GlobalProtect Connects With Old Password Even After A Password Change
3472
Created On 12/09/20 00:53 AM - Last Modified 02/05/25 21:31 PM
Symptom
- A user changes password and logs into machine with new password.
- The password syncs to Active Directory/LDAP
- End user then connects to GlobalProtect but the user is not prompted for password.
Environment
- All versions of PAN-OS
- GlobalProtect
- Always-on connect method
- LDAP or RADIUS authentication
- NGFW Hardware/VM-Series
- The option 'Save User Credential' is set to 'Yes'
Cause
If the portal and gateway agents use cookie for authentication override, the user is not prompted for the new password until the cookie expires. Further, the client continues to use this cookie for authentication until lifetime expiry.
Resolution
- The user can log out of the GlobalProtect client and reconnect.
- Pre-logon with machine certificate authentication can be considered for additional security.