topic Re: GLOBAL PROTECT single user multiple session restriction settings in GlobalProtect Discussions

GLOBAL PROTECT single user multiple session restriction settings

N.Rana — Wed, 06 Mar 2024 04:23:40 GMT

Hi , is there a way to configure global protect to single session for a user? Currently one user can have multiple session (basically diff people can login using that one user acc).

I researched and found PA does not have that feature yet, but it can be done via API. However this is a very sensitive secure network, im not keen in messing with scripts into the system.

Re: GLOBAL PROTECT single user multiple session restriction settings

JayGolf — Wed, 06 Mar 2024 06:38:33 GMT

Hi @N.Rana ,

I am not currently aware of such a feature, but I would recommend that users should not be using a single account for access in a highly sensitive network. Users should have their own accounts created for individual use.

Re: GLOBAL PROTECT single user multiple session restriction settings

N.Rana — Wed, 06 Mar 2024 07:05:00 GMT

hi,

yes but my issue is say i created a user acc for u, chances are i am able to connect using your user acc while you are connected as well.. basically having multiple sessions with a single user acc

Re: GLOBAL PROTECT single user multiple session restriction settings

Mick_Ball — Thu, 07 Mar 2024 18:39:13 GMT

Yes that is possible and for our users with more than one device it works well.

You really need to introduce a more secure form of authentication like certificate or OTP/MFA to prevent this from ever being possible.

Re: GLOBAL PROTECT single user multiple session restriction settings

OtakarKlier — Thu, 07 Mar 2024 21:42:09 GMT

Hello,

I believe the question is 'can we ensure that one user can only have one connection at a time'? Meaning a user cannot connect from two systems into the same portal/gateway. I know this was not possible in the past, however wondering if this feature has been added. @JayGolf @Mick_Ball

Regards,

Re: GLOBAL PROTECT single user multiple session restriction settings

BPry — Thu, 07 Mar 2024 21:47:17 GMT

@N.Rana

You can monitor this through a script and boot any subsequent connection from the same user, however this isn't something built-in that you can just enable. There's an existing FR4603 that you can add your vote to, however @Remo put together a script a while back that he graciously shared with the community HERE.

Re: GLOBAL PROTECT single user multiple session restriction settings

enginy — Thu, 29 Aug 2024 18:08:07 GMT

I know that this is an old post but I would like to share an update for anyone looking for a solution.

In order to achieve that I created a external & standalone program to limit concurrent GlobalProtect sessions/connections per unique user. It can be accessed here: https://github.com/enginy88/PAN-GPLimiter

This topic also discussed here: https://live.paloaltonetworks.com/t5/general-topics/pan-gplimiter-limit-concurrent-globalprotect-sessions/td-p/596293

Hope this helps!