How to configure and verify a Global Protect disable code using 'Allow with Ticket'

How to configure and verify a Global Protect disable code using 'Allow with Ticket'

6752
Created On 07/27/22 22:54 PM - Last Modified 01/27/26 21:33 PM


Objective


There are 5 options a firewall administrator can configure to allow Global Protect users to disable the Global Protect agent by the user directly.  This document is specifically focused on one option named 'Allow with Ticket'.  Where the other 4 options are: Allow, Disallow, Allow with Comment, and Allow with Passcode. 

Environment


  • GlobalProtect App
  • GlobalProtect Portal and Gateway

Procedure


This document assumes an already configured and working GlobalProtect configuration.  This article will focus on only the Allow with Ticket configuration and verification.
 

  1.  Configure the Allow with Ticket disable option in the Global Protect Portal.  Navigate to:
Network > GlobalProtect > Portals > (click on the desired portal name) > Agent > (click on the desired configuration in the CONFIGS column) > App tab.

See the following screenshot for an example:
image.png

 

  1. Find the option named Allow User to Disable GlobalProtect App, drop down the options menu, and select Allow with Ticket 

NOTE: The setting description on the latest PAN-OS versions has been changed to Allow user to disconnect GlobalProtect App (Always-on mode) 

 

Please see the following screenshot (old PAN-OS version):
image.png
  1. Click OK and commit the configuration

NOTE: Even though the GP Portal configuration was modified and committed as in the above steps, you will need to ensure that the GP App is able to pull down this new Portal Configuration before it will be able to work. The best way to ensure the GP App pulls down the new Portal Configuration is to use the GP Agent settings 'Refresh Connection option on the GP agent