GLOBAL PROTECT single user multiple session restriction settings

[N.Rana]

Hi , is there a way to configure global protect to single session for a user? Currently one user can have multiple session (basically diff people can login using that one user acc).

I researched and found PA does not have that feature yet, but it can be done via API. However this is a very sensitive secure network, im not keen in messing with scripts into the system.

[JayGolf]

Hi @N.Rana ,

I am not currently aware of such a feature, but I would recommend that users should not be using a single account for access in a highly sensitive network. Users should have their own accounts created for individual use. 

[N.Rana]

hi,

yes but my issue is say i created a user acc for u, chances are i am able to connect using your user acc while you are connected as well.. basically having multiple sessions with a single user acc

[Mick_Ball]

Yes that is possible and for our users with more than one device it works well.

You really need to introduce a more secure form of authentication like certificate or OTP/MFA to prevent this from ever being possible.

[OtakarKlier]

Hello,

I believe the question is 'can we ensure that one user can only have one connection at a time'? Meaning a user cannot connect from two systems into the same portal/gateway. I know this was not possible in the past, however wondering if this feature has been added. @JayGolf @Mick_Ball 

Regards,

[BPry]

@N.Rana 

You can monitor this through a script and boot any subsequent connection from the same user, however this isn't something built-in that you can just enable. There's an existing FR4603 that you can add your vote to, however @Remo  put together a script a while back that he graciously shared with the community HERE.