topic Re: Login with globalprotect before windows login in General Topics

Login with globalprotect before windows login

gyrodude — Wed, 01 Apr 2020 11:01:23 GMT

Is it not possible in some way to launch the client from the Windows login screen, create a tunnel with the users credentials, and THEN log in to Windows? Or is the only way going the machine certificate route?

Re: Login with globalprotect before windows login

reaper — Wed, 01 Apr 2020 12:37:38 GMT

before having logged on to windows, the OS does not permit this sort of user interaction, so only machine level vpn can be set up

Re: Login with globalprotect before windows login

kiwi — Wed, 01 Apr 2020 12:37:51 GMT

Hi @gyrodude ,

Are you referring to pre-logon ?

Basic GlobalProtect Configuration with Pre-logon

Hope this helps,

-Kiwi.

Re: Login with globalprotect before windows login

reaper — Thu, 02 Apr 2020 13:24:00 GMT

@gyrodude TIL this is a new feature in PAN-OS 9.0:

Pre-Logon Followed By Two-Factor and SAML Authentication

The GlobalProtect app for Windows and Mac endpoints now supports pre-logon followed by two-factor or SAML authentication for user login. After the pre-logon tunnel is established, the user can log in to the endpoint and authenticate using the configured authentication method. If authentication is successful on Windows endpoints, the pre-logon tunnel is seamlessly renamed to User tunnel and the GlobalProtect connection is established. If authentication is successful on macOS endpoints, a new tunnel is created and the GlobalProtect connection is established.

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-release-notes/pan-os-9-0-release-information/features-introduced-in-pan-os-9-0/globalprotect-features.html