topic Re: about global protect agent default behavior in General Topics

about global protect agent default behavior

paloalto.netfos — Sun, 17 Mar 2013 08:55:36 GMT

Hi All,

Is there any one knowing that global protect client will cash or keep user credential in the local? is the default behavior or not?

Our PA runs PanOS 4.1.10 and global protect client's version is 1.1.7.

Thanks.

Regrads,

Joy

Re: about global protect agent default behavior

Retired Member — Sun, 17 Mar 2013 09:33:08 GMT

Hi,

Why do you need that information and which credentials you mean ?

Re: about global protect agent default behavior

emr_1 — Sun, 17 Mar 2013 13:29:45 GMT

If you permit to save it and client users are able to save their ID/PW, it will be save in client device.

You can decide it under Network tab > Global Protect Portal > <config name> > Agent tab > Use can save password.

This configuration is enabled by default.

Regards,

Re: about global protect agent default behavior

paloalto.netfos — Sun, 17 Mar 2013 14:23:32 GMT

Hi All,

Thanks for feedbacks, quickly descrip my question below.

1.Use AD LDAP for sslvpn authentication

2.User-ID group-mapping is also use for after sslvpn login security policy control

3.The group-mapping -> Include group is also add groups into that would like to authenticated.

4.Two accounts in the AD who are "test_user" and "test.user".

In the beginning test_user can login sslvpn by global protect agent, and can hit correct security policy. for testing, we change user to "test.user" and do the test again, we find the user "test.user" can login sslvpn successfully, but the traffic logs we see, the user column is display "test_user" not "test.user".

We also check system logs, test.user is always try to login but authenticated fail. after several times, the system logs show user "test_user" login successfully.

After investigation, the user "test.user" is not in group-mapping include groups, so system logs display auth-fail, but it seems the GP agent brought account "test_user" to authenticae with PaloAlto firewall automatically, and auth-success.

So, we would like to know that is the global protect agent default behavior? or not?

In addition, we change another laptop and to the same again, but issue not occured.

My laptop runs windows 7 x86 and GP client's version is 1.1.7.

Regards,

Re: about global protect agent default behavior

Retired Member — Sun, 17 Mar 2013 15:41:12 GMT

if you did not see the issue on another laptop, I think you have to focus on differences between these 2 client pc.

I did not see any issue like that before and configured many global protect environments.

Re: about global protect agent default behavior

paloalto.netfos — Sun, 17 Mar 2013 16:20:37 GMT

I did not see the issue before too, I think that should be the issue of first laptop itself, however just only a confusion, "why"?