topic Re: Concurrent Global Protect user in General Topics

Concurrent Global Protect user

SamirK — Sat, 15 May 2021 13:47:27 GMT

Need to know how many concurrent connections can have a single user

Re: Concurrent Global Protect user

S.Cantwell — Sat, 15 May 2021 14:37:43 GMT

Look within your session browser (Under the Monitor Tab) and filter on a single IP in question. There is no exact/consistent number or report. It varies by the person.

Re: Concurrent Global Protect user

Abdul_Razaq — Sun, 16 May 2021 10:46:05 GMT

Hi @SamirK ,

Currently, no feature to restrict number of connections from a single user. You can follow the document https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClorCAC and filter with username to see the concurrent connections by a single user.

Re: Concurrent Global Protect user

Remo — Sun, 16 May 2021 15:44:20 GMT

Hi @SamirK

As already written by @Abdul_Razaq , there is no limit of the concurrent connections of a single user. The theoretical max is the max supported vpn connection count of the hardware/vm you are using.

(Quite a while ago I wrote a little script to terminate connections if a user is logged in more than once. So far this is still the only possibility to somehow restrict concurrent connections: https://live.paloaltonetworks.com/t5/general-topics/how-to-limit-concurrent-globalprotect-connections-per-user/m-p/202128#M59665 )

Re: Concurrent Global Protect user

nikoolayy1 — Mon, 17 May 2021 11:02:38 GMT

Because I have seen similar issues like SamirK, so for Globalprotect it is not like the issue with an RDP connection where there is only one session and if a script uses another username to connect the firewall will overwrite the connection ip to user mapping (basically having a limit to just one connection per client source ip) ?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleBCAS

Re: Concurrent Global Protect user

aleksandar.astardzhiev — Mon, 17 May 2021 21:31:59 GMT

Hi @nikoolayy1 ,

No, it is not the same. With the RDP scenario you will have multiple users related to same IP address and instead of keeping both it will override username with the last received.

Having multiple concurrent connections to GlobalProtect for the same user it will create multiple IP addresses related to same username, which is totally fine and all entries will kept. Because each successful login will assing you new IP from the pool.