Matching client config not found

[seanmccoy]

I have a user trying to connect via Global Protect from a Win 11 client. The error is "matching client config not found".  I have no issues at all connecting as that same user from a Win 10 client. Also we use Mini Orange for MFA which sends an SMS code to the user.

[aleksandar.astardzhiev]

Hi @seanmccoy ,

The error indicates that connecting user does not match any of the user config you have defined. First you need to identify if the error is returned by GP Portal or GP Gateway. You should be able to confirm this from GP logs on the firewall -> Monitor -> GlobalProtect Logs, check at what stage of the VPN connection the error is created.

After that look at the relevant agent config (GP Portal -> Agent -> config, or GP Gateway -> Agent -> config). Focus on the "Config Selection Criterias":

- Are you matching config by user/user groups?

- Are you matching config by device OS?

- Are you matching config by device checks?

- Are you matching config by custom checks?

Step 6 from this guide show where those checks are configured - https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-portals/define...

Confirm that you user is matching all of the check for at least one agent configs

[seanmccoy]

Good morning @aleksandarastardzhiev,

So the same version of the GP client works fine on Win 10 but not Win 11. Based on your troubleshooting suggestions, it appears the issue lies within the gateway based on what I'm seeing in the GP traffic log. GP client version is 5.2.8-23 on both Win 10 and Win 11 clients.

[seanmccoy]

I opened a case with PAN support. They indicated 5.2.10 and higher is recommended for Win 11. I downloaded 5.2.10 and activated it. After upgrading on a Win 10 client, I'm now getting that same matching client config not found error.

[aleksandar.astardzhiev]

Hi @seanmccoy ,

I would strongly recommend to follow the recommended version here - https://live.paloaltonetworks.com/t5/customer-resources/support-pan-os-software-release-guidance/ta-...

Especially for GP it is very useful to be on the latest preffered version (it is quite common to see bug for HIP failing to correctly identify OS, AV or something else).

Back to your question - without looking at your configuration I am shooting in the dark. But before reviewing the config I don't like to jump on search for bugs.

If you said that user is failing to match GP gateway config, this narrow down the problem - because GP gateway agent/client config selection criteria are only based on user, os (and public source ip/region).

Shooting in the dark again - is there any changes for Win10 and Win11 user authentication? How users are authenticated when login to Windows? On-prem AD or Azure AD? Any difference for the two OS?

What I could imagine (as happened to us) is that Win 11 is using AAD, where user is login with UPN (user principle name), which cause group mapping to fail and the connecting username is not mapped to the user group used in GP gateway config.

Are you able to share GP logs from the firewall for the failed and successfull login? Obfuscate the sensitive info (username, ip, gp name, etc)

[seanmccoy · Accepted solution]

Hello again @aleksanderastardzhiev ,

PAN support had me delete the DAT files from c:\users\username\AppData\Local\Palo Alto Networks\GlobalProtect on the Win 11 client. I was able to connect and then upgraded to 5.2.10. After upgrade, I had to again delete those DAT files and then user was able to successfully connect to GP on Win 11.