the user group 'A1' to the same portal mapping where user group 'A2' is mapped.

From CLI.

# config vpn ssl settings

set servercert "self-sign"

        set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"

        set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"

        set source-interface "port2"

        set source-address "all"

        set source-address6 "all"

        set default-portal "web-access"

        # config authentication-rule

            edit 1

set groups "A1" "A2"

                set portal "full-access"

                set realm "Realm1"

            next

        end

    end  

 

Note.

In this scenario realms and full tunnel are used.

Related Articles

Technical Tip: Creating sslvpn with multiple realms