Global Protect CLient "Startup Before Login"

[eputnam]

Is there a way to have the Global Protect client interface show up before a user logs into Windows?  For example, They want to manually connect to VPN before they login to their Windows machine. Thanks

[gswcowboy · Accepted solution]

This is not plausible as Single Sign On option uses windows credentials upon login to connect to GP portal and gateway respectively. On demand mode, well allows users to connect, on demand.

[acamacho]

As my colleague stated that is not plausible, so you might want to contact your local SE and have them submit a feature request to see if this will be possible in future releases.

Thank you 

[mikand]

Hopefully this is already addressed in soon to be released PANOS 5.0 which will have the "preauth" capabilities (using a machine cert to setup the global protect tunnel so its up and running when the client logins to the AD which then UserID will be able to pick up). This way you can setup security rules where userid=preauth to let those boxes to WSUS and AV-update servers and not until the user is actually authed to the domain they will be able to pass specific userid rules or where userid=known-user.

[gswcowboy]

Pre-logon connection is available in PANOS 5.0. GlobalProtect can be configured to establish a connection using an already deployed machine certificate. VPN connection will be established before the user logs onto the machine. Please refer to the PANOS 5.0 documentation and perhaps your local Sales SE if 5.0 is an option for you and your environment before you deploy.