topic Re: Setting Up a Remote VPN using Connect Before Logon in General Topics

Setting Up a Remote VPN using Connect Before Logon

D.Callahan — Thu, 09 Jan 2025 21:22:04 GMT

Looking for some assistance as I am building out a remote vpn using Connect before logon for my Palo Alto.

Does anyone know a simple, easy way to set this up with LDAP. Some article are outdated and some are inconsistent in their approach verse other documents.

Appreciate the help.

Re: Setting Up a Remote VPN using Connect Before Logon

mshekh — Sun, 12 Jan 2025 04:30:38 GMT

Hi @D.Callahan ,

Please refer the below kb related to GP configuration with pre-logon.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEYCA0

Best Regards,

Mohammad Talib

Re: Setting Up a Remote VPN using Connect Before Logon

arusharma — Mon, 13 Jan 2025 03:02:20 GMT

You can start from here config guide: https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-user-guide/globalprotect-app-for-windows/use-connect-before-logon-followed-by-the-authentication-method

https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-apps/deploy-app-settings-transparently/deploy-app-settings-to-windows-endpoints/deploy-connect-before-logon-settings-in-the-windows-registry

Re: Setting Up a Remote VPN using Connect Before Logon

D.Callahan — Mon, 13 Jan 2025 15:23:23 GMT

Hi Mohammad,

Thanks for the link. So are Connect Before Logon and Pre-Logon the same thing?

Re: Setting Up a Remote VPN using Connect Before Logon

mshekh — Mon, 13 Jan 2025 15:40:57 GMT

Hi @D.Callahan ,

Yes, both are the same connect before logon and pre-logon.

Best Regards,

Mohammad Talib

Re: Setting Up a Remote VPN using Connect Before Logon

D.Callahan — Mon, 13 Jan 2025 16:41:37 GMT

Hi Mohammad,

This has been very helpful. Last question, when you say the same connect, do you mean I would follow the same "instructions" in setting up the Palo Alto for the Pre-logon as I would for the "Connect before Logon"? In other words, I could follow a video instruction for the Pre-logon and then make my windows registry modification for the connect before logon and be done?

Re: Setting Up a Remote VPN using Connect Before Logon

arusharma — Tue, 14 Jan 2025 03:57:51 GMT

CBL provides a way to connect to GlobalProtect VPN using user credentials even before the user logs into the Windows machine.

Connect Before Logon (CBL) is different from Pre-logon connect method. Pre-logon relies only on certificate authentication whereas CBL can be used with any authentication type like SAML, Username/Password etc.

CBL is user-triggered, while pre-logon is automatic. The user doesn't need to connect via CBL but can use GP after logging in. Pre-logon starts automatically.