topic Re: Portal Error when using GlobalConnect client in General Topics

Portal Error when using GlobalConnect client

dvanderschoor — Fri, 20 Apr 2012 07:33:41 GMT

We have 1 PA-500 which we recently upgraded from 4.0.5 to 4.1.4.

On 4.0.5 we used the NetConnect client for several users without any problem.
Now we upgraded to 4.1.4 we need to use the GlobalConnect client.

So I downloaded and activated the 1.1.4 client.

I thought it should offer an upgrade when you connect with an old client, so I started my NetConnect client and tried to connect. It failed to connect.

So I upgraded the client manually and and inserted my user/password and the portal.

Connection still fails with the error: Portal Error.

When I open the traffic log i see incoming connections from the Public IP.

Any ideas?

Dennis

Re: Portal Error when using GlobalConnect client

ppatel — Sat, 21 Apr 2012 00:14:28 GMT

Hi Dennis,

Firstly since you upgraded the code from 4.0.x to 4.1.5, Global protect needs to be used as it has replaced SSL VPN .

Second, you can not connect via the old client (Netconnect).

While installing new one you will be prompted for the unistall. Please do so.

Also to check through you configuratio in Global protect I would like you to go through the the following document of the GlobalProtect configuration for users upgrading from NetConnect

NetConnect to GlobalProtect Migration

Portal Error that you are gettings is related to the certificates. Please validate the configuration/migration path from the above document.

Regards,

Parth

Re: Portal Error when using GlobalConnect client

ppatel — Sat, 21 Apr 2012 00:18:30 GMT

I think you upgraded to 4.1.4 and NOT 4.1.5. I overlooked it,

Any way this is true for upgrade to 4.1.x platform.

Regards,

Parth

Re: Portal Error when using GlobalConnect client

dvanderschoor — Mon, 23 Apr 2012 06:21:13 GMT

Hi Parth,

The upgrade wasn't suggested because at that point the firewall was already upgraded to 4.1.4 (not 4.1.5, my mistake) and the VPN wasn't working properly.

I did some more test and I can't figure out how i was ever connected as the logs only report errors.
The main error is that it could not connect to the portal.

Will read the docs and keep you posted

Dennis

Re: Portal Error when using GlobalConnect client

dvanderschoor — Wed, 25 Apr 2012 07:21:19 GMT

Hi,

I haven't changed anything.
Right now i see errors coming in that the username or password is incorrect.

and

User is not in allowlist for <IP address>

Verified the username and password and they ar correct.
Can't find anything about allowing users from a certain ipaddress

The Authentication profile is set to allow users that are member of a certain active directory group.

When i try to use the Globalconnect with a username that is not allow I will get the same error message

Regards,

Dennis

Re: Portal Error when using GlobalConnect client

zarina — Wed, 25 Apr 2012 22:57:55 GMT

Are you using LDAP to pull user groups? Getting the error "User is not in allowlist for <IP address>" indicates an issue with ldap configuration. Can you verify if you have your base DN and bind DN configured correctly?

Re: Portal Error when using GlobalConnect client

dvanderschoor — Thu, 26 Apr 2012 09:40:47 GMT

We use RADIUS for the authentication from Active directory.
if i start typing it will find all AD groups, so RADIUS is working properly

When I allow 'all' then i'm able to connect, but it failed to get passed the discovering network.

Re: Portal Error when using GlobalConnect client

userwat — Thu, 26 Apr 2012 10:04:36 GMT

check "Network->Zones->Enable User Identification" -after my upgrade from 4.0.7 - 4.1.4 was disable by its self.

maybe that will help regards...

Re: Portal Error when using GlobalConnect client

dvanderschoor — Thu, 26 Apr 2012 11:12:22 GMT

User identification is still enabled.

But even if the authentication is working, then it wouldn't get passed the discover network part. Cannot figure out why because nothing has been changed to the network

Re: Portal Error when using GlobalConnect client

mvenkatesan — Thu, 26 Apr 2012 23:18:10 GMT

What are the certificates you have in place for global protect? If you have a root cert, do you have it installed in your PC?

Manish