Globalprotect Portal not generating cookie after login

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Globalprotect Portal not generating cookie after login

L0 Member

Hi everyone,
i ran over an cookie generation issue with my GlobalProtect Portal.
To minimize login requests we are generating Authentication override cookies on the portal side and set the lifetime on the gateway side to 5 minutes.
The first time i connect to the portal (windows client) the cookie is issued and logged in gp logs 'portal-gen-cookie', with the gateway accepting the authentication override.
When i reboot the windows client after 10 minutes and again authenticate against the portal, the portal doesn't generate a new cookie.
The gateway login fails and the gp logs say 'Cookie expired'.
Only when delete the cookie files in localappdata the portal is generating a new one. 
Cookie generation on the gateway side is working on every login, but is not helpful in our case.
Am i missing something?

We are using PAN-OS 12.2.3 and Globalprotect 6.3.3-c1121

2 REPLIES 2

Cyber Elite

Monitor > GlobalProtect

With filter " ( eventid eq portal-auth ) and ( status eq success )" you confirm that workstation authenticates to portal both times?

Maybe GP agent bypassed logging into portal and used cached gateway config during second login?

 

If workstation authenticated to portal both times then filter "( eventid eq portal-gen-cookie )" shows up only for first login event?

Principal Architect @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

When i restart the windows machine, it directs me to the portal everytime.
Cookie lifetime on the gateway side is set to 5 minutes.

First LoginFirst Login

After >5 Minutes
Second Time, no new cookie generatedSecond Time, no new cookie generated

Every login after no new cookie is generated. It stays expired, and i have to authenticate twice...

  • 240 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!