Globabprotect on demand mode

[jdprovine]

I have configured the GP agent to be on demand mode so you have to manually have to login in and it won't automatically log you in. But the client on my machine is still trying to login in automatically, is there another setting that has to be changed?

[rsriramoju]

Hi Jprovine,

Generally if a user puts his PC in sleep mode while being connected to Global Protect, based on the inactivity timeout that user will be kept logged on. As of now the minimum timeout is 120mins.

- It is suggested that upon GP usage, the user should Disconnect from the Client and then put PC in Sleep mode.

Also please check the below Document

https://live.paloaltonetworks.com/docs/DOC-2811

-regards

Rajiv

[jdprovine]

I did read that document earlier and was thinking that you can't have SSO on and on demand because it would still try to logon automatically because of the single sign on. Of course if you didn't have the password remembered it still wouldn't login because there is no password

[jdprovine]

So has anyone configured and using on demand mode for their globalprotect vpn client. If so can you share your configuration with me

[Zewwy]

Do you have multiple Agent Configurations setup on your Portal settings? if yes, ensure that your account is a member of only one of them.to

We use AD groups to tell which users are "On-Demand" vs Auto connect, and its pretty straight forward and working without issue for me. If you are using MS AD Groups ensure your account is getting the proper SID for that group.

[jdprovine]

I have three agent configurations configured.  My account is only a member of one of the two ad groups that are being pointed to for credential for example we have one agent for "students" it is an ad group, I do not exist in it and the student client is pointed to the correlating ad group. We have a second client called staff, it has an ad group I am a part of and the client is point to it for credentials