"Advanced View" in GlobalProtect Client won't be locked after version 1.1.6

[paloalto.netfos]

Hi, all,

In normal, "Advanced View" in GlobalProtect client will be locked if I configure to cancel "Enable advanced view" option in GlobalProtect Portal, and it will check the GlobalProtect portal information automatically after rebooting, so that client user cannot modify the settings easly.

But after GlobalProtect version 1.1.6, I found it won't be checked automatically after rebooting and client user can modify the settings, it must connect to GlobalPortect gateway one time then "Advanced View" will be locked. The situation is also found in version 1.2.x ( e.g. version 1.2.2 ), it's a issue of security control for my customer.

Is it normal ? or a bug ?

How to fix it ? or I need to open a case to report it ?

Thanks,

Sample Wu

[sraghunandan]

Are you using on-demand or SSO?

[paloalto.netfos]

Hi, sraghunandan,

I used "On Demand" mode,

Thanks,

Sample Wu

[sraghunandan · Accepted solution]

I think it is working as expected now.  With On-demand GlobalProtect agent will not automatically connect to the gateway. Instead the user will have to manually connect to the gateway by clicking to connect on the agent icon.

So in your case after a reboot the client won't connect to pull up the config instead the user has to initiate a connection, after which we will pull up the latest config.

[paloalto.netfos]

Hi, sraghunandan,

I got it, so, the behavior between 1.1.5 and 1.1.6 are changed to will not initiate connection with gateway automatically, right ? If yes, I think it's working as expected as you said.

For the workaround, could I enable both of "On Demand" mode and "SSO" mode to make it a behavior that be initiated with gateway after a reboot every time ?

Thanks,

Sample Wu