topic Re: GlobalProtect and logon scripts in General Topics

GlobalProtect and logon scripts

ldavie — Tue, 24 Dec 2013 19:33:01 GMT

Hello. Is it possible to launch a logon script to map drives after connecting with GlobalProtect in on-demand mode? I know we could create a script to launch manually after a connection to map the drives but would like an automated method.

Thanks!

Re: GlobalProtect and logon scripts

kadak — Wed, 25 Dec 2013 01:19:37 GMT

Hello ldavie,

Currently we do not have the ability for a GP client to launch script after successful tunnel establishment. However I do a see a feature request (FR ID : 2572) submitted to our development team to be included in our future release.

The feature request will include a logon script to include:

1.) Modifying routes on local client

2.) Letting the host setup mapped drives across the tunnel

3.) Re-executing logons so domain GPOs and other things can be accomplished.

You can request your account's SE to vote for it.

Hope that helps!

Thanks and regards,

Kunal Adak

Re: GlobalProtect and logon scripts

HITSSEC — Wed, 25 Dec 2013 02:16:40 GMT

Hello Idavie,

We are using Global Protect with pre-logon authentication (Using a digital certificate). We allow the pre-logon account to access the file shares and domain controllers. This allows our users to have their drive mappings and keep their AD password synced on the laptop with the domain.

Hope this provides an option that might work for you.

Phil

Re: GlobalProtect and logon scripts

ldavie — Thu, 02 Jan 2014 23:29:12 GMT

Thanks for your replies, very helpful!

Re: GlobalProtect and logon scripts

ldavie — Thu, 02 Jan 2014 23:42:06 GMT

Thanks for that idea Phil. I have not tried pre-logon. Just so I understand better you chose pre-logon as the connect method and supplied a cert. Did you create that cert on your own CA against an account in the domain, then import that cert to the firewall and push it out to the clents with AD? I am assuming that with this option the laptops will always be conencted to the VPN when an internet connection is present and they never acurally have to log into it? Does this also happen while they are on the corporate network?

Thanks,

Levin

Re: GlobalProtect and logon scripts

HITSSEC — Mon, 13 Jan 2014 18:50:23 GMT

Levin,

We imported a corporate (Active Directory) cert into PaloAlto and issued a cert (with password) to be installed on corporate laptops. We are looking at having a cert pushed out via a GPO. This allows the user to log into the domain directly. Internal Host detection setting will tell the client if they are on the corporate network. You then see a house in front of the globe as opposed to the shield .

Phil