Is it possible to host a Global Protect Portal and Gateway on the same outside interface as IPSEC VPNS

I'm trying to set up a global protect gateway on an interface that already has a couple IPSEC VPN tunnels on it. But I am unable to browse to the page to download the client. After some checking I realized that I'm not even able to ping this interfac

Global Protect authentication happened twice while LDAP and Okta Auth

Recently we moved  to PA-3410 software version 11.0.1-h2 from PA-850  software version 10.2.3-h4 .

on both firewalls

We have selected option for authentication override 

On Portals
Generate cookie for authentication overri

"failed to open message queue" error for one user but not others

Greetings all.  CentOS 8 user is unable to run globalprotect from the CLI; gets "Cannot connect to local gpd service."  The PanGPA process never starts for the user, either automatically or manually.  In user's PanGPI.log, the errors are:

Global Protect

Hi Friends,

We have a customer who is using global protect.

Two HIP profiles are configured for two different groups. One for AD users and one for Local users.

The requirement is if local user tries to login he should get the hip profile banner set

MFA on PAN-OS Firewall (okta integrated) redirects on GP instead of browser for HTTP resources.

I have MFA deployed on the firewall ( okta integrated), based on implementation if user is accessing http/https based resources then redirect will happen in Browser however, for non-http applications MFA will prompt on GP client App,

Please note port

GlobalProtect Web Portal - Domain Validation Code (DVC) - /.well-known/pki-validation

Does anyone know how to go about performing domain validation for an IP address for the GlobalProtect Portal?

This is a standard supported by most Certificate providers but I can't find anything about it when searching Palo Alto's site.  With this

GlobalProtect session disconnected while I using remote session

Hi All,

I got issue that Global Protect session disconnected while I using remote session. As I understanding that I need to set setting "User Switch Tunnel Rename Timeout (sec)". Am I correct? if yet where can I set this setting and guide me please.

Users connected to on-prem GP gateways which are managed by Panorama

Hello - 

I have users that are connected to on-prem GP gateways which are managed by Panorama and I would like to have these on-prem GP users mapped to an Infoblox server.

Is there any way to do this?

GP 6.0.6 - Cookie expired only from mobile phone

Hi,

we have PA-850 and we deployed GP 6.0.7 for desktops and 6.0.6 version for mobile phones.

The authentication is based on SAML via Azure and every connection from desktops works flawlessly.

Recently we started receiving complaints from users that

Group Login condition Azure Groups

Hi,

We are using our on prem LDAP to fetch groups on the Palo. For GP authentication as well, we are using group in

1) GP Portal > Agent > Config Selection Criteria > User/User Group

2) GP Gateway > Agent > Client Settings > Config Selection Criteria

SAML cookies and global protect cookies

Hi,

If I am using SAML authentication on my portal and gateway what is the best practice around Authentication cookies override.

When using SAML my user will be prompted via the default browser 2 times ones for the portal and ones for the gateway.

upgrade Global Protect Client

We need to upgrade Global Protect Client from 5.2 to 6.2.7 ,

Is the direct upgrade would be possible or do we need to upgrade to any intermittent OS.