06-20-2019 05:43 AM
I have a strange and critical issue. I have Always-on type global protect with cert based username and OTP authentication method on handful of user machines. I have set the captive portal timeout for 0 and enforce network access under portal app settings.
these users each have 2 machines.whenever the user changes his AD password on a different machine, the one with globalprotect doesn't connect to the network and says the connection is unauthenticated. How does GP interfere with user AD creds? As I mentioned earlier, I am using firewall issued certificate and RADIUS based OTP authentication method.
TIA.
06-20-2019 08:14 AM
Although you are not using SSO, you could set "Use single sign-on (windows only)" to "No" in your portal app config.
may seem a bit random but it has caused me issues in the past.
06-20-2019 09:14 AM
@Mick_Ball thank you so much for the suggestion. I am going to try it now. Did this fix your issue?
06-20-2019 09:23 AM
it did fix my issue but for a different reason.
after a version update the authentication overide was not working correctly and in the system log on the firewall i could see the AD username failing OTP. the username for the OTP was different to the AD account so thats what gave it away..
I only offer it as a suggestion as this is the only setting I know regarding AD auth...
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
