topic Re: meaning of source-user pre-logon in General Topics

meaning of source-user pre-logon

nwsol — Mon, 26 Nov 2012 07:52:40 GMT

Hi,

Can anyone explain what the option "pre-logon" means as a value for source-user in a security policy?

I can't find anything about it. Not in the build in help, the admin guide nor the CLI reference.

Re: meaning of source-user pre-logon

mikand — Mon, 26 Nov 2012 08:31:20 GMT

Its a new feature in PANOS 5.0 which is described in the release notes:

Pre-logon Connection – The pre-logon option is part of the GlobalProtect agent configuration and is used to preserve pre-logon and post-logon services provided by a corporate infrastructure regardless of where the user machine is located. By doing this, a company can create a logical network that maintains the security and management features normally achieved by a physical network. Tunnel selection and establishment occurs pre-logon based on machine certificates. Examples of some of the services that can be maintained include: Active Directory group policy enforcement, drive mapping to server resources, and the ability to receive central software deployment downloads while working remotely. One specific example of how the pre-logon feature works is remote users forget their passwords, a helpdesk admin can reset their domain passwords and the users can log in with the new password because the VPN is already established and direct domain authentication will work.

So in short, Globalprotect can establish a VPN-tunnel before the user is authenticated in his/her machine (using machine cert).

This way you can for example set user=pre-logon to access AD, DNS, AV, WSUS. And the other rules can have user=ad-group(s) or user=userX,userY... for your other systems.

Re: meaning of source-user pre-logon

James — Mon, 26 Nov 2012 08:35:43 GMT

Also an exert from the 5.0 admin guide:

****************************************************************************************************************************************************************

– pre-logon—Select this option to preserve pre-logon and post-logon services provided by a corporate infrastructure regardless of where the user machine is located. GlobalProtect will establish a connection prior to user login to the computer. By doing this, a company can create a “logical network” that maintains the security
and management features normally achieved by a physical network. Tunnel selection and establishment happens pre-logon based on machine certificates that need to be pre-deployed on client systems outside of GlobalProtect.
Examples of some of the services that can be maintained include: Active Directory group policy enforcement, maintaining drive mapping to server resources, and the ability to receive central software deployment downloads while remote. One specific example of how the pre-logon feature works is if a remote user forgets his/her password, since GlobalProtect would connect and use the cached credentials and establish a VPN before the login prompt even appears, a domain administrator could reset the user’s password as if they were logged in directly to a domain controller on the physical network.

****************************************************************************************************************************************************************

Thanks

James

Re: meaning of source-user pre-logon

nwsol — Mon, 26 Nov 2012 08:42:14 GMT

So, the pre-logon user value is linked to global protect?

I indeed found it in the admin guide under global protect. But there's no mention about the two things being linked.

Re: meaning of source-user pre-logon

djrodb — Mon, 10 Dec 2012 09:02:36 GMT

Hi,

I'm hitting the same issue. Can you or anyone clear up pre-logon definition? for example do I need to create a user called pre-logon on the PA and create a security rule matching the GP VPN or do I create a pre-logon user in AD? or do I not need to create a pre-logon user ID?

I've got pre-logon partly working. The pre-logon feature fails with the error' user domain\pre-logon failed authentication' invalid username/password'

However when I log into the laptop with my AD credentials the GP client authenticates.

Rod

Re: meaning of source-user pre-logon

djrodb — Mon, 10 Dec 2012 09:51:32 GMT

I've resolved my problem. Please refer to https://live.paloaltonetworks.com/message/21662#21662