topic Re: "You are not authorized to connect to GlobalProtect Portal" in GlobalProtect Discussions

"You are not authorized to connect to GlobalProtect Portal"

pomologist — Mon, 31 May 2021 17:08:00 GMT

Hello Everyone,

I had global-protect working perfectly. Two days ago however something happened (not sure what caused the problem) and I'm unable to connect to GP anymore. I always get the error: "You are not authorized to connect to GlobalProtect Portal". The weird thing is that in the system logs there are no error messages relating to GP, I actually get an "auth-sucess" event for every attempted login where i'm presented with "You are not authorized to connect to GlobalProtect Portal"!

I'm using a local user, followed the same instructions I used to get it working the first time, (here: https://blog.fuelusergroup.org/how-to-set-up-globalprotect-on-a-palo-alto-firewall-2) and to the best of my recollection I haven't changed anything relating to GP functionality, but nothing gets me beyond that error message! I'm pulling my hair out because it was not hard to get this working the first time, and why I should be getting this error now is incredibly confusing!

Any help you can provide would be much appreciated! Thanks!!

Re: "You are not authorized to connect to GlobalProtect Portal"

pomologist — Mon, 31 May 2021 17:25:36 GMT

PS: I've double checked against two other PA guides:

https://live.paloaltonetworks.com/t5/globalprotect-articles/globalprotect-initial-set-up/ta-p/322232

and

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClH2CAK

All my settings are correct, exactly as outlined in these documents. What else should I check?

Re: "You are not authorized to connect to GlobalProtect Portal"

Remo — Mon, 31 May 2021 19:25:11 GMT

Hi @pomologist

Are you the only one who configures thisbfirewall or did maybe another admin change something? Is there something in the config log?

Specifically related the not autorizes message: is there a specific group or user configured in the auth profile or in the global protect agen configuration?

Re: "You are not authorized to connect to GlobalProtect Portal"

pomologist — Mon, 31 May 2021 21:11:16 GMT

Hi! No I'm the only admin. It's got to be something I changed somewhere, or else an update that nuked things. Yes, the authorize message is linked to the only user account who has GP access for offsite management, we have no other GP users.

Re: "You are not authorized to connect to GlobalProtect Portal"

pomologist — Mon, 31 May 2021 21:41:19 GMT

So I deleted the settings, GP portal, etc and completely rebuilt the GP infrastructure from the ground up. But now I'm getting these errors when I commit:

GlobalProtect portal(.......)setting is invalid: auth-profile exist(method none), client-cert-profile none no username. (Module: sslvpn)
GlobalProtect gateway(.......) setting is invalid: auth-profile exist(method none), client-cert-profile none no username.(Module: rasmgr)

Anyone know what the problem is?

Randy

Re: "You are not authorized to connect to GlobalProtect Portal"

Remo — Mon, 31 May 2021 21:42:42 GMT

So you doublechecked that this one user is configured in the authentication profile (or then set to all users) and the same in the global protect portal agent configuration?

Re: "You are not authorized to connect to GlobalProtect Portal"

Remo — Mon, 31 May 2021 21:43:49 GMT

Do you want to use an authentication profile for your local user or certificates for the vpn connection? Or both?

Re: "You are not authorized to connect to GlobalProtect Portal"

pomologist — Tue, 01 Jun 2021 17:57:46 GMT

Hi Everyone - I am wanting to use auth profile AND client certificates (with cert profile). I figured out that if I re-issue the client cert with a CN that is the same as the name of my user who wants to log in, and change the cert profile username to Subject (instead of none), everything works and I don't get the error above! I'm able to get in that way.

Only thing is, I'm never prompted to enter the user's password. I'd still like to be prompted for the actual user password as well in order for them to log in. Do you know if this is possible, when authenticating with an auth profile + client cert profile as I've outlined above?

Do you think GP authentication using a auth profile + client cert profile as implemented above, is a secure enough way to manage the PA remotely?

Thanks!

Re: "You are not authorized to connect to GlobalProtect Portal"

Remo — Tue, 01 Jun 2021 23:16:05 GMT

Hi @pomologist

Did you set the option "Allow Authentication with User Credentials OR Client Certificate" to no in the portal and gateway authentication tab?

