topic Re: Globabprotect on demand mode in General Topics

Globabprotect on demand mode

jdprovine — Thu, 30 Apr 2015 13:17:48 GMT

I have configured the GP agent to be on demand mode so you have to manually have to login in and it won't automatically log you in. But the client on my machine is still trying to login in automatically, is there another setting that has to be changed?

Re: Globabprotect on demand mode

rsriramoju — Thu, 30 Apr 2015 23:22:05 GMT

Hi Jprovine,

Generally if a user puts his PC in sleep mode while being connected to Global Protect, based on the inactivity timeout that user will be kept logged on. As of now the minimum timeout is 120mins.

- It is suggested that upon GP usage, the user should Disconnect from the Client and then put PC in Sleep mode.

Also please check the below Document

https://live.paloaltonetworks.com/docs/DOC-2811

-regards

Rajiv

Re: Globabprotect on demand mode

jdprovine — Fri, 01 May 2015 13:47:29 GMT

I did read that document earlier and was thinking that you can't have SSO on and on demand because it would still try to logon automatically because of the single sign on. Of course if you didn't have the password remembered it still wouldn't login because there is no password

Re: Globabprotect on demand mode

jdprovine — Tue, 05 May 2015 12:48:40 GMT

So has anyone configured and using on demand mode for their globalprotect vpn client. If so can you share your configuration with me

Re: Globabprotect on demand mode

Zewwy — Fri, 08 May 2015 16:15:06 GMT

Do you have multiple Agent Configurations setup on your Portal settings? if yes, ensure that your account is a member of only one of them.to

We use AD groups to tell which users are "On-Demand" vs Auto connect, and its pretty straight forward and working without issue for me. If you are using MS AD Groups ensure your account is getting the proper SID for that group.

Re: Globabprotect on demand mode

jdprovine — Mon, 11 May 2015 13:01:08 GMT

I have three agent configurations configured. My account is only a member of one of the two ad groups that are being pointed to for credential for example we have one agent for "students" it is an ad group, I do not exist in it and the student client is pointed to the correlating ad group. We have a second client called staff, it has an ad group I am a part of and the client is point to it for credentials