Access Role not working?

[biskit]

I suspect I'm missing something obvious, so I'm after some help please.

I've set up remote access using Azure AD auth (Identity Provider) - both for Mobile Access (with SNX) and client VPN.  Both authenticate fine and I get an Office Mode IP.  Great.

I've configured an Access Role where I've specified certain users from Azure AD.  When I click "add" it browses Azure AD with no problem, and I select the users I want.

The Access Role is in a rule allowing access to the LAN.

But it doesn't work.  It's as if nothing is being picked up on that Access Role rule.  Traffic is dropped on the cleanup.

If I add a rule lower down to allow the Office Mode net to get to the LAN, then my traffic works on that rule.

I can't work out why my traffic isn't allowed on the Access Role rule which has my Azure name in it?   Obviously I don't want to leave the Office Mode rule in otherwise I have no way of creating rules based on the person.  I presumed Access Roles should do this but they are being completely ignored 😞

I've tried with and without Remote Access in the VPN column, and also tried with Captive Portal in the Accept column.  No difference...

Does anyone have any ideas please?! 

[#2 · Accepted solution]

With some help from TAC I got it working.  The current instructions from CP don't quite give the full story, so I've attached some notes to supplement and clarify some steps.  The golden rule is - don't miss any steps in SK172909, and don't miss any steps in my attached supplementary notes which fill in some critical gaps in SK172909.

If anyone finds a different/simpler way to achieve this I'd love to know 🙂

[#3 · Accepted solution]

With some help from TAC I got it working.  The current instructions from CP don't quite give the full story, so I've attached some notes to supplement and clarify some steps.  The golden rule is - don't miss any steps in SK172909, and don't miss any steps in my attached supplementary notes which fill in some critical gaps in SK172909.

If anyone finds a different/simpler way to achieve this I'd love to know 🙂

[#4 · Accepted solution]

With some help from TAC I got it working.  The current instructions from CP don't quite give the full story, so I've attached some notes to supplement and clarify some steps.  The golden rule is - don't miss any steps in SK172909, and don't miss any steps in my attached supplementary notes which fill in some critical gaps in SK172909.

If anyone finds a different/simpler way to achieve this I'd love to know 🙂

[#5 · Accepted solution]

With some help from TAC I got it working.  The current instructions from CP don't quite give the full story, so I've attached some notes to supplement and clarify some steps.  The golden rule is - don't miss any steps in SK172909, and don't miss any steps in my attached supplementary notes which fill in some critical gaps in SK172909.

If anyone finds a different/simpler way to achieve this I'd love to know 🙂

[the_rock]

I really wish I could give you logical answer, but I dont know at this point. I would do IA debugs and see if we can pin point a reason. I will find the debugs TAC sent me once and send them to you here.

Andy

[the_rock]

I really wish I could give you logical answer, but I dont know at this point. I would do IA debugs and see if we can pin point a reason. I will find the debugs TAC sent me once and send them to you here.

Andy

[the_rock]

I really wish I could give you logical answer, but I dont know at this point. I would do IA debugs and see if we can pin point a reason. I will find the debugs TAC sent me once and send them to you here.

Andy

[biskit]

Thanks Andy.  I take a bit of comfort in the knowledge I'm not doing anything completely obviously wrong at this stage?!

[biskit]

Thanks Andy.  I take a bit of comfort in the knowledge I'm not doing anything completely obviously wrong at this stage?!

[biskit]

Thanks Andy.  I take a bit of comfort in the knowledge I'm not doing anything completely obviously wrong at this stage?!

[the_rock]

Do you have time for remote session? I think we spoke once before during COVID, you are in UK if I recall? If so, if you are free at say 2 pm your time, just message me privately and we can do remote...I have some ideas.

Andy

[the_rock]

Do you have time for remote session? I think we spoke once before during COVID, you are in UK if I recall? If so, if you are free at say 2 pm your time, just message me privately and we can do remote...I have some ideas.

Andy

[the_rock]

Do you have time for remote session? I think we spoke once before during COVID, you are in UK if I recall? If so, if you are free at say 2 pm your time, just message me privately and we can do remote...I have some ideas.

