topic Re: GlobalProtect client can't authenticate anymore after upgrade to 4.1 in General Topics

GlobalProtect client can't authenticate anymore after upgrade to 4.1

ZEBIT — Thu, 29 Mar 2018 10:17:05 GMT

We have upgraded our firewall to version 8.1 and the GlobalProtect agent to 4.1.

We use a certificate to authenticate with our GlobalProtect Agent but after the upgrade (8.0.5 and 4.0.3) nobody can't authenticate anymore.

In the logs I always see this:

First

'GlobalProtect portal user authentication succeeded. Login from: 10.1.2.10, Source region: 10.0.0.0-10.255.255.255, User name: STSCH@zeb.be, Auth type: client certificate.Client OS version: Microsoft Windows 10 Pro , 64-bit

After:
GlobalProtect portal client configuration failed. Login from: 10.1.2.10, Source region: 10.0.0.0-10.255.255.255, User name: STSCH@zeb.be, Client OS version: Microsoft Windows 10 Pro , 64-bit

Re: GlobalProtect client can't authenticate anymore after upgrade to 4.1

Mick_Ball — Thu, 29 Mar 2018 10:41:37 GMT

is the portal/agent/config set to any user/group

Re: GlobalProtect client can't authenticate anymore after upgrade to 4.1

ZEBIT — Thu, 29 Mar 2018 11:13:18 GMT

But now it is set to a specific security group in our Active-Directory. I'm member of this group and it worked before!

You solution works, but I would really like the Active Direcotry group.

Re: GlobalProtect client can't authenticate anymore after upgrade to 4.1

ZEBIT — Thu, 29 Mar 2018 11:31:35 GMT

I think I see what the problem is. I needed to install new UserID agents (8.1.0-66) and my users doesn't get mapped properly.

Re: GlobalProtect client can't authenticate anymore after upgrade to 4.1

Mick_Ball — Thu, 29 Mar 2018 13:01:09 GMT

i was not offering it as a solution, because of the log output that you provided it was obvious that the issue was with agent permissions.

Re: GlobalProtect client can't authenticate anymore after upgrade to 4.1

ZEBIT — Thu, 29 Mar 2018 14:40:39 GMT

The problem is in the PanOS version 8.1 and userID agent 8.1. UserID indentification does not work in the releases.

If you use this in your company don't upgrade to 8.1.0