GlobalProtect Cookie Authentication in PAN-OS 10.1

GlobalProtect Cookie Authentication in PAN-OS 10.1

4816
Created On 04/27/22 04:15 AM - Last Modified 03/11/25 20:22 PM


Environment


  • Palo Alto Firewalls 
  • PAN-OS 10.1 and higher
  • GlobalProtect (GP) App
  • Cookie authentication on Portal/Gateway

Resolution


To better improve the user experience while using the GlobalProtect App, you can enable cookie authentication on either the Portal and/or Gateway to reduce the amount of times a user must authenticate. You can complete this by performing the following steps:
  1.  Enable cookie authentication on the GP Portal
    1.  Navigate to Network > GlobalProtect > Portals > [Select Portal] > Agent > [Select Proper Config] > Authentication > Authentication Override
    2.  Select the checkbox for both the generate and accept options
    3.  Specify the cookie lifetime in minutes, hours, or days along with the appropriate certificate for encryption/decryption and select OK twice
Snapshot displaying the authentication override dialog box within the Palo Alto Networks Portal GUI
  1.  Enable cookie authentication on the GP Gateway
    1.  Navigate to Network > GlobalProtect > Gateways > [Select Gateway] > Agent > Client Settings > [Select Proper Config] > Authentication Override
    2.  Select the checkbox next to the accept option (it's already being generated on the Portal so it's not required here)
    3.  Specify the cookie lifetime in minutes, hours, or days along with the same certificate from Step 1c and select OK twice
Snapshot displaying the authentication override dialog box within the Palo Alto Networks Gateway GUI
  1. Commit your changes
Note: In this example, we set the lifetime to 5 minutes to present the snippet of sslvpn or gpsvc process logs. 

