About SteveMcBride

Finally solved this. Basically needed to add the account under the Windows > Settings > Email and Accounts > Add a work or school account.     After that we get a window that pops up and asks which account to sign in with. I have had a couple of corner cases where some PCs insist on using the user configured default browser which then signs them in with the "other" SAML creds. I think this issue is because of another GP Client configuration that allows for the default browser to be utilised even though this profile does not allow it.        ... View more

Any one managed to solve this issue? In essence the GP client seems to just leverage the default PC login credentials for the authentication. In this instance we do not want to use login credentials but the credentials from a different organisation.  I can only assume this is some sort of setting on the PC itself as other "non-domain" domain joined PCs are prompted to choose which account to utilise. I have tried logging out of the account on my browsers and have also tried deploying registry keys to prevent SSO logins. Nothing works and we continue to receive login errors due to the wrong user credentials been automatically submitted.   ... View more

So I did use the groups in security policies but that is more a component of UserID rather than the setup for the VPN access. My deployment utilises a single portal and gateway but has multiple agent configurations that are mapped to the returned groups. In this way I am able to provide different split tunnel settings, agent settings and so forth ... View more

I recently utilised RSA to authenticate GLobalProtect users. I leveraged ISE/RADIUS to do this and found it fairly straightforward with the RADIUS sending back group mappings to the Palos in the access-accept. These group mapping sent from the radius have to match with the group mapping configured for the globalprotect profile.    My struggle was more related to getting the out of sync, new pin messages to present but this came down to issues between ISE and the PAs.             ... View more

Hi all,   thanks for your replies. I have done further works and would like to share my finding and/or errors 😜   Basically what I have found to date is that I can't get this to work successfully with anything other than PAP. Initially I utilised EAP-GTC and am able to successfully authenticate and connect when there is no token issue. Problem with EAP-GTC is when next tokencode mode is invoked the messages just will not appear on the GP client. When I change the protocol back to PAP the prompts and tokencode process work as expected.   I have not been able to ascertain whether the issue is with ISE, Palo or indeed the RSA 8.1 server. I am going to post this on the other appropriate forums to see what I find and will update this post accordingly. I mainly post in case anyone else has this issue in the future. ... View more