topic Re: Globalprotect client failing authentication in General Topics

Globalprotect client failing authentication

jbland — Wed, 18 Jan 2012 15:31:18 GMT

We have had several instances where our end users are not able to connect with the globalprotect client since upgrading to PANOS 4.1. When I check the system log file I see the following errors

2012/01/18 09:45:03info globalp portal globalp 0 GlobalProtect portal user authentication failed. Login from: 208.54.35.242, User name: USER, Reason: Authentication failed: Invalid username or password .

2012/01/18 09:45:03info general auth-fa 0 User 'USER' failed authentication. Reason: User is in locked users list From: 208.54.35.242.

2012/01/18 09:45:02info globalp portal globalp 0 GlobalProtect portal user authentication failed. Login from: 208.54.35.242, User name: USER, Reason: Authentication failed: Invalid username or password .

2012/01/18 09:45:02info general auth-fa 0 User 'USER' failed authentication. Reason: User is in locked users list From: 208.54.35.242.

If I force an IP address change on the end user's PC then I can connect. I've tried looking for a lock file for specific IP addresses but have not been successful in finding anything of the sort. Can someone please point me in the right direction?

We are running Panos v 4.1.0 and globalprotect client 1.1.1. We use Radius on windows 2008 server and pan agent to authenticate.

Thanks in advance,

James

Re: Globalprotect client failing authentication

jbland — Wed, 18 Jan 2012 21:56:48 GMT

Looks like some of these erros may be due to password change notices. I will run some tests.

Re: Globalprotect client failing authentication

kamish — Sat, 21 Jan 2012 14:51:12 GMT

You are not the only one having this issue.

We have a couple PA-500s in our environment and upon upgrading to 4.1.2 from 4.0.5 Apps-and-Threats 288-1251 would fail to install and sync to the HA Peer. We also upgraded our GlobalProtect Client to version 1.1.1 from 1.0.5 and GlobalProtect stopped working externally. It would get hung up on "Connecting" and fail to connect. Upon testing, we reverted to our previously installed versions of GlobalProtect and Software and GlobalProtect then works. However, the "panupv2-all-contents-288-1251.tgz" still will not install properly and sync to the HA Peer.

Staying in our known working config until this gets fixed...

Re: Globalprotect client failing authentication

mikand — Sat, 21 Jan 2012 21:28:00 GMT

Kamish: I do hope you filed this as a bug to the support (or are you expecting other customers to do that? :P)