Afterwards, we can verify the cookie is successfully generated and used for authentication on the firewall by using the following methods:
  1.  Check the monitor logs in the firewall GUI
    1.  Navigate to Monitor > Logs > GlobalProtect
    2.  You can easily isolate your logs by using filter parameters similar to the ones shown in the image below (eg., portal/gateway name and username)
Snapshot displaying the GlobalProtect logs within the Palo Alto Networks firewall GUI.
  1.  Generating a tech support file on the GP Portal/Gateway
Note: Additional debugs must be enabled prior to authenticating in order to see the full cookie creation process (rasmgr, sslvpn [10.1], gpsvc [10.2 and higher])
  1. After downloading the tech support file from Device > Support > Tech Support File, expand the folder and navigate to the var/log/pan directory 
  2.  You should see the cookie being generated after successful authentication to the Portal and then used for the Gateway authentication similar to the ones shown below:
  • appweb3-sslvpn.log (less mp-log appweb3-sslvpn.log)
Portal Login -
debug: pan_gp_lookup_by_sock(pan_gp_cfg.c:1668): found client config!
debug: panGlobalProtectLogin(panPhpGlobalProtect.c:4318): panGlobalProtectLogin: pan_generate_portal_user_auth_cookie
debug: pan_gp_rsa_gen_app_auth_cookie(pan_gp_cfg.c:2560): un-encrypted auth cookie localuser2;;Windows;20090e21-2afb-408b-98ce-a3d39b2ac20c;1651024558;192.168.150.100, user=localuser2, remote_addr=192.168.150.100
debug: pan_generate_portal_user_auth_cookie(panPhpGlobalProtect.c:2369): generate portal user auth cookie successful
debug: panGlobalProtectLogin(panPhpGlobalProtect.c:4407): loginStatus=1; no pwd_expiry_msg
debug: panGlobalProtectLogin(panPhpGlobalProtect.c:4443): panGlobalProtectLogin: set domain=(empty_domain) from EMPTYDOMAIN
debug: panGlobalProtectLogin(panPhpGlobalProtect.c:4487): user(localuser2) gen_prelogon_cookie(yes) prelogon_exist(no) gen_cookie(yes) has_prelogon_cookie(no)
debug: panGlobalProtectLogin(panPhpGlobalProtect.c:4552): panGlobalProtectLogin: cleanup
debug: panGlobalProtectLogin(panPhpGlobalProtect.c:4554): return portal user auth cookie(p6Wu9gz8Vt******lB7ofFNw==)
debug: panGlobalProtectLogin(panPhpGlobalProtect.c:4592): login ret string sent to the client is : Success
debug: panGlobalProtectLogin(panPhpGlobalProtect.c:4610): login response sent to the client is : Success
Gateway Login -
debug: panSslVpnLogin(panPhpSslVpn.c:2319): panSslVpnLogin: Begin... user=localuser2, empty passwd=no, empty new passwd=yes, input=, hostid=.....
<><><><><><><><><><>
debug: pan_gp_rsa_dec_app_auth_cookie(pan_gp_cfg.c:2699): decrypt auth cookie localuser2;;Windows;20090e21-2afb-408b-98ce-a3d39b2ac20c;1651024558;192.168.150.100
debug: pan_gp_rsa_dec_app_auth_cookie(pan_gp_cfg.c:2761): curtime(1651024558) cookietime(1651024558) end=0
debug: pan_gp_rsa_dec_app_auth_cookie(pan_gp_cfg.c:2771): remote_addr(192.168.150.100) ret_remote_addr(0-6496a8c0ffff0000)
debug: panSslVpnLogin(panPhpSslVpn.c:2807): gateway user auth cookie decrypt successful
debug: panSslVpnLogin(panPhpSslVpn.c:2972): clientaddr=192.168.150.100, cookie ip=192.168.150.100; source ip check enable 0, netmask v4 32 v6 128
<><><><><><><><><><>
debug: panSslVpnLogin(panPhpSslVpn.c:3693): Cookie valid : Getting the framed ip
debug: panSslVpnLogin(panPhpSslVpn.c:3878): User localuser2 authResult = 1 cookie_valid(yes)
debug: panSslVpnLogin(panPhpSslVpn.c:4082): Valid cookie, skipping user authentication
  • gpsvc.log (less mp-log gpsvc.log)
Portal Login -
{"level":"debug","task":"1770-5","time":"2024-07-19T12:34:25.758824212-05:00","message":"NewHttpTask: task for gp-getconfig(POST) request begin..."}
<><><><><><><><><><>
{"level":"debug","task":"1770-5","time":"2024-07-19T12:34:26.807403111-05:00","message":"HandlePortalAuthOverrideCookie: gen-cookie(yes)"}
{"level":"debug","task":"1770-5","time":"2024-07-19T12:34:26.821376872-05:00","message":"GenerateAuthCookie: cleartext localuser2;[domain-name];Windows;d64830af-791e-4f75-b28b-11a0819f46cd;1721410466;192.168.150.100, authCookieStr fCWJT1dBuLZvcsBAgOqwrho60vxT0U+Zv..."}
<><><><><><><><><><>
{"level":"debug","task":"1770-5","time":"2024-07-19T12:34:26.826875761-05:00","message":"RunHttp: task for gp-getconfig is completed"}
Gateway Login -
{"level":"debug","task":"1772-19","time":"2024-07-19T12:34:30.788277584-05:00","message":"NewHttpTask: task for gw-login(POST) request begin..."}
<><><><><><><><><><>
{"level":"debug","task":"1772-19","time":"2024-07-19T12:34:30.803233694-05:00","message":"DecryptAuthCookie: auth cookie after decryption: localuser2;[domain-name];Windows;d64830af-791e-4f75-b28b-11a0819f46cd;1721410466;192.168.150.100"}
{"level":"debug","task":"1772-19","time":"2024-07-19T12:34:30.803383847-05:00","message":"AuthWithCookie: set domain=[domain-name] from auth override cookie"}
{"level":"debug","task":"1772-19","time":"2024-07-19T12:34:30.803416778-05:00","message":"AuthWithCookie: set user=localuser2 from auth override cookie"}
<><><><><><><><><><>
{"level":"debug","task":"1772-19","time":"2024-07-19T12:34:30.80681415-05:00","message":"HandleGWAuthOverrideCookie: gen-cookie(no)"}
{"level":"debug","task":"1772-19","time":"2024-07-19T12:34:30.807099047-05:00","message":"gwLogin: PAN_AUTH_SUCCESS"}
<><><><><><><><><><>
{"level":"debug","task":"1772-19","time":"2024-07-19T12:34:30.809681398-05:00","message":"RunHttp: task for gw-login is completed"}
  1. Navigating to rasmgr.log should display the cookie being presented for authentication similar to the logs shown below:
rasmgr.log (less mp-log rasmgr.log)
debug: sslvpn_set_pub_ip(src/rasmgr_sslvpn.c:1499): GP Client conn type is ipv4 (0), pub_ip 192.168.150.100, pub_ip6 0:0:0:0:0:0:0:0, rep_pub_ip 192.168.150.100, rep_pub_ip6 0:0:0:0:0:0:0:0
debug: _print_client_requests(src/rasmgr_sslvpn.c:157): (login) gw login (1651024558722, 2022-04-26 18:55:58.722, 192.168.150.100); getconfig (0, , ::); sslvpnconnrect (0, , ::)
new cookie:  ******
rasmgr_sslvpn_client_register space globalprotect-gw-N domain  user localuser2 computer 6347E0B5-3379-4 result 0

Additional Information


Cookie Authentication on the Portal or Gateway
Other users also viewed:
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004OLHCA2&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language