Re: "You are not authorized to connect to GlobalProtect Portal"

pomologist — Tue, 01 Jun 2021 23:22:17 GMT

Yes! It's set to "no" in both portal and gateway. I am authenticated with that setup, but without ever entering the password of the user. But I want to enter the user password as part of authentication.

Re: "You are not authorized to connect to GlobalProtect Portal"

Remo — Tue, 01 Jun 2021 23:25:38 GMT

I understand. Sorry if some questions sound a little dumb, but I just want to make sure that there is nothing missed right at the beginning while you maybe troubleshoot somewhere else.

Would it be possible that you share screenshots of the authentication profile and global protect portal/gateway configuration?

Re: "You are not authorized to connect to GlobalProtect Portal"

pomologist — Tue, 08 Jun 2021 21:32:07 GMT

No worries! Thank you for your help. Attached are photos.

Re: "You are not authorized to connect to GlobalProtect Portal"

Remo — Wed, 02 Jun 2021 02:16:55 GMT

Hi @pomologist

According to these screenshots I assume the problem is your authenticarion profile. There is a dropdown field for "Type" where you need to choose local database to tell the firewall the source of your users. After changing that, global protect should ask you for username and password. This should work also without specifying a username attribute in the certificate profile.

Re: "You are not authorized to connect to GlobalProtect Portal"

Mick_Ball — Wed, 02 Jun 2021 09:40:26 GMT

ok perhaps go back a step as got myself a bit confused here...

these errors...

GlobalProtect portal(.......)setting is invalid: auth-profile exist(method none), client-cert-profile none no username. (Module: sslvpn)
GlobalProtect gateway(.......) setting is invalid: auth-profile exist(method none), client-cert-profile none no username.(Module: rasmgr)

this is probably because you were missing or failed to add an auth profile, thats why when you set the cert profile to subject it started working, albeit without username and password...

so i would delete the auth profile and create a new one with your local user database and leave the advanced tab to "all" for now....

add a new portal with the new auth profile included and the certificate profile set to "None" in the username field...

start from there and we can do some diags when it fails on "not authorized"

Re: "You are not authorized to connect to GlobalProtect Portal"

pomologist — Wed, 02 Jun 2021 11:23:25 GMT

That was it! Totally obvious - "type" needed to be set to local database. I have no idea how I overlooked that! Thank you so much!

One other question while I'm at it. Under the global protect portal agent configs (first screenshot above), is it important to check "install in local root certificate store" for the "Trusted Root CA's"? I have already installed those (PA generated, self signed) root CA's manually on the computer I'll be using for remote access, and I'm the only GP user, and using GP on only one single device.

Thanks!

Re: "You are not authorized to connect to GlobalProtect Portal"

pomologist — Wed, 02 Jun 2021 11:44:26 GMT

And if you don't mind, one more question. (see screenshot below)

Is it best practice to check all of these boxes on the cert profile for the GP and GP Client certs? Or are there any that could break the system if left checked?

Thanks!

Re: "You are not authorized to connect to GlobalProtect Portal"

Remo — Wed, 02 Jun 2021 12:29:00 GMT

Hi @pomologist

Do you use a local CA on the firewall which signed your clientcertificate? Actually it doesn't even matter if an internal corporate or firewall CA is used. Depending on the configuration all of these four checkboxes on the right side of the screenshot could break/prevent a successful connection. In your case (one gp user and also one firewall admin) I wouldn't check these four. But if you'd like to activate these too, go for it 😉 but as I mentionned maybe you need to adjust some settings with the existing CA certificate used.

Re: "You are not authorized to connect to GlobalProtect Portal"

pomologist — Wed, 02 Jun 2021 12:31:54 GMT

OK Thanks! Yes I use a local firewall CA. I'll just experiment then. Again, thank you very much!

Re: "You are not authorized to connect to GlobalProtect Portal"

Remo — Wed, 02 Jun 2021 12:32:06 GMT

In this case you don't need to install these certificates on the client - specially with only one user. This option is intended to be used in cases where you use a public cert for the portal and a selfsigned cert for the gateway. In this situation the selfsigned CA is required that the clients trust the gatewaycert. Another usecase is, if you configured tls decryption, where also a CA cert is required on the client in order to avoid certificate warnings in the browsers.