topic Re: Global Protect portal page error in GlobalProtect Discussions

Global Protect portal page error

Mohammed_Yasin — Tue, 08 Jun 2021 09:06:01 GMT

Restriction of the users on the GP portal page.

We selected a particular group in the allowed list, but authentication was failing unless we select all.

Re: Global Protect portal page error

Mick_Ball — Tue, 08 Jun 2021 15:51:40 GMT

probably domain info wrong, post auth profile so we can check

Re: Global Protect portal page error

jdelio — Tue, 08 Jun 2021 16:05:34 GMT

When you do not select all, what is showing up in the logs?

Also, how are the users defined? You mentioned groups? please provide more info on the auth method/etc.

Re: Global Protect portal page error

Mohammed_Yasin — Wed, 09 Jun 2021 12:05:57 GMT

My Actual Issue,

GlobalProtect Portal or Agent users fail authentication

My Authentication Profile has specific filtered groups. The users appear to be in the group that makes up the allow list. However, the message "user not in allow list" still appears. If the allow list is changed to have "all" rather than specific groups, the user authenticates fine.

And I followed this link https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClizCAC

Model 850, VSYS Not Support, so I skip the "shared" authentication profile here.

Re: Global Protect portal page error

Mick_Ball — Wed, 09 Jun 2021 14:17:02 GMT

Have you run the command "show user group name [name of your group]"

if you did, do the users have the domain name included "domain\username"

if 'yes' then have you added that domain name to the authentication profile.

Re: Global Protect portal page error

Mohammed_Yasin — Thu, 10 Jun 2021 05:12:03 GMT

Yes.. ran the command to show the user group name and added it to the auth profile as it was.

then ran a test auth user & pass from CLI.. the Authentication failed with the user not allowed in the list.

Re: Global Protect portal page error

Mick_Ball — Thu, 10 Jun 2021 07:52:10 GMT

when you run a cli auth profile test you need to use domain\username because cli test does not use the domain info in the auth profile. it just ignores it.

also you need to ensure you have the correct setting samaccountname or userprincipalname in both group mapping and the auth profile.