topic Global Protect Client in General Topics

Global Protect Client

djrodb — Wed, 14 Dec 2011 15:49:54 GMT

I'm using radius (rsa) to authenticate GP users and can't get me head around the GP client configuration - specifically the section where you need to put a username and password. How can this be possible when the RSA token changes every minute?

Can someone shed some light on this please

Thanks

Rod

Re: Global Protect Client

djrodb — Wed, 14 Dec 2011 15:58:16 GMT

I should follow up with the following:

I want to use the SSL functionality of the PA and not the full blown GP features. I'm trying to get the same functionality as the older netconnect client.

Thanks.

Rod

Re: Global Protect Client

jnguyen — Wed, 21 Dec 2011 01:08:25 GMT

RSA SecurID Ready Implementation Guide

https://live.paloaltonetworks.com/docs/DOC-1370

https://gallery.emc.com/docs/DOC-2151?viewTab=collateral&version=3

Re: Global Protect Client

djrodb — Thu, 22 Dec 2011 10:26:17 GMT

Sorry I should have been more specific.

Before we updated to 4.x we used net connect to connect to the PA using SSL VPN. We used our RSA tokens to authenticate. I already had RSA configured and working.

The problem we have is since moving to PA 4.x. The global connect client requires a username and password as part of it's configuration. My question is how can you put a password in this field when the RSA tokens changes every 60 seconds. its not viable.

How can users who are using RSA tokens and have a RSA radius profile set up on the PA for authenticaiton actually authenticate without having to put a token passcode into the global protect password every time they connecto the the PA?

Somethings missing and I can't figure it out....

Thanks

Rod

Re: Global Protect Client

hosmanr — Thu, 22 Dec 2011 16:13:06 GMT

We are having this same issue with no apparent resolution for the issue. We are pushing through support to get some answer so we can move forward otherwise we will need to stay on the 4.0.x code base as we have a mandate from the outside for two-factor in remote access.

Re: Global Protect Client

FlexyZ — Fri, 23 Dec 2011 09:31:33 GMT

I have not been using the globalconnect that much, but I am also aiming for using a 2factor authentication.

Right now I use the normal user/pass approach. So it dont work if you type in a new password in the globalconnect client before hitting the "connect" function?

Thanks

Re: Global Protect Client

saburkhalid — Tue, 22 May 2012 17:52:41 GMT

Has Anybody resolved this issue yet becasue I am in the same boat and our customers are not happy. Because of the auto authentication function we keep locking the OTP and the accounts which is very annoying and my customer is thinking of moving.

Re: Global Protect Client

kkeeton — Thu, 17 Jan 2013 23:39:59 GMT

I would recommend another solution for VPN personally, the RSA/GP solution is not enterprise ready to say the least.

My recommendation if you want to move with this LDPAP auth the portal, RSA the gateway