About MHaran

Hi,   We have a Global Protect portal available to our users via a public facing URL.  Question I have is whether the Palo Alto solution can support multiple portals based on the same URL and interface IP to serve different authentication profiles.  Example: All users using the GP Client for connection:   Group of Users (A):  Connect to companya.com  ---> Authenticate against Entrust for Portal ---- >  Authenticate against LDAP for Gateway   Group of Users (B): Connect to companya.com/mfa ---> Authenticate against MFA for portal ----> Authenticate against LDAP for Gateway   CompanyA.com would resolve to the same IP terminating on the same interface but I want to create a sub-domain for users to connect to subtly different URL to pick up different authentication profile but not have to create a different DNS with a different physical interface on Palo to achieve this.   Comments welcome   Regards ... View more

Hi,   We have a number of GP users operating clients running 4.07 and some using version 5.x.  There is an odd (Annoying) issue that those running the later versions of GP have noticed and its to do with the pop-up placement of the Welcome Screen.  In 4.07 the Welcome screen appears after the authentication has been successful with the GP gateway.  That's great, as we use the Welcome Screen as an indication you have connected and provide info on onward URL's.   But on the newer clients the pop-up appears as soon as the authentication on the GP Portal has completed.  This is a pain for us running 2FA as our users aren't yet able to use resources yet as they still need their second authentication credentials for the gateway.  I see in the release notes for version 4.7 that the placement of the Welcome Screen after the gateway was a bug!  I would argue it was a feature and I now have a bug.   GPC-7314 - Fixed an issue on Windows endpoints where the GlobalProtect app displayed the Welcome page only after connecting to a GlobalProtect gateway instead of after connecting to the GlobalProtect portal.   Can someone enlighten me as to whether anyone else feels my pain or whether there is any other solution to this so I get a welcome page pop-up after the gateway authentication?     Regards   Mike ... View more

Hi,   We have around 500 concurrent SSL clients connecting to our Palo Alto Gateway using Global Protect version 3.0.1.   If I activate the newest version on the Firewall (Version 3.1.3), will the existing clients be unaffected by this activation and continue to work.   Due to PC lockdown's in our organisation, I can't easily enforce an auto upgrade for the users so would like the existing clients to work as-is and any additional users who wish to use the SSL vpn, download the newer versions going forward.   Regards   Mike ... View more

Hi,   I have a slight issue whereby I am operating 2FA for my SSL users utilising Global Protect.  The initial authentication is using Single Sign On techniques to the domain controller with the secondary authenication requiring Entrust token input before connecting the the VPN.   Both work well, however upon connecting to the SSL VPN, the users are prompted with the authentication dialogue box for the Entrust username and password but the username is always pre-populated with the initial authentication credentials from domain credentials.  I'd like it so that the username entry is not pre-populated and is blank when offered to the users.   I have read numerous Palo Alto briefs on how to remove but no joy....any help appreciated.   Thanks ... View more

Hi,   I have a strange issue where my Global Protect SSL Client connects to the firewall with no issues.  I get the IP, the routes and the DNS servers but I don't get anything listed in the DNS Suffix entry.  I have configured the DNS Suffix correctly under 'Global Protect Gateway', 'Client Configuration', 'Network Settings' and can even see the DNS Suffix being received from the agent during my agent debug when trying to connect but nothing shows up in IPCONFIG.   Any ideas?   Regards   Mike ... View more

Hi,   Has anyone seen this error before?   I have a user who is using SSL VPN to the Palo Alto.  Upon downloading the client, the initial connection works.   However, subsequent connections displays an error on the client "Failed to get default route entry".  The logs on the Palo Alto Firewall don't suggest an issue an indicate the user is connected and an IP assigned.  Yet the IPconfig on the laptop does not indicate the IP has been received.   I have other users connecting OK.   Regards   Mike     ... View more