We have configured GlobalProtect for AlwaysOn using machine certificates for pre-logon. This works fine on both Mac and Windows. In the portal agent config we have also a gateway configured as Manual Only that the users can switch to for getting access to additional resources once they are logged on to their computer. This gateway uses MFA (Radius) authentication with username/otp. This works fine on Windows. Now to the problem: When switching to the 'Manual Only' gateway on Mac, the Username field is pre-populated with the 'username' (i.e. machine name) picked up from the certificate that is used for the pre-logon authentication and it's not possible to change it. Does anyone know if this is a bug or a feature? I've tried various settings in the App Config without success, and as stated it's not locked on Windows clients. PanOS 8.0.14, GP 4.1.7.
... View more