topic Re: Global Protect not passing last login information? in General Topics

Global Protect not passing last login information?

rgreens — Thu, 11 Sep 2014 13:34:06 GMT

We have a few vendors who have AD accounts, but only connect to Global Protect to SSH to specific servers. They don't use any other domain resources. When we look in the domain controllers there is no last login information. So our policy to disable unused accounts after 21 days keeps disabling active accounts.

Anyone know how to get it to pass this information?

Thank you,

Randy

Re: Global Protect not passing last login information?

hshah — Thu, 11 Sep 2014 13:38:07 GMT

Hi Randy,

I am rephrasing the question, correct me if I am wrong.

Question : How to find out unused GP users for last 21 days?

If that is the question, you can not readily pull out that information from Firewall.

However, system logs have information about GP user login/logout activity. You should forward it to syslog server. And do the analysis from login/logout logs.

Let me know if that helps.

Regards,

Hardik Shah

Re: Global Protect not passing last login information?

ajbool — Thu, 11 Sep 2014 13:43:40 GMT

I think he means; how can a user logging into Global Protect cause the last-logged-in timestamp held in Active Directory to be updated.

Re: Global Protect not passing last login information?

rgreens — Thu, 11 Sep 2014 13:45:03 GMT

ajbool, correct. I can see in the Palo Alto the last login for Global Protect, but in the Domain Controllers in doesn't update the last login information.

Re: Global Protect not passing last login information?

hshah — Thu, 11 Sep 2014 13:45:30 GMT

Hi Ajbool,

When user tries to login, firewall sends credentials to AD for verification. So, AD should have that log in security logs.

Regards,

Hardik Shah

Re: Global Protect not passing last login information?

hshah — Thu, 11 Sep 2014 13:46:58 GMT

Hello Rgreens,

This appears to be AD log issue, try to deep dive into security logs of AD.

I dont think there is any issue with firewall, if user is authenticated than firewall must have forwarded request to AD.

Regards,

Hardik Shah

Re: Global Protect not passing last login information?

Retired Member — Fri, 12 Sep 2014 06:20:59 GMT

just check AD settings for logging that.

Not a firewall issue.

Re: Global Protect not passing last login information?

rgreens — Thu, 18 Sep 2014 13:51:43 GMT

The issue is with AD in the fact the Palo Alto's are only using "simple bind" with the LDAP lookup. From what I found the AD should use lastlogonTimeStamp instead of lastlogon for "simple bind." However it appears it is still not accurate. Showed a user last logged on 7 days ago, but the are currently logged on.