topic Re: global protect clientless using guacamole in GlobalProtect Discussions

global protect clientless using guacamole

SShnap — Tue, 16 Jun 2020 19:27:11 GMT

Hi all,

Start working with global protect using MFA and try using guacamole for proxy rdp connection.

after building the guacamole server (updated one using Guacamole 1.1 on Ubuntu 20.04) the server is working on the internal network but when accessing it from outside I get the following message.

Access Error: 404 -- Not Found
Can't locate document: /guacamole/

The same error I received if I using MFA with SAML or LDAP authentication.

tried to use some other links but the same issue exist.

anyone familiar with this issue.

Thank you.

Re: global protect clientless using guacamole

domari — Wed, 17 Jun 2020 14:52:13 GMT

Can you check if you have everything properly configured as in the following admin guide:

https://docs.paloaltonetworks.com/globalprotect/9-0/globalprotect-admin/globalprotect-clientless-vpn/configure-clientless-vpn.html

+ Check if you have the correct NAT rule, security rules.

+ Check if the application host can be resolved by DNS, to confirm this, run the following command via command line:

> show system setting ssl-decrypt dns-cache

+ If the issue still persists, I would suggest upgrading Clientless VPN to the latest software, this can be done from Device> Dynamic Updates> Check Now to see the latest updates.

I hope this helps. Let us know if you are still experiencing any issues.

Re: global protect clientless using guacamole

SShnap — Wed, 17 Jun 2020 15:14:27 GMT

HI @domari

New day new thinking.

Found the problem, found wrong configuration on the portal.

under global protect portal config --> clientless vpn --> general

I put the guacamole server address in the host name instead of the vpn portal address.

now it is working fine.

I need to see how to use SSO for the guacamole rdp session instead of entering the credential again after the user pressing the guacamole application.

Re: global protect clientless using guacamole

domari — Wed, 17 Jun 2020 15:27:49 GMT

Here is an example that shows how to configure Clientless VPN with SAML and SSO:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm2oCAC

Re: global protect clientless using guacamole

SShnap — Wed, 17 Jun 2020 16:31:46 GMT

@domari

In our case we are using DUO so we user SAML and I'm looking for a way to add SSO for guacamole server. on DUO I don't see the option to add bookmark from their side.

Re: global protect clientless using guacamole

JacobDecker — Thu, 08 Jul 2021 21:22:56 GMT

Did you ever find a solution to this? Trying to find a way to "passthrough" user credentials from the clientless vpn login to the guacamole server to prevent users from having to type in their credentials twice.