topic Re: Global Protect CLient "Startup Before Login" in General Topics

Global Protect CLient "Startup Before Login"

eputnam — Fri, 19 Oct 2012 21:36:31 GMT

Is there a way to have the Global Protect client interface show up before a user logs into Windows? For example, They want to manually connect to VPN before they login to their Windows machine. Thanks

Re: Global Protect CLient "Startup Before Login"

gswcowboy — Sat, 20 Oct 2012 04:45:35 GMT

This is not plausible as Single Sign On option uses windows credentials upon login to connect to GP portal and gateway respectively. On demand mode, well allows users to connect, on demand.

Re: Global Protect CLient "Startup Before Login"

acamacho — Thu, 25 Oct 2012 15:15:05 GMT

As my colleague stated that is not plausible, so you might want to contact your local SE and have them submit a feature request to see if this will be possible in future releases.

Thank you

Re: Global Protect CLient "Startup Before Login"

mikand — Thu, 25 Oct 2012 16:08:15 GMT

Hopefully this is already addressed in soon to be released PANOS 5.0 which will have the "preauth" capabilities (using a machine cert to setup the global protect tunnel so its up and running when the client logins to the AD which then UserID will be able to pick up). This way you can setup security rules where userid=preauth to let those boxes to WSUS and AV-update servers and not until the user is actually authed to the domain they will be able to pass specific userid rules or where userid=known-user.

Re: Global Protect CLient "Startup Before Login"

gswcowboy — Tue, 06 Nov 2012 20:10:37 GMT

Pre-logon connection is available in PANOS 5.0. GlobalProtect can be configured to establish a connection using an already deployed machine certificate. VPN connection will be established before the user logs onto the machine. Please refer to the PANOS 5.0 documentation and perhaps your local Sales SE if 5.0 is an option for you and your environment before you deploy.