For details on cookie usage on our site, read our Privacy Policy
LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2
- LIVEcommunity
- Discussions
- General Topics
- Re: LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
LSVPN Satellites unable to sign-in to the portal after upgraded to PAN OS 10.1.2
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-01-2021 08:43 PM
Hello,
We have upgraded the PAN OS to the latest version 10.1.2 on 3 of 5 PA firewalls, including the LSVPN portal, and 2 of the satellite firewalls.
The thing is that 2 of the satellite firewalls with the latest PANOS 10.1.2 are unable to log in with the portal.
Auth Method: Satellite Auth Cookie
Error (Portal Side): cookie is invalid and no username, Invalid authentication cookie...
Error (Satellite Side): GlobalProtect Satellite connection to portal failed. Satellite failed to connect to Portal <portal url> due to invalid http response.
The rest of the satellites firewall with the PAN OS(10.0.x) are works as usual. No changes were made on the LSVPN configuration, both of the portal and the satellite.
Please help.
Thanks!
- Mark as New
- Subscribe to RSS Feed
- Permalink
05-19-2022 02:47 AM
Our customer is facing the same issue starting with 10.1. Unfortunately, the LSVPN authentication cookie used after an initial authentication (username/password) is expiring after 6 months! From an operational view, this creates a lot of headaches. Is there a way to carry out a (controlled) forceful re-authentication to re-new the lifetime of the authentication cookie?
- Mark as New
- Subscribe to RSS Feed
- Permalink
07-20-2022 04:57 AM
@rgafner I guess.. no. At least I will be moving away from LSVPN to plain IPsec-tunnels because I'm not going to re-authenticate manually every 6 months for each of the devices we have.
- Mark as New
- Subscribe to RSS Feed
- Permalink
07-20-2022 06:15 AM - edited 07-20-2022 06:17 AM
Or actually.. looked into this. You can use XML API to refresh the portal configuration (haven't tested this though.. :D) with something like:
wget -o/dev/null https://your-firewall-hostname/api/ --post-data='?type=op&cmd=<request><global-protect-satellite><get-portal-config><username>your-username</username><password>your-password</password><satellite>configured-satellite</satellite></get-portal-config></global-protect-satellite></request>&key=your-api-key'
And scheduling that against all of your satellites.
- Mark as New
- Subscribe to RSS Feed
- Permalink
08-24-2022 12:15 AM
Do you have any idea what the change will be?
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
