Global protect AD strange issue

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Global protect AD strange issue

L4 Transporter

I have a strange and critical issue. I have Always-on type global protect with cert based username and OTP authentication method on handful of user machines. I have set the captive portal timeout for 0 and enforce network access under portal app settings.

these users each have 2 machines.whenever the user changes his AD password on a different machine, the one with globalprotect doesn't connect to the network and says the connection is unauthenticated. How does GP interfere with user AD creds? As I mentioned earlier, I am using firewall issued certificate and RADIUS based OTP authentication method.

TIA.

3 REPLIES 3

L7 Applicator

Although you are not using SSO, you could set "Use single sign-on (windows only)" to "No" in your portal app config.

 

may seem a bit random but it has caused me issues in the past.

 

 

@Mick_Ball  thank you so much for the suggestion. I am going to try it now. Did this fix your issue?

it did fix my issue but for a different reason.

after a version update the authentication overide was not working correctly and in the system log on the firewall i could see the AD username failing OTP. the username for the OTP was different to the AD account so thats what gave it away..

 

I only offer it as a suggestion as this is the only setting I know regarding AD auth...

  • 3254 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!