topic Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2 in General Topics

LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

yanchen — Sat, 02 Oct 2021 03:43:16 GMT

Hello,

We have upgraded the PAN OS to the latest version 10.1.2 on 3 of 5 PA firewalls, including the LSVPN portal, and 2 of the satellite firewalls.

The thing is that 2 of the satellite firewalls with the latest PANOS 10.1.2 are unable to log in with the portal.

Auth Method: Satellite Auth Cookie

Error (Portal Side): cookie is invalid and no username, Invalid authentication cookie...

Error (Satellite Side): GlobalProtect Satellite connection to portal failed. Satellite failed to connect to Portal <portal url> due to invalid http response.

The rest of the satellites firewall with the PAN OS(10.0.x) are works as usual. No changes were made on the LSVPN configuration, both of the portal and the satellite.

Please help.

Thanks!

Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

yanchen — Sun, 03 Oct 2021 01:19:04 GMT

The problem was solved.

1. If the portal firewall were upgraded to the PAN-OS 10.1.X, then the satellites should be upgraded to 10.1.x as well, otherwise satellites will fail to log on to the portal with the error: "GlobalProtect Satellite connection to portal failed. Satellite failed to connect to Portal <portal url> due to invalid http response."
2. The enrollment credentials on the satellite side should be re-authenticated after being upgraded to 10.1.x.

Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

MatthewSabin — Thu, 13 Jan 2022 23:13:04 GMT

Will 10.0.x clients not be able to get authenticated (or renew certificates) until they're upgraded?

Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

yanchen — Fri, 14 Jan 2022 05:07:49 GMT

If the portal running 10.1.x and the satellites are running 10.0.x, then yes, the satellites are unable to get authenticated until they are upgraded to the same version as the portal firewall currently running.

According to the response from Technical support that the PAN-OS version running on all firewalls should be the same as of Portal firewall.

Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

tigeli — Sat, 16 Apr 2022 19:01:45 GMT

According to the 10.1 and 10.2 documentation plain serial number is still enough to register devices on the portal but.. it is not. Engineering made undocumented change to the product.. I have no problem with the change itself but it would be nice this would have been documented in the "changes to default behaviour" and in the product documentation itself how to register satellites to the portal.

--cut--

Prior to PAN-OS 10.1, the GP LSVPN Portal would register and authenticate the GP LSVPN Satellite either based on the Serial Number or Authentication Profile (username/password credentials)

To enhance the security for GP LSVPN Satellite registration and authentication, PAN-OS 10.1 added the Satellite Cookie Validation mechanism that uses both the Serial Number and Authentication Profile (username/password credentials) to register and authenticate the GP LSVPN Satellite.

--cut--

Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

rgafner — Thu, 19 May 2022 09:47:23 GMT

Our customer is facing the same issue starting with 10.1. Unfortunately, the LSVPN authentication cookie used after an initial authentication (username/password) is expiring after 6 months! From an operational view, this creates a lot of headaches. Is there a way to carry out a (controlled) forceful re-authentication to re-new the lifetime of the authentication cookie?

Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

tigeli — Wed, 20 Jul 2022 11:57:54 GMT

@rgafner I guess.. no. At least I will be moving away from LSVPN to plain IPsec-tunnels because I'm not going to re-authenticate manually every 6 months for each of the devices we have.

Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

rgafner — Wed, 20 Jul 2022 12:14:45 GMT

There will be changes regarding this in 10.1.7

Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

tigeli — Wed, 20 Jul 2022 13:17:07 GMT

Or actually.. looked into this. You can use XML API to refresh the portal configuration (haven't tested this though.. :D) with something like:

wget -o/dev/null https://your-firewall-hostname/api/ --post-data='?type=op&cmd=<request><global-protect-satellite><get-portal-config><username>your-username</username><password>your-password</password><satellite>configured-satellite</satellite></get-portal-config></global-protect-satellite></request>&key=your-api-key'

And scheduling that against all of your satellites.

Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

UrosSustar — Wed, 24 Aug 2022 07:15:36 GMT

Do you have any idea what the change will be?

Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

rgafner — Wed, 24 Aug 2022 07:54:23 GMT

Contact Jason Baucom for details

Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

UrosSustar — Mon, 12 Sep 2022 13:06:07 GMT

If you are using LSVPN in combination with ZTP, just forget about it and go directly to static tunnels, since the automated portal authentication won't be possible for some time.

Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

leitzf — Thu, 12 Jan 2023 01:29:31 GMT

After a ton of troubleshooting this, I figured out that removing the device serial number from the network > portal > satellites > satellite device list seems to clear the stored cookie on the portal. This then prompts the satellite to re-authenticate using username/password, which you can do via an automated method. I'm running 10.1.8-h2, so your mileage might vary depending on your version

Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

UrosSustar — Tue, 09 May 2023 11:52:12 GMT

"This then prompts the satellite to re-authenticate using username/password, which you can do via an automated method" - how did you manage to automate U/P?

Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

leitzf — Tue, 09 May 2023 20:13:54 GMT

There is a CLI command available that you can use to script:
request global-protect-satellite get-portal-config username @username password @password satellite @satellite

Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2

fjwcash — Wed, 18 Oct 2023 16:12:58 GMT

So, those of us who use certificate-based authentication are basically screwed, if we have 10.1.x running on our Portal/Gateway and 8.x or 9.x running on the Satellites? There's no username or password associated with the setup.