GLOBAL PROTECT single user multiple session restriction settings

[N.Rana]

Hi , is there a way to configure global protect to single session for a user? Currently one user can have multiple session (basically diff people can login using that one user acc).

I researched and found PA does not have that feature yet, but it can be done via API. However this is a very sensitive secure network, im not keen in messing with scripts into the system.

[JayGolf]

Hi @N.Rana ,

I am not currently aware of such a feature, but I would recommend that users should not be using a single account for access in a highly sensitive network. Users should have their own accounts created for individual use. 

[N.Rana]

hi,

yes but my issue is say i created a user acc for u, chances are i am able to connect using your user acc while you are connected as well.. basically having multiple sessions with a single user acc

[Mick_Ball]

Yes that is possible and for our users with more than one device it works well.

You really need to introduce a more secure form of authentication like certificate or OTP/MFA to prevent this from ever being possible.

[OtakarKlier]

Hello,

I believe the question is 'can we ensure that one user can only have one connection at a time'? Meaning a user cannot connect from two systems into the same portal/gateway. I know this was not possible in the past, however wondering if this feature has been added. @JayGolf @Mick_Ball 

Regards,

[BPry]

@N.Rana 

You can monitor this through a script and boot any subsequent connection from the same user, however this isn't something built-in that you can just enable. There's an existing FR4603 that you can add your vote to, however @Remo  put together a script a while back that he graciously shared with the community HERE.  

[enginy]

I know that this is an old post but I would like to share an update for anyone looking for a solution.

In order to achieve that I created a external & standalone program to limit concurrent GlobalProtect sessions/connections per unique user. It can be accessed here:  https://github.com/enginy88/PAN-GPLimiter

This topic also discussed here: https://live.paloaltonetworks.com/t5/general-topics/pan-gplimiter-limit-concurrent-globalprotect-ses...

Hope this helps!