Andy

[RS_Daniel]

Hi,

On the gateway object, identity awareness tab, is "Remote Access" option checked on the list of Identity Sources? after the vpn client connects to the gateway, check if the firewall has any identity related to that IP "pdp monitor ip X.X.X.X" or "pep show user all | grep X.X.X.X"

Regards

[RS_Daniel]

Hi,

On the gateway object, identity awareness tab, is "Remote Access" option checked on the list of Identity Sources? after the vpn client connects to the gateway, check if the firewall has any identity related to that IP "pdp monitor ip X.X.X.X" or "pep show user all | grep X.X.X.X"

Regards

[RS_Daniel]

Hi,

On the gateway object, identity awareness tab, is "Remote Access" option checked on the list of Identity Sources? after the vpn client connects to the gateway, check if the firewall has any identity related to that IP "pdp monitor ip X.X.X.X" or "pep show user all | grep X.X.X.X"

Regards

[the_rock]

Forgot that part about remote access, good point.

[the_rock]

Forgot that part about remote access, good point.

[the_rock]

Forgot that part about remote access, good point.

[biskit · Accepted solution]

With some help from TAC I got it working.  The current instructions from CP don't quite give the full story, so I've attached some notes to supplement and clarify some steps.  The golden rule is - don't miss any steps in SK172909, and don't miss any steps in my attached supplementary notes which fill in some critical gaps in SK172909.

If anyone finds a different/simpler way to achieve this I'd love to know 🙂

[biskit · Accepted solution]

With some help from TAC I got it working.  The current instructions from CP don't quite give the full story, so I've attached some notes to supplement and clarify some steps.  The golden rule is - don't miss any steps in SK172909, and don't miss any steps in my attached supplementary notes which fill in some critical gaps in SK172909.

If anyone finds a different/simpler way to achieve this I'd love to know 🙂

[biskit · Accepted solution]

With some help from TAC I got it working.  The current instructions from CP don't quite give the full story, so I've attached some notes to supplement and clarify some steps.  The golden rule is - don't miss any steps in SK172909, and don't miss any steps in my attached supplementary notes which fill in some critical gaps in SK172909.

If anyone finds a different/simpler way to achieve this I'd love to know 🙂

[the_rock]

Amazing job Matt, thanks for that!

Andy

[the_rock]

Amazing job Matt, thanks for that!

Andy

[the_rock]

Amazing job Matt, thanks for that!

Andy

[AK2]

Thanks - I needed to follow your AAD instructions to get matches on my AAD Identity Awareness policies. Much appreciated 🙂

[AK2]

Thanks - I needed to follow your AAD instructions to get matches on my AAD Identity Awareness policies. Much appreciated 🙂

[AK2]

Thanks - I needed to follow your AAD instructions to get matches on my AAD Identity Awareness policies. Much appreciated 🙂

[TRajkumar]

Hello biskit

     Detto i'm facing the same issue. But now i'm trying this on my trial Azure AD (Groups is not possible) and using users. Could you please help me with more details.

[TRajkumar]

Hello biskit

     Detto i'm facing the same issue. But now i'm trying this on my trial Azure AD (Groups is not possible) and using users. Could you please help me with more details.

[TRajkumar]

Hello biskit

     Detto i'm facing the same issue. But now i'm trying this on my trial Azure AD (Groups is not possible) and using users. Could you please help me with more details.

[TRajkumar]

Hi Biskit

  I also facing the same challenge, But in my case i'm using the cloudguard gateways (GCP). I tried the document you have shared but no luck for me. Cloud you please help me to resolve this.

[TRajkumar]

Hi Biskit

  I also facing the same challenge, But in my case i'm using the cloudguard gateways (GCP). I tried the document you have shared but no luck for me. Cloud you please help me to resolve this.

[TRajkumar]

Hi Biskit

  I also facing the same challenge, But in my case i'm using the cloudguard gateways (GCP). I tried the document you have shared but no luck for me. Cloud you please help me to resolve this.