topic Re: Has anyone managed to get global protect pre-logon to work??? in General Topics

Has anyone managed to get global protect pre-logon to work???

MalcolmMaynes — Thu, 20 Jun 2013 10:54:00 GMT

Has anyone managed to get global protect pre-logon to work? specifically, with a remote users laptop.

When the laptop is booted up, at the logon prompt before entering username and password details, do you get a pre-logon connection?

Re: Has anyone managed to get global protect pre-logon to work???

Gregoux — Thu, 20 Jun 2013 11:56:19 GMT

for the prelogon you need to configure the user login and the user password from the setting of global protect agent.

and reboot the client pc, the global protect agent started as a service and try to connect with the credential that provide in the setting of the agent, in fact you are connected without opening a windows session. you can benefit of the update for your pc via vpn like that.

Re: Has anyone managed to get global protect pre-logon to work???

VinceM — Thu, 20 Jun 2013 13:55:25 GMT

Hi,

Just keep in mind that for pre-logon connexion, just password can be light. Maybe could be better for you to make authent with password and cert.

Re: Has anyone managed to get global protect pre-logon to work???

MalcolmMaynes — Thu, 20 Jun 2013 14:22:09 GMT

Hi all,

I have the pre-logon user set. On the client i have entered the pre-logon username and password and ticked the 'remember' me box.

I get no errors, the connection shows up on the remote users window on the Palo. I reboot the laptop but i dont get a connection before the logon prompt.

Re: Has anyone managed to get global protect pre-logon to work???

gswcowboy — Thu, 20 Jun 2013 19:04:36 GMT

are you using machine certificate to assist with connecting as a pre-logon user?

Re: Has anyone managed to get global protect pre-logon to work???

MalcolmMaynes — Fri, 21 Jun 2013 08:39:31 GMT

Yes, machine certificate is setup and working fine...

Re: Has anyone managed to get global protect pre-logon to work???

Retired Member — Mon, 24 Jun 2013 09:06:46 GMT

Can you paste your GlobalProtect configuration in XML format?

Re: Has anyone managed to get global protect pre-logon to work???

MalcolmMaynes — Tue, 25 Jun 2013 13:48:27 GMT

How do i save the client config as XML ?

Re: Has anyone managed to get global protect pre-logon to work???

Retired Member — Tue, 25 Jun 2013 13:53:42 GMT

Refer to: https://live.paloaltonetworks.com/docs/DOC-3552

If it is possible paste lines between <globalprotect>...</globalprotect>

Re: Has anyone managed to get global protect pre-logon to work???

gswcowboy — Tue, 25 Jun 2013 14:19:28 GMT

you'll need to provide snippet of the pangp service debug logs for further assistance here. specifically where the log indicates an error to connect. might provide code to shed more light on the matter

Re: Has anyone managed to get global protect pre-logon to work???

jmenon — Tue, 25 Jun 2013 15:41:49 GMT

Refer to configuration tech note

Another useful document

Re: Has anyone managed to get global protect pre-logon to work???

MalcolmMaynes — Tue, 02 Jul 2013 08:15:43 GMT

Hi All,

I managed to get it working with help from Exclusive Networks Support. The problem was with the root CA.