topic Global Protect VPN Unique ID's and one user allowed in General Topics

Global Protect VPN Unique ID's and one user allowed

Solomonsands — Fri, 23 Feb 2018 23:17:39 GMT

Hello all,

I have a requirement for the following and short of any draconian methods, I'm hoping that the PA GP will be able to answer.

These are PAN8.0.7 on 5520's in Active/Passive

I have a req to ensure that a user of GP is only allowed one GP session at a time. No sharing sessions or passwords. Options explored inlude a unique ldap group or unique tunnel to every user. This will scale poorly and create a nigthmare for management. Is there a better way? I've seen one thread discussing a Feature Request #4603 but I dont see any public ledger for this

Along with that, I'm looking for a way to generate a unique user ID per vpn session. I see there are timestamps for logins but these are granular to HHMMSS. I've chekced with PA TAC that they cannot be modified to display miliseconds, so using this as a unique ID is a hard sell, so I'd like to see a proper implementation.

I'm totally ready ti move to 8.1.0 when available, perhaps this release has the capabilities if not already there?

Re: Global Protect VPN Unique ID's and one user allowed

Remo — Fri, 23 Feb 2018 23:39:09 GMT

Hi @Solomonsands

So far this is still not possible. You can vote for the FR, but at the moment thats all - unfortunately.

There is an (ugly) workaround with kicking out users that are logged in more than once, but thats not what what you're searching for.

Regards,

Remo

Re: Global Protect VPN Unique ID's and one user allowed

Solomonsands — Sat, 24 Feb 2018 00:04:03 GMT

Your suggested solution would be satisfactory, actually. Is There a knowledge base or article available to aid me in configuring this?

@Remo

Re: Global Protect VPN Unique ID's and one user allowed

Remo — Sat, 24 Feb 2018 11:10:04 GMT

Hi @Solomonsands

As far as I know there is no knowledgebase article for this. This is a workaround I created by myself and also used on our GP gateways, because we also did not want to have the same users logged in more than once.

Anyway what I did is writing this powershell script. This script can then run every 10s, 30, 60s or whatever you chose. Every time the script runs, it checks the logged in users and if a user is logged in more than once only the current session remains and the other GP sessions will be terminated.

As I said ... ugly ... but for me it was sufficient, maybe also for you ...

Edit: I deleted the script here because I created a ned topic specially for this: https://live.paloaltonetworks.com/t5/General-Topics/How-to-limit-concurrent-GlobalProtect-connections-per-user/m-p/202128#M59665

Re: Global Protect VPN Unique ID's and one user allowed

Solomonsands — Sat, 24 Feb 2018 00:40:56 GMT

Got it. Makes sense to just use the API instead. I can't use MS systems in my environment so this will have to be re written for bash or python. Thank for the perspective