topic Re: Matching client config not found in GlobalProtect Discussions

Matching client config not found

seanmccoy — Thu, 08 Jun 2023 18:08:40 GMT

I have a user trying to connect via Global Protect from a Win 11 client. The error is "matching client config not found". I have no issues at all connecting as that same user from a Win 10 client. Also we use Mini Orange for MFA which sends an SMS code to the user.

Re: Matching client config not found

A_Astardzhiev — Fri, 09 Jun 2023 07:48:29 GMT

Hi @seanmccoy ,

The error indicates that connecting user does not match any of the user config you have defined. First you need to identify if the error is returned by GP Portal or GP Gateway. You should be able to confirm this from GP logs on the firewall -> Monitor -> GlobalProtect Logs, check at what stage of the VPN connection the error is created.

After that look at the relevant agent config (GP Portal -> Agent -> config, or GP Gateway -> Agent -> config). Focus on the "Config Selection Criterias":

- Are you matching config by user/user groups?

- Are you matching config by device OS?

- Are you matching config by device checks?

- Are you matching config by custom checks?

Step 6 from this guide show where those checks are configured - https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-portals/define-the-globalprotect-app-configurations

Confirm that you user is matching all of the check for at least one agent configs

Re: Matching client config not found

seanmccoy — Fri, 09 Jun 2023 13:32:32 GMT

Good morning @aleksandarastardzhiev,

So the same version of the GP client works fine on Win 10 but not Win 11. Based on your troubleshooting suggestions, it appears the issue lies within the gateway based on what I'm seeing in the GP traffic log. GP client version is 5.2.8-23 on both Win 10 and Win 11 clients.

Re: Matching client config not found

seanmccoy — Fri, 09 Jun 2023 14:54:25 GMT

I opened a case with PAN support. They indicated 5.2.10 and higher is recommended for Win 11. I downloaded 5.2.10 and activated it. After upgrading on a Win 10 client, I'm now getting that same matching client config not found error.

Re: Matching client config not found

A_Astardzhiev — Fri, 09 Jun 2023 15:24:25 GMT

Hi @seanmccoy ,

I would strongly recommend to follow the recommended version here - https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-p/258304

Especially for GP it is very useful to be on the latest preffered version (it is quite common to see bug for HIP failing to correctly identify OS, AV or something else).

Back to your question - without looking at your configuration I am shooting in the dark. But before reviewing the config I don't like to jump on search for bugs.

If you said that user is failing to match GP gateway config, this narrow down the problem - because GP gateway agent/client config selection criteria are only based on user, os (and public source ip/region).

Shooting in the dark again - is there any changes for Win10 and Win11 user authentication? How users are authenticated when login to Windows? On-prem AD or Azure AD? Any difference for the two OS?

What I could imagine (as happened to us) is that Win 11 is using AAD, where user is login with UPN (user principle name), which cause group mapping to fail and the connecting username is not mapped to the user group used in GP gateway config.

Are you able to share GP logs from the firewall for the failed and successfull login? Obfuscate the sensitive info (username, ip, gp name, etc)

Re: Matching client config not found

seanmccoy — Fri, 09 Jun 2023 19:07:21 GMT

Hello again @aleksanderastardzhiev ,

PAN support had me delete the DAT files from c:\users\username\AppData\Local\Palo Alto Networks\GlobalProtect on the Win 11 client. I was able to connect and then upgraded to 5.2.10. After upgrade, I had to again delete those DAT files and then user was able to successfully connect to GP on Win 11.

Re: Matching client config not found

MAerre — Wed, 08 Jan 2025 16:30:21 GMT

Hello @A_Astardzhiev ,

i'm faing the same error but in a different case: i deploy my GP with local authentication and it works, i added an authetication sequence profile with a radius server (Cisco ISE) and i log with the local credential test.test it works, it logging with the credential in the radius server which is test_test i'm given the radius accept from the server but i'm receiving the "Matching client config not found", i've already deleted the dar files as stated before.

I'm using the same machine and only thing differente is the authentication type.

Do you have any tip?

Thank you