Configure Palo Alto Networks GlobalProtect to Address the Double-authentication Problem
Please follow these steps to remove the double authentication problem of the Palo Alto Networks VPN client. These steps require a change in the Portal and in the Gateway configuration.
Step 1 - Configure the Portal
From Palo Alto Web Management Site, go to Network → GlobalProtect → Portals and select the GlobalProtect Portal Configuration item associated with the endpoint that needs to be modified (e.g.,. pa-vpn-02).
Click on the name of the GlobalProtect item that you want to configure. The following screen will appear:
Go to the “Agent” section on the menu on the left. From the “Agents” table, click on the item you would like to configure (e.g., pa-vpn-client-02).
The following screen will appear:
From the “Authentication” tab, configure the “Authentication Override” section as follows:
Check the checkboxes next to the following items:
Generate cookie for authentication override
Accept cookie for authentication override
Set the attributes to following values as described:
Cookie Lifetime: “Hours” and “24”
Certificate to Encrypt: Select the certificate associated with the Palo Alto Networks Server (e.g., pa-vpn-server-02).
Click “OK” to save the settings.
Certificate example: The following screen shows a sample certificate for the Pa-vpn-server-02 location:
Sample Pa-vpn-server-02 certificate details:
Step 2 - Configure the Gateway
Go to Network → GlobalProtect → Gateways. Select the GlobalProtect Gateway Configuration item associated to the endpoint that you would like to configure (e.g., pa-vpn-gateway-02), and click on it:
The following screen will appear:
Go to the “Agent” section on the menu on the left. From the “Client Settings” tab, click on the item you would like to configure (e.g., pa-vpn-client-02). Then, select the “Authentication Override” tab:
From the “Authentication Override” tab, configure the following options:
Check the boxes next to the following items:
Generate cookie for authentication override
Accept cookie for authentication override
Set the attributes to the following values as described:
Cookie Lifetime: “Hours” and “24”
Certificate to Encrypt: Select the certificate associated with the Palo Alto Networks Server (e.g., pa-vpn-server-02)
Click “OK” to save the settings.
Back on the GlobalProtect Gateway Configuration screen, click on the “OK” button.
Step 3
Commit all changes using the Palo Alto Networks management portal.