About rix_jborgen

I'm looking to rollout GlobalProtect to my company and trying to do it properly the first time around.  We need need pre-login VPN capabilities and I've got that functioning with the user-based pre-login but I know it's also available to do using a certificate.  In my testing this worked but required the certificate to be installed on the machine ahead of time for pre-login or post-login connection.  I'm trying to roll this out in such a fashion that users can connect from home devices if needed but not be required/need to do pre-login because they would obviously not be on company-issued devices and we don't really want to burden them or IT with installing a certificate on every home computer now or in the future.   My question is has anyone come up with a single deployment that can be used to cover both company issued and BYOD devices that will invoke pre-login only if the situation matches (ie - the certificate exists therefore pre-login is performed)?  I'd really like to be able to set things up in this fashion but haven't found a way to do this thus far.  If anyone had thoughts or ideas I would be most grateful.  Thank you! ... View more

Hi everyone, I am hoping someone may have seen this before and may have some guidance.  I have a fully functioning GlobalProtect OnDemand system with LDAP + SAML setup and working well outside of the pre-login.  Once logged in, everything works as expected - the Portal authenticates you with LDAP and then the Gateway pops the webpage (using GP, not default browser) and prompts for SAML.  Pre-login wise if I switch to only LDAP, no SAML, it works great, but I need SAML for my 2FA provider.  The issue is that the browser that GlobalProtect pops does not run the necessary JavaScript to function so SAML is never requested.  It instead errors out on line 0 and the browser just has a spinning wheel on it.   I've already added the 2FA provider's domain to first the Trusted Sites and then the Intranet zone and ensured all things scripting are set to run, as it looks like an IE/Internet Options issue.  I've also tried setting GP to use the default browser but none of those seem to do the trick.  I have a ticket in with the vendor (SAASPASS) but I thought I'd check here too because I don't know that this problem is specific to them.  If anyone had any thoughts that would be much appreciated.  Thanks!   Script error pops first Then the browser pops and spins forever ... View more