Incorrect password expiry notice in GlobalProtect

JimMcGrady — Thu, 23 Jul 2020 00:39:03 GMT

My client is running GP 5.0.8 clients to a 9.0.9 Palo Alto gateway. Globalprotect doesn't seem to be using the fine granular password expiry details from AD. Its saying the password will expire in 6 days when it wont actually expire for many months. Is there a setting i must change to have GP reference the correct source for password expiry in AD?

Re: Incorrect password expiry notice in GlobalProtect

kiwi — Thu, 23 Jul 2020 10:17:01 GMT

Hi @JimMcGrady ,

Can't say 100% for sure you're hitting this issue but there was an expiry issue fixed in GP 5.1 (GPC-8743):

https://docs.paloaltonetworks.com/globalprotect/5-1/globalprotect-app-release-notes/gp-app-release-information/globalprotect-addressed-issues

Also you might want to check if the FW is able to fetch the correct expiry date in the logs:

> tail follow yes mp-log authd.log :

https://live.paloaltonetworks.com/t5/general-topics/global-protect-password-expire/td-p/36143

That said, if you're indeed hitting a known bug then you will have to reach out to support to get a confirmation on that.

Cheers,

-Kiwi.

topic Incorrect password expiry notice in GlobalProtect in General Topics

Incorrect password expiry notice in GlobalProtect

Re: Incorrect password expiry notice in GlobalProtect