GP 6.0.6 - Cookie expired only from mobile phone

JoseCortijo — Tue, 19 Sep 2023 10:49:45 GMT

Hi,

we have PA-850 and we deployed GP 6.0.7 for desktops and 6.0.6 version for mobile phones.

The authentication is based on SAML via Azure and every connection from desktops works flawlessly.

Recently we started receiving complaints from users that the VPN stopped working on phones, they received an XML saying Access Denied (attached).

Looking at logs I found a Cookie Expiration and the quick solution was to clean the history of the mobile browser. then, the error disappeared and SAML authentication happened as usual.
It seems like the GP client on a desktop can go for SAML authentication whenever it receives a cookie expiration message.

Is there a way to configure the mobile client to do the same? is it a bug? any setting I can configure at Paloalto level?
one option would be to disable the cookie authentication but that would be my last choice.... 😕

topic GP 6.0.6 - Cookie expired only from mobile phone in GlobalProtect Discussions

GP 6.0.6 - Cookie expired only from mobile phone