About FDEMUYTER

Hi, I would like to accomplish the following I have an always on VPN configured to use user-id password at logon. When the user is on one of our remote sites with know public IP's I want to use only LDAP in all other situation when he is external I want RADIUS(MFA).  Can I make an authentication profile and link it to source IP?     Kind regards,   Frederik   ... View more

Hello, I have the following question is it possible to assign multiple authentication profiles to globalprotect.  I wan't to accomplishg the following:   Users of LDAP GROUP X.:  Use LDAP authentication only. Users of LDAP GROUP Y:  User RADIUS auth with MFA capabilities.   Is this possible an how can i accomplish this?  If somebody could point me into the right direction. The main reason for asking this is because my radius server (Microosoft NPS server with MFA extension) by default forwards all request to MFA. And i want certain users to be able to bypass MFA.    Any help on this would be appreciated.         ... View more

Hello,   We have PC's that are only registered inside Azure AAD and managed via Intune they have no connection to the on-prem AD and are connecting via a Wifi zone behind PA to the internet.  How can i determine the USER id, without user interaction. Or do i need Global protect for this and SSO? Is there someting like a User ID agent for Azure AAD. Or maybe i can use SAML SSO with Azure AAD for captive portal, can somebody point me to a good article on how to configure this.     ... View more

Hi, In lab i am trying to setup a simple global protect configuration where the gateway and portal are on the same IP and just using local user authentication.  I have a certificate for my my public IP from let's ecnrypt and  have imported this into palo alto. I am able to connect to the portal without any certificate issues.  But when connecting through the gateway i am getting the server certficate is invalid.   My config looks like this:   Portal config:   GPP-Portal { portal-config { client-auth { GPP-AUTH { os Any; authentication-profile "Local-Database Authentication"; authentication-message "Enter login credentials"; } } local-address { interface loopback; ip { ipv4 10.1.1.1; } } custom-login-page factory-default; custom-home-page factory-default; custom-help-page factory-default; ssl-tls-service-profile PORTAL-SSL-SERVICE-PROFILE; } client-config { configs { AUTH-PORTAL { hip-collection { max-wait-time 20; collect-hip-data yes; } gateways { external { list { fw.relianet.be { fqdn fw.relianet.be; priority-rule { Any { priority 1; } } manual yes; } } cutoff-time 5; } } authentication-override { generate-cookie no; } source-user any; os Windows; agent-ui { max-agent-user-overrides 0; agent-user-override-timeout 0; } gp-app-config { config { connect-method { value on-demand; } refresh-config-interval { value 24; } agent-user-override { value allowed; } client-upgrade { value prompt; } use-sso { value no; } logout-remove-sso { value yes; } krb-auth-fail-fallback { value yes; } retry-tunnel { value 30; } retry-timeout { value 5; } enforce-globalprotect { value no; } captive-portal-exception-timeout { value 0; } traffic-blocking-notification-delay { value 15; } display-traffic-blocking-notification-msg { value yes; } traffic-blocking-notification-msg { value '<div style="font-family:'Helvetica Neue';"><h1 style="color:red;text-align:center; margin: 0; font-size: 30px;">Notice</h1><p style="margin: 0;font-size: 15px; line-heigh t: 1.2em;">To access the network, you must first connect to GlobalProtect.</p></div>'; } allow-traffic-blocking-notification-dismissal { value yes; } display-captive-portal-detection-msg { value no; } captive-portal-detection-msg { value '<div style="font-family:'Helvetica Neue';"><h1 style="color:red;text-align:center; margin: 0; font-size: 30px;">Captive Portal Detected</h1><p style="margin: 0; font-size : 15px; line-height: 1.2em;">GlobalProtect has temporarily permitted network access for you to connect to the Internet. Follow instructions from your internet provider.</p><p style="margin: 0 ; font-size: 15px; line-height: 1.2em;">If you let the connection time out, open GlobalProtect and click Connect to try again.</p></div>'; } certificate-store-lookup { value user-and-machine; } scep-certificate-renewal-period { value 7; } retain-connection-smartcard-removal { value yes; } enable-advanced-view { value yes; } enable-do-not-display-this-welcome-page-again { value yes; } rediscover-network { value yes; } resubmit-host-info { value yes; } can-change-portal { value yes; } can-continue-if-portal-cert-invalid { value yes; } show-agent-icon { value yes; } user-switch-tunnel-rename-timeout { value 0; } pre-logon-tunnel-rename-timeout { value -1; } show-system-tray-notifications { value no; } max-internal-gateway-connection-attempts { value 0; } portal-timeout { value 5; } connect-timeout { value 5; } receive-timeout { value 30; } enforce-dns { value yes; } flush-dns { value no; } proxy-multiple-autodetect { value no; } wsc-autodetect { value yes; } mfa-enabled { value no; } mfa-listening-port { value 4501; } mfa-notification-msg { value "You have attempted to access a protected resource that requires additional authentication. Proceed to authenticate at"; } ipv6-preferred { value yes; } } } save-user-credentials 2; portal-2fa no; manual-only-gateway-2fa no; internal-gateway-2fa no; auto-discovery-external-gateway-2fa no; mdm-enrollment-port 443; } } } satellite-config { client-certificate { local; } } }   GATEWAY:   GP-GATEWAY { roles { default { login-lifetime { days 30; } inactivity-logout { hours 3; } disconnect-on-idle { minutes 180; } } } client-auth { GPG-CLIENT-AUTH { authentication-profile "Local-Database Authentication"; os Any; authentication-message "Enter login credentials"; } } remote-user-tunnel-configs { GPG-Agent { authentication-override { generate-cookie no; } split-tunneling { access-route 192.168.1.0/24; exclude-access-route; } source-user any; authentication-server-ip-pool; ip-pool 192.168.250.0/24; os any; retrieve-framed-ip-address no; no-direct-access-to-local-network no; } } ssl-tls-service-profile PORTAL-SSL-SERVICE-PROFILE; tunnel-mode yes; remote-user-tunnel tunnel.3; }   Anybody that can help me out with this.     ... View more