GlobalProtect localDb auth change password

[BigPalo]

Hi,

I want to configure global protect to authenticate with localDB users. My doubt is if its possible to change the password for the different users when they connect with GP the first time. We would need local users accessing the GP to be able to manage password changes themselves.

Is that possible? what config should be done?

Thanks

[JayGolf]

Hi @BigPalo ,

You can set auth to the Local DB,  but it does not support user-initiated password changes via GlobalProtect. If you are looking for self-service password management, consider using LDAP, RADIUS, or SAML.

[BPry]

@BigPalo,

Using the Local DB is not something that I recommend. I had a customer demand it and what we ended up doing was building out automation to get the phash values and place them in the configuration and update things through the API and a custom web front-end. It was very customized and took a lot to implement properly.

I would highly recommend just setting up a RADIUS server (something like FreeRADIUS) and simply using that with local users instead, that way you can allow them to update their passwords and manage things off of the firewall. This can run on any old desktop that you have laying around easily and doesn't really require much from a basic configuration installation.