GlobalProtect Pre-Logon Windows 10 Issue

[dpsarras]

Hello!

I am facing a problem with pre-logon on windows 10. I have some windows 10 laptops that works fine but few of them have the problem below.

I have import the  local machine certificate and change registry entries. If I sign out from windows, I can see the pre logon option and connect to my vpn. But when i restart or shutdown the laptop, when it comes to the windows login screen, I dont have any option for pre logon. That means that i have first to login with a cached user , log off and here they are the start global protect option. 

Any advice?

Thanks a lot

[fatboy1607]

Do a check on following :-

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup

Prelogon Value should be 1.

Check your machine certificate status.

your machine certificates it should contain private key.

Check certificate chain for machine certificate.

Troubleshooting logs what error do you see ?

[SirchRettop]

Just wondering if there was a resolution with this?

From research apparently changing the Pre-Logon Tunnel Rename Timeout to 0 might help.

This setting controls how GlobalProtect handles the pre-logon tunnel that connects an endpoint to the gateway.

A value of -1 means the pre-logon tunnel does not time out after a user logs on to the endpoint; GlobalProtect renames the tunnel to reassign it to the user. However, the tunnel persists even if the renaming fails or if the user does not log in to the GlobalProtect gateway.

A value of 0 means when the user logs on to the endpoint, GlobalProtect immediately terminates the pre-logon tunnel instead of renaming it. In this case, GlobalProtect initiates a new tunnel for the user instead of allowing the user to connect over the pre-logon tunnel. Typically, this setting is most useful when you set the 

Connect Method

 to 

Pre-logon then On-demand

, which forces the user to manually initiate the connection after the initial logon.

A value of 1 to 600 indicates the number of seconds in which the pre-logon tunnel can remain active after a user logs on to the endpoint. During this time, GlobalProtect enforces policies on the pre-logon tunnel. If the user authenticates with the GlobalProtect gateway within the timeout period, GlobalProtect reassigns the tunnel to the user. If the user does not authenticate with the GlobalProtect gateway before the timeout, GlobalProtect terminates the pre-logon tunnel.

[pete_b]

Having this issue now - did you ever get it resolved?
Cheers

[AKoutoulas]

Hello all,

In case someone else is facing this issue

1. Make sure the registry's Prelogon Value is 1, as Fatboy1607 already mentioned.

2. Make sure you imported the correct certificates on the machine/user store on the endpoints

3. As per the PA doc, if you have different configs for prelogon and other users, make sure the connect method is prelogon.

And here is what fixed the same issue I had:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001UgXCAU&lang=en_US%E2%80%A...

Checking PanGPS, I found out that PanGPS found a user session, so it skipped the pre-logon tunnel establishment, and continued with the normal user connection establishment

Once I disabled that Windows 10 feature mentioned on the link above, pre-logon tunnel was working as expected

Kind regards,

Apostolos

[Alex_Kalbfell]

I owe you big time. Was struggling with this for a long time until I finally came across your post. Thanks a lot!