What is the expected behavior in GlobalProtect pre-login with a single gateway?

[Adrian_Jensen]

I am playing around with a new GlobalProtect configuration, using a pre-login always-on configuration with a single gateway. The pre-login VPN works fine. My understanding is that when a user logins into the PC, the tunnel is supposed to rename itself to the user name. The userID associated with traffic from the endpoint changes to the user, but I see no reconnection in the GlobalProtect logs and the user information for the Gateway Remote Users still shows the user as "pre-logon". I have tried with/without the "Use Single Sign-on" option set, without effect.  The user name under the Gateway Remote Users should change to match the logged-in user correct?

The Pre-Logon Tunnel Rename Timeout value is currently set to the default "-1", which "renames the tunnel to reassign it to the user" unless the renaming fails or the user does not log into the Gateway. It is Always-On so shouldn't the user always auto-logon to the Gateway?

[mshekh]

Hi @Adrian_Jensen ,

Yes your understanding is correct once the user logs on to the machine, the tunnel gets renamed (in Windows) from the 'pre-logon' user to the actual 'user' who logged in to windows machine.

Refer the below kb to review your configuration if everything is configured correctly.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEYCA0

[Adrian_Jensen]

@mshekh 

Yeah, it is not automatically renaming the tunnel from "pre-login" to the actual user with "Pre-Logon Tunnel Rename Timeout = -1". If I manually refresh the VPN then it will switch, otherwise it will remain connected as "pre-login" for days. Setting the Pre-Logon value to 0 seems to force it to immediately reconnect when the user logs in (and change back to "pre-login" when the user logs out). But the -1 value doesn't seem to work as the documentation suggests.