GlobalProtect portal client configuration failed

[MHamad]

Hello,

I am facing an issue with Global Protect. I have users coming in from 2 different domains and after an upgrade from PAN OS 7.0.5-h2 to 7.0.9, users from the second domain are no longer able to connect.

The error message is that: You are not authorized to connect to the Global Protect Portal.

I have verified that the user is part of the group which is configured in the Portal configuration and that even the authenciation is succeeding.

In the client logs, I see (username masked):

<response>
	<type>portal</type>
	<status>Disconnected</status>
	<protocol/>
	<portal-config-version>0</portal-config-version>
	<error>You are not authorized to connect to GlobalProtect Portal.</error>
	<product-version>2.2.2-3</product-version>
	<product-code>&quot;{E8B1936D-DF39-4BE1-87F9-6A53A90A93D5}&quot;</product-code>
	<portal-status>No portal configuration</portal-status>
	<user-name>xxxxxxxx</user-name>
	<state>Disconnected</state>
	<check-version>no</check-version>
	<mdm-is-enabled>no</mdm-is-enabled>
</response>

In the Palo Alto System logs, I see (IP and username masked):

Event: globalprotectportal-config-fail 
Description: GlobalProtect portal client configuration failed. Login from: 1.1.1.1, User name: xxxxxx

Maybe I am hitting a bug on PA?

Thanks,

[Roby_Sreejith]

is the client version is cmpaible with new relaese 

[MHamad]

I tried using the GP version 2.3.5 agent as well and am facing the same.

[MHamad · Accepted solution]

Okay, so after some tinkering, a colleague found the issue.

It seems that the groups had to be included in the Goup Include list in the Group mapping which wasn't present. After adding the groups against which the PA was assigning portal configuration, it now works fine.