topic Connect automatically to Global Protect using OKTA cred in General Topics

Connect automatically to Global Protect using OKTA cred

nivhovav — Wed, 15 Mar 2023 15:13:48 GMT

Hi,

Thought it might be worth asking here, maybe you can help me 🙂

We're using Prisma Access and the Global Protect client to log in to VPN. We're also using OKTA to authenticate.

Is there any way to somehow automate the login to the client, and maybe in a way, somehow enforce the login? We basically want all of our users to keep login into GP without a way to disable it (for security visibility). It should be completely seamless for the user, with as less user intervention as possible.

Right now, we're using an Always-ON mode, with an option to disable the client with only a passcode. That being said, in a restart laptop/cookie expiration, it just pops up the regular OKTA authentication, without anything preventing the user from closing it, and then the client stays on "connecting...".

Is there anything that you could suggest to me for this to work? Is there anyone here using the pre-logon connection method? is it reliable?

*We're also using Jamf Connect, if it matters

Re: Connect automatically to Global Protect using OKTA cred

nivhovav — Wed, 15 Mar 2023 15:30:05 GMT

Haven't mentioned but we're using macOS

Re: Connect automatically to Global Protect using OKTA cred

BPry — Wed, 15 Mar 2023 20:34:24 GMT

@nivhovav,

You might want to think about changing over to a certificate for the actual tunnel and then using an authentication policy to capture the actual login instead. This would ensure that the tunnel is always connected, while still giving you the ability to enforce user authentication to capture the user-id and access resources.