GlobalProtect machine pre-logon coverted into a user connection without user certificate in device

Reply
L3 Networker

GlobalProtect machine pre-logon coverted into a user connection without user certificate in device

Hi there, we are facing a weird situation with GlobalProtect pre-logon connections.

 

  • We have some laptops with machine certificate only (they do not have user certificates deployed).
  • We want them to connect using this machine certificate, as "pre-logon", so they got limited/specific access to some company resources
  • They are able to establish GP VPN connection but their session is a normal user connection instead of a pre-logon connection because, somehow, the Machine Certificate value is used as if it were a user. So, in short, this is what I'm saying:
    10.png11.png

 

These are some useful logs I found in the Tech Support files:

 

2021/01/14 13:23:05 info globalp GP-Por globalp 0 GlobalProtect portal client configuration generated. Login from: xxx.xxx.xxx.xxx, Source region: ES, User name: 7836523f-2a31-4e61-8583-252ad100fc62, Client OS version: Microsoft Windows 10 Pro , 64-bit, Config name: GP-Agent-HUB01-On-Demand.

 

2021/01/14 13:23:11 info globalp GP-Gat globalp 0 GlobalProtect gateway user login succeeded. Login from: xxx.xxx.xxx.xxx, Source region: ES, User name: 7836523f-2a31-4e61-8583-252ad100fc62, Client OS version: Microsoft Windows 10 Pro , 64-bit.

 

2021/01/14 13:23:11 info auth auth-su 0 Certificate validated for user '7836523f-2a31-4e61-8583-252ad100fc62'. From: xxx.xxx.xxx.xxx.

 

2021/01/14 13:23:12 info globalp GP-Gat globalp 0 GlobalProtect gateway client configuration generated. User name: 7836523f-2a31-4e61-8583-252ad100fc62, Private IP: 10.x.x.39, Client version: 5.1.3-12, Device name: COMMXTF47SVPGIT, Client OS version: Microsoft Windows 10 Pro , 64-bit, VPN type: Device Level VPN.

 

 

And this is the GlobalProtect Portal profile they are matching as per the logs (GP-Agent-HUB01-On-Demand):

 

9.png8.png7.png6.png5.png4.png3.png2.png1.png

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!