Is Palo Alto Globalprotect Always On mode possible only for the portal?

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Is Palo Alto Globalprotect Always On mode possible only for the portal?

L6 Presenter

Hello to All,



Is it possible to set the Globalprotect Always-ON mode enable Single Sign On, so that the user automatically logs into the portal but after that the user to need to authenticate to the gateway?



The idea is that for the portal and gateway different authentication methods are used and the gateway authentication method does not use the Windows credentials. This why also the cookie override option is not used.


I currently don't have a test firawall to test such setup with the Always-ON mode.


L7 Applicator

I would assume that if you have different auths for portal and gateway then the user should be auto prompted for the gateway credentials by default, are you not seeing this,,,   what is your gateway auth method?

Cyber Elite
Cyber Elite

you can use cookies (set to a long expiration) to always be authenticated to the portal, but use regular authentication for the gateway

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization
  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!