topic Re: Global Protect does not connect after computer installation in General Topics

Global Protect does not connect after computer installation

Remo — Tue, 25 May 2021 10:44:25 GMT

Hi community

During the still ongoing pandemic, this issue is a little painful...

We use sccm to install windows and additional software to computers. One of this additional software is global protect. The intention was to install the computer in the office by the client team and then send the device to the employees. With Pre-Logon actually it should be possible to log in to the computer directly even if this active directory account was not logged in at that time.

The problem now is that global protect does not connect after this computer installation. As msiexec params we use the following:

CANCONTINUEIFPORTALCERTINVALID="no" CONNECTMETHOD="pre-logon" CANSAVEPASSWORD="no" PORTAL="******************" CANCHANGEPORTAL="no" USESSO="no"

Does anyone know a sollution which makes global protect opening the connection directly after the installation or at least after a reboot after the installation? As soon as a user loggs in global protect connects and this setting then also persists for the next reboots - global protect then connects already prior to the user login (as it should with the pre-logon setting).

Btw: The firewall where the client should connect to is running PAN-OS 9.1.9 and the used Global Protect version is 5.2.6.

Thanks,

Remo

Re: Global Protect does not connect after computer installation

aleksandar.astardzhiev — Wed, 26 May 2021 09:03:33 GMT

Hi @Remo ,

Couple of months ago we have some transparent upgrade from 5.0 to 5.1 failing on random computers. From the logs I noticed that the transparent upgrade client is running batch file msiexec to uninstall and install the new msi with all of the required parameters.

I am saying this because since that I am using the exact same command to re-install GP remotely and it seems the pre-logon to work after reboot. This is what is working for me:

TARGETDIR="C:\Program Files\Palo Alto Networks\GlobalProtect" CONNECTMETHOD="pre-logon" USESSO="yes" CERTIFICATESTORELOOKUP="user-and-machine" CACUNPLUGBEHAVE="yes" USEPROXY="yes" PORTAL="vpn.portla.wow" BENICE="yes" /l+* "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPMsi.log

Comparing with what you have probably you can try where to look for the client certificate. Although looking at the docs it seems user-and-machine should be default and not need to specify it.

Re: Global Protect does not connect after computer installation

kiwi — Wed, 26 May 2021 13:12:28 GMT

Hi @Remo ,

Please check the following document which explains your requirement. Step 11 more specifically:

https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-quick-configs/remote-access-vpn-with-pre-logon.html

Please correct me if I misunderstood you.

Cheers !

-Kiwi.

Re: Global Protect does not connect after computer installation

nikoolayy1 — Mon, 31 May 2021 20:02:29 GMT

You can also test the feature "Connect Before Logon" that is even before the user logs into his computer.

https://docs.paloaltonetworks.com/globalprotect/5-2/globalprotect-app-new-features/new-features-released-in-gp-app/connect-before-logon

Another thing is if you are using "enforce network access" you may need to exclude some ip addresses from this:

https://docs.paloaltonetworks.com/globalprotect/5-1/globalprotect-app-new-features/new-features-released-in-gp-app/enforce-globalprotect-exclusions.html

Re: Global Protect does not connect after computer installation

Remo — Mon, 31 May 2021 22:48:34 GMT

Hi @nikoolayy1

As we intend to use Windows Hello, we cannot use this connect button on the loginscreen (it is only available with the global protect login option).

At the moment the vpn connection is not enforced for network access.