topic Re: Palo Alto Networks - Global Protect error: Failed to get client configuration in GlobalProtect Discussions

Palo Alto Networks - Global Protect error: Failed to get client configuration

rjhardy90 — Sun, 13 Mar 2022 23:53:02 GMT

We have configured the application in Azure, and imported the profile on the palo. We have set up the gateway and portal and authentication profile. The logs on the Palo and Azure show as successful but when a user tests connecting via Global Protect client they get an auth failed. The Palo Global protect logs show failed to get client configuration. Anyone ever had this issue before?

Re: Palo Alto Networks - Global Protect error: Failed to get client configuration

Mick_Ball — Mon, 14 Mar 2022 10:17:15 GMT

Have you restricted GP to certain users or groups... the authentication is working but seems the palo cannot find an agent config for them...

Re: Palo Alto Networks - Global Protect error: Failed to get client configuration

Arne — Thu, 17 Mar 2022 13:16:26 GMT

Had the same issue yesterday, I am using Cloud Identity Engine to sync users and machine objects to the palo.

Under Network - Global Protect - Portals - Agent - Config Selection Criteria - Device Checks the Serial Number Check was set to "no", I changed it to "none" and everything worked.

Lesson learned, test the portal and gateway with no config selection criteria checks.

Re: Palo Alto Networks - Global Protect error: Failed to get client configuration

Netwerk-iSOFT — Fri, 01 Apr 2022 12:26:31 GMT

Hi Arne,

I had the same issue, and this exactly did it for me. I wonder what the default setting is, as I never encountered this on my other Palo Alto firewalls.

Thanks!

Re: Palo Alto Networks - Global Protect error: Failed to get client configuration

EricMikota — Wed, 13 Mar 2024 18:38:49 GMT

Thanks, Arne! I just had this issue today with our new GlobalProtect Portal on VM-Series. Changing the Serial Number Check from "no" to "none" allowed me to connect. Prior to that, I was also getting the "Global Protect error: Failed to get client configuration" error. Glad I found your post on this as I had checked everything else I could think of and it all looked good. Never would've thought of changing that setting and you saved me hours!

Re: Palo Alto Networks - Global Protect error: Failed to get client configuration

J.Jacobsen — Thu, 03 Oct 2024 20:29:59 GMT

Had a similar issue over the last few weeks and discovered that the "mail" attribute on our user accounts weren't all populated with their email address, or had their old email address or simply an incorrect value in that field. Soon as I fixed that for the affected users, they were then able to finish authenticating, but before that I was getting auth failures and the failed to get client config stuff.

Not sure if anyone else is having this issue, but worth sharing I figured. Enabling this different auth method produced some interesting challenges.