About PeterKeller

Hey community,    we have solved this case together with PA Engineers.   For those who are fighting with the same issues here the problem analysis and solution.   Problem: - Starting the iPhone and as long as it belongs in the "locked mode" WiFi is disabled and it has no access to user certificates (this setting has changed with iOS15). - Mobile Data can already be used for certain processes, so the Global Protect also loads its profile and gets the information to authenticate the user for VPN using the OS Rule iOS with the option "SAML or certificate". And this is the problem, no access to user certificate and it is trying to authenticate with SAML what is not proper possible with the iPhones. So it keeps trying this and run in a timeout.   Solution: Delete all iOS and any OS user authentication rules and then there is a fallback rule which is only using certificate.  And here we go, couple of seconds after you unlock your iPhone VPN is connected.  Something you have to know.   Here is what the Engineer wrote:   Update from PA : Below are the steps which can be followed: 1) In the GlobalProtect User Authentication settings, ensure there are entries for each OS that is in your client base with the appropriate authentication. 2) Delete any entry with OS as ANY or iOS. 3) Push the changes to Prisma. 4) Manually open the GP client and connect to GP. 5) Test the GP connectivity on the iOS by rebooting it (both Wifi and Mobile Data). 5) Revert the changes back to the way it was after the test.   Hope this can help some others too.   Can be closed.   Thanks Peter ... View more