GLOBAL PROTECT single user multiple session restriction settings

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

GLOBAL PROTECT single user multiple session restriction settings

L0 Member

Hi , is there a way to configure global protect to single session for a user? Currently one user can have multiple session (basically diff people can login using that one user acc).

I researched and found PA does not have that feature yet, but it can be done via API. However this is a very sensitive secure network, im not keen in messing with scripts into the system.

6 REPLIES 6

Community Team Member

Hi @N.Rana ,

 

I am not currently aware of such a feature, but I would recommend that users should not be using a single account for access in a highly sensitive network. Users should have their own accounts created for individual use. 

LIVEcommunity team member
Stay Secure,
Jay
Don't forget to Like items if a post is helpful to you!

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

hi,

yes but my issue is say i created a user acc for u, chances are i am able to connect using your user acc while you are connected as well.. basically having multiple sessions with a single user acc

Yes that is possible and for our users with more than one device it works well.

You really need to introduce a more secure form of authentication like certificate or OTP/MFA to prevent this from ever being possible.

Cyber Elite
Cyber Elite

Hello,

I believe the question is 'can we ensure that one user can only have one connection at a time'? Meaning a user cannot connect from two systems into the same portal/gateway. I know this was not possible in the past, however wondering if this feature has been added. @JayGolf @Mick_Ball 

Regards,

Cyber Elite
Cyber Elite

@N.Rana 

You can monitor this through a script and boot any subsequent connection from the same user, however this isn't something built-in that you can just enable. There's an existing FR4603 that you can add your vote to, however @Remo  put together a script a while back that he graciously shared with the community HERE.  

L2 Linker

 

I know that this is an old post but I would like to share an update for anyone looking for a solution.

 

In order to achieve that I created a external & standalone program to limit concurrent GlobalProtect sessions/connections per unique user. It can be accessed herehttps://github.com/enginy88/PAN-GPLimiter

This topic also discussed here: https://live.paloaltonetworks.com/t5/general-topics/pan-gplimiter-limit-concurrent-globalprotect-ses...

Hope this helps!

  • 1565 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!