Palo Alto Networks - Global Protect error: Failed to get client configuration

[rjhardy90]

We have configured the application in Azure, and imported the profile on the palo. We have set up the gateway and portal and authentication profile. The logs on the Palo and Azure show as successful but when a user tests connecting via Global Protect client they get an auth failed. The Palo Global protect logs show failed to get client configuration. Anyone ever had this issue before?

[Mick_Ball]

Have you restricted GP to certain users or groups...   the authentication is working but seems the palo cannot find an agent config for them...

[Arne]

Had the same issue yesterday, I am using Cloud Identity Engine to sync users and machine objects to the palo.

Under Network - Global Protect - Portals - Agent - Config Selection Criteria - Device Checks the Serial Number Check was set to "no", I changed it to "none" and everything worked.

Lesson learned, test the portal and gateway with no config selection criteria checks.

[Netwerk-iSOFT]

Hi Arne,

I had the same issue, and this exactly did it for me. I wonder what the default setting is, as I never encountered this on my other Palo Alto firewalls.

Thanks!

[EricMikota]

Thanks, Arne! I just had this issue today with our new GlobalProtect Portal on VM-Series. Changing the Serial Number Check from "no" to "none" allowed me to connect. Prior to that, I was also getting the "Global Protect error: Failed to get client configuration" error. Glad I found your post on this as I had checked everything else I could think of and it all looked good. Never would've thought of changing that setting and you saved me hours!

[J.Jacobsen]

Had a similar issue over the last few weeks and discovered that the "mail" attribute on our user accounts weren't all populated with their email address, or had their old email address or simply an incorrect value in that field.  Soon as I fixed that for the affected users, they were then able to finish authenticating, but before that I was getting auth failures and the failed to get client config stuff.

Not sure if anyone else is having this issue, but worth sharing I figured.  Enabling this different auth method produced some interesting challenges.