About mwalter

The client certificate that is used internally in GlobalProtect is provided to the client through the GlobalProtect Portal. If you'd like to use a client certificate from your PKI here, you have to import into the Portal including the private key. The certificate is actually shared across all GlobalProtect clients in your deployment to ensure that only clients from your deployment can connect to your configured GlobalProtect Gateways. It doesn't provide true machine authentication and authorization as you are looking for. ... View more

GlobalProtect actually tries to cache and re-use credentials provided by the user for portal and the gateway. Meaning, the credentials you entered for the portal would be re-used for the gateway connection. Because you use two different authentication profiles for portal and gateway, the authentication with the cached credentials fails and we prompt you to enter the password again, or in your case the SecurID PIN and Tokencode. This is actually expected behaviour. Though, unlike other applications we don't try to authenticate over and over again with those cached credentials, hoping that the authentication server would magically accept those credentials. Instead, we only try once and the prompt the user. We are working on some improvements on improving the product experience so that you won't see an error messages due to a failed first authentication. But for now, this is why you see the behaviour you described. Functionally, it should work fine though, with the log errors being an annoyance right now. ... View more

The training is based on 3.1 and is currently updated. The 4.1 User-ID Agent supports up to 100 DCs/Servers by default and this setting is actually obsolete. ... View more

I admit it's not exactly intuitive to select "Install" on an uninstall routine, but you can simply launch the .pkg file to uninstall GlobalProtect. I know we should maybe document this better, though it is the standard way of uninstalling software on the Mac. GlobalProtect doesn't provide the list of features other VPN clients might have. But we felt that we should focus on what's really needed and make the user experience our highest priority. The goal of GlobalProtect is to keep you connected to a Palo Alto Networks Next Generation Firewall at all times to ensure that mobile user experience the same level of protection they get on the campus network. With that, it is important in my opinion to be as non-intrusive as possible, which is why it runs and connects automatically (which you can change btw). The issues you are experiencing with RADIUS based authentication should be investigated a little bit further. RADIUS is a very common authentication scheme used by many of our customers, especially in conjunction with GlobalProtect. ... View more

Using GlobalProtect with an external CA could be documented better I suppose. The most common mistake is that the certificate that is issued by the external CA is not imported back into PANOS together with the corresponding private key and certificate chain. Usually you'd import it as a PKCS12 file. ... View more

GlobalProtect doesn't provide this option at this point. We also don't use DHCP to assign IP addresses or any other network parameters to the GlobalProtect Agents. Just out of curiousity, why do you need to proxy remote access connections to your intranet? If it is for access control, I suppose App-ID and user authentication would give you the tools needed. ... View more

As soon as you authenticate through SSL-VPN, we know the user and Captive Portal rules don't kick in anymore. Captive Portal rules are only applied for unknown-users. Based on what kind of firewall you have, you could setup two vsys and route traffic between them. The first vsys would terminate the SSL-VPN and then route traffic to the second one, which runs Captive Portal. User-ID information is not shared among vsys, which means that even though the first vsys identifies the user correctly, the user would be unknown for vsys two and Captive Portal rules would be applied. ... View more

Can you please open a support ticket and work with our support team on verifying your configuration? it seems this would be the easiest and fastest way to identify the issue and also to provide a solution without posting your configuration on this forum. ... View more

Rod, what is it about GlobalProtect that makes it so aweful? Sure, every product has issues, but we get pretty good feedback from other customers. I'd like to understand how we could help to make sure you have a better product experience too. ... View more

The disable option is only used if 'on-demand' is disabled, meaning if GlobalProtect is in a mode where it would automatically connect to the gateway. From your post I believe your in on-demand mode, which is why you see a connect and disconnect option. ... View more

GlobalProtect Agent uses a SSL certfificate to authenticate to the gateway as a proof that it belongs to the same deployment. This certificate is provided through the GlobalProtect portal and is used among all agents. In addition to that, GlobalProtect requires user authentication, which can be done through RSA SecurID when connecting to the gateways, meaning when the tunnel is established. ... View more

There is a few examples here: Sample for a basic netlogon script https://live.paloaltonetworks.com/docs/DOC-1580 Perl module for the User-ID XML API https://live.paloaltonetworks.com/docs/DOC-1662 ... View more