Hello team,
I created this post to share my experience resolving recent issues related to GlobalProtect on iPad devices.
We have some users with iPads who attempted to connect to GlobalProtect using SAML-based authentication; however, after the users logged in with their credentials, the GlobalProtect application displayed the following error "Connection Failed or The Connection TimeOut or Timeout Expired", and the iPad lost its internet connection:
GLOBAL PROTECT IPAD CONNECTION TIME OUT
We found the following cause for this behavior (we were using the user login mode):
CAUSE
- GlobalProtect iOS application only supports SAML authentication for on-demand connect method (Manual user-initiated connection) due to Apple VPN framework limitation.
- When Always-on mode is deployed to iOS devices, the Apple device blocks the internet connection and since SAML authentication requires internet, it will not work.
- When using a VPN profile in conjunction with MDM, the onDemandEnabled option behaves the same as the GP "Always-on" mode. Thus, SAML authentication is not supported on iOS devices when a VPN profile is used with onDemandEnabled = 1.
As a solution we create a agent
RESOLUTION
To allow iOS iPhone or iPad to work with Global Protect, we need to have On-demand as the connect method over the Portal, after that, the iPads can now connect without any issue, as shown below:
GLOBAL PROTECT PORTAL CONNECTION METHOD
GLOBAL PROTECT CONNECTED
The best way to accomplish the same is to configure a new Agent instance only for IOS devices and move it to the top of the list,
With the above configuration, the new Agent will take care of iOS iPad and iPhone clients. All other clients will use the second Agent in the list and are not affected.
Thank you for your time, and I hope this information is helpful in your daily cybersecurity work. I would greatly appreciate your support by liking or accepting this answer as the solution; it would help me a lot in becoming a CyberElite!
Best Regards,
Daniel Romero
Senior Network/Security Engineer
PANW Partner
GlobalProtect NGFW VM-Series
