Problem with GlobalProtect after certificate renew

Damiano — Fri, 18 Mar 2022 08:46:35 GMT

Hello there,

Yesterday our certificates used for GlobalProtect expired. I reneved them like last time and then - we lost possibility to connect to our institution from endpoints. Nothing more were changed.

Error seen on endpoint:

Now nobody can connect via GlobalProtect using AD credentials.

Currently our settings in Agent config looks like:

When I set user settings to "Any" GlobalProtect starts to work again, but we cannot have this set to "Any" cos we must have control who have possibility to connect to company actually.

I have no idea what can I do to make this work again.

Re: Problem with GlobalProtect after certificate renew

ahandoo — Fri, 18 Mar 2022 11:15:56 GMT

Hi @Damiano
May I know what is the Authentication which you are using like LDAP, SAML, Radius or any other method?
Can you check how is the firewall creating the IP-to-User mapping while having the 'user/user group' set as 'Any'? ---->run the following command after user is connected 'show user ip-user-mapping all type GP'
The way you have added the user is called as 'sAMAccountName'. However, the mapping can be also learned in different ways such as UPN format (udername@domain.com) or simply just the username.
If the mapping is learned in a different format we can try checking the below document.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boHMCAY

topic Problem with GlobalProtect after certificate renew in GlobalProtect Discussions

Problem with GlobalProtect after certificate renew

Re: Problem with GlobalProtect after certificate renew