topic Re: GlobalProtect portal client configuration failed in General Topics

GlobalProtect portal client configuration failed

MHamad — Mon, 05 Sep 2016 08:39:56 GMT

Hello,

I am facing an issue with Global Protect. I have users coming in from 2 different domains and after an upgrade from PAN OS 7.0.5-h2 to 7.0.9, users from the second domain are no longer able to connect.

The error message is that: You are not authorized to connect to the Global Protect Portal.

I have verified that the user is part of the group which is configured in the Portal configuration and that even the authenciation is succeeding.

In the client logs, I see (username masked):

<response>
	<type>portal</type>
	<status>Disconnected</status>
	<protocol/>
	<portal-config-version>0</portal-config-version>
	<error>You are not authorized to connect to GlobalProtect Portal.</error>
	<product-version>2.2.2-3</product-version>
	<product-code>&quot;{E8B1936D-DF39-4BE1-87F9-6A53A90A93D5}&quot;</product-code>
	<portal-status>No portal configuration</portal-status>
	<user-name>xxxxxxxx</user-name>
	<state>Disconnected</state>
	<check-version>no</check-version>
	<mdm-is-enabled>no</mdm-is-enabled>
</response>

In the Palo Alto System logs, I see (IP and username masked):

Event: globalprotectportal-config-fail 
Description: GlobalProtect portal client configuration failed. Login from: 1.1.1.1, User name: xxxxxx

Maybe I am hitting a bug on PA?

Thanks,

Re: GlobalProtect portal client configuration failed

Roby_Sreejith — Mon, 05 Sep 2016 12:46:43 GMT

is the client version is cmpaible with new relaese

Re: GlobalProtect portal client configuration failed

MHamad — Tue, 06 Sep 2016 05:13:36 GMT

I tried using the GP version 2.3.5 agent as well and am facing the same.

Re: GlobalProtect portal client configuration failed

MHamad — Wed, 07 Sep 2016 09:06:00 GMT

Okay, so after some tinkering, a colleague found the issue.

It seems that the groups had to be included in the Goup Include list in the Group mapping which wasn't present. After adding the groups against which the PA was assigning portal configuration, it now works fine.