topic Re: GlobalProtect VPN settings in GlobalProtect Discussions

GlobalProtect VPN settings

jeromecarrier — Fri, 18 Nov 2022 16:01:54 GMT

Hello

I discover GP so I'm sorry, in advance, if my questions are stupide.

Q1 : How I can force my users to enter their credentials (OnPrem AD or Azure AD depending the auth profile configured) when they start GP protect ? I don't want to use SSO and I want that my user enter their credential each time that they want to start the VPN connexion.

Q2 : Is-it possible to configure the GP client with the Gateway server by default (without the possibilty to remove it by user or to add another one) ? The objective is when I deploy the client on the computer via SCCM or when user open a session on the portal to download the vpn client, the client is already "pre-configured" with our settings and user does not have to enter gateway information, just click "connect".... 🙂

Re: GlobalProtect VPN settings

jeromecarrier — Mon, 21 Nov 2022 21:55:47 GMT

Hello

No update?

Re: GlobalProtect VPN settings

TomYoung — Tue, 22 Nov 2022 00:08:33 GMT

Hi @jeromecarrier ,

1. If you change Save User Credentials to No under Network > GlobalProtect > Portals > [edit] > Agent > Configs > [edit] > Authentication, the user will have to enter their username and password every time.

2. If you set "Allow User to Change Portal Address" to No under App in the same agent client config, then the user will not be able to change the portal address. Note that this document -> https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/globalprotect/network-globalprotect-portals/globalprotect-portals-agent-configuration-tab/globalprotect-portals-agent-app-tab says that you "must supply the default portal address in the Windows registry or Mac plist".

Thanks,

Tom

Re: GlobalProtect VPN settings

jeromecarrier — Tue, 22 Nov 2022 16:05:12 GMT

Hello

I have not found the option to force to enter user credentials each time in Network > GlobalProtect > Portals > [edit] > Agent > Configs > [edit] > Authentication... 😞

Re: GlobalProtect VPN settings

TomYoung — Tue, 22 Nov 2022 16:53:10 GMT

Hi @jeromecarrier ,

As mentioned above, change "Save User Credentials" to No. Please see the pic below.

You may also want to verify that "Use Single Sign-On" is disabled for Windows and MacOS under the App tab.

Thanks,

Tom

Re: GlobalProtect VPN settings

jeromecarrier — Wed, 23 Nov 2022 10:51:08 GMT

Hello

These settings are already configured on my environment.

when I have a session open on my laptop with my domain account and my laptop connected on public wifi, when I start the GP program, the connexion is established without to be requested to enter my credentials on GP vpn client. For security reason, we want to force user to enter their credential each time that they want to connect the VPN on the network...

An idea?

Jerome

Re: GlobalProtect VPN settings

TomYoung — Wed, 23 Nov 2022 16:18:27 GMT

Hi @jeromecarrier ,

That is indeed a mystery. In my environment, I have "Save User Credentials" set to No, and I am always prompted for credentials. Maybe an uninstall/reinstall of the GP client may help. You may need to open a TAC case.

I would like to know the resolution.

Thanks,

Tom