topic Re: Global Protect Auth Failure after FW upgraded to 11.2.4-h1 in GlobalProtect Discussions

Global Protect Auth Failure after FW upgraded to 11.2.4-h1

James_Martin — Mon, 02 Dec 2024 10:09:30 GMT

Hello,

We upgraded our firewalls to 11.2.4-h1 to patch the critical vulnerability recently discovered.

We use Global Protect with AO VPN and enforce network connection.

A problem we are seeing this morning is when our Global Protect clients are attempting to authenticate, either nothing happens for most of our staff or the ones that prompted, it is using the default browser to authenticate. Our Agent config is set to use the embedded browser, not default browser as this was always problematic.

The only fix we have to this problem right now is to uninstall Global Protect and install again. Not feesable for 1000s of machines.

Re: Global Protect Auth Failure after FW upgraded to 11.2.4-h1

James_Martin — Mon, 02 Dec 2024 10:28:17 GMT

So downgrading the firewall to previous OS has resolved our problem. Something not right with 11.2.4-h1

Re: Global Protect Auth Failure after FW upgraded to 11.2.4-h1

Tom_Access — Tue, 07 Jan 2025 15:52:06 GMT

We've run into a similar issue with PAN-OS v11.1.4-h7 and GP v6.3.1 or later (we've tried v6.3.1-c838 and 6.3.2-525). After the PAN-OS upgrade - to patch a vulnerability - our GlobalProtect users would have failed authentications even though their credentials were correct. Clearing the saved credentials out of the GP client settings (using the Sign-Out button) would force a new authentication that worked on the next connection attempt.

I've been trying to sort that issue out for a couple weeks now. A new problem has cropped up where the user is connected to the VPN gateway, then gets disconnected for no apparent reason. The same clearing of credentials in the GP settings seems to allow them to log back in and stay connected for a while. But then the issue crops back up later.

Other than downgrading PAN-OS and the GP client, does anyone know a solution or workaround?