Global Protect Client

[djrodb]

Hi

I'm using radius (rsa) to authenticate GP users and can't get me head around the GP client configuration - specifically the section where you need to put a username and password. How can this be possible when the RSA token changes every minute?

Can someone shed some light on this please

Thanks

Rod

[djrodb]

I should follow up with the following:

I want to use the SSL functionality of the PA and not the full blown GP features. I'm trying to get the same functionality as the older netconnect client.

Thanks.

Rod

[jnguyen]

RSA SecurID Ready Implementation Guide

https://live.paloaltonetworks.com/docs/DOC-1370

https://gallery.emc.com/docs/DOC-2151?viewTab=collateral&version=3

[djrodb]

Hi

Sorry I should have been more specific.

Before we updated to 4.x we used net connect to connect to the PA using SSL VPN. We used our RSA tokens to authenticate. I already had RSA configured and working.

The problem we have is since moving to PA 4.x. The global connect client requires a username and password as part of it's configuration. My question is how can you put a password in this field when the RSA tokens changes every 60 seconds. its not viable.

How can users who are using RSA tokens and have a RSA radius profile set up on the PA for authenticaiton actually authenticate without having to put a token passcode into the global protect password every time they connecto the the PA?

Somethings missing and I can't figure it out....

Thanks

Rod

[hosmanr]

We are having this same issue with no apparent resolution for the issue. We are pushing through support to get some answer so we can move forward otherwise we will need to stay on the 4.0.x code base as we have a mandate from the outside for two-factor in remote access.

[FlexyZ]

I have not been using the globalconnect that much, but I am also aiming for using a 2factor authentication.

Right now I use the normal user/pass approach. So it dont work if you type in a new password in the globalconnect client before hitting the "connect" function?

Thanks

[saburkhalid]

Has Anybody resolved this issue yet becasue I am in the same boat and our customers are not happy. Because of the auto authentication function we keep locking the OTP and the accounts which is very annoying and my customer is thinking of moving.

[kkeeton]

I would recommend another solution for VPN personally, the RSA/GP solution is not enterprise ready to say the least.

My recommendation if you want to move with this LDPAP auth the portal, RSA the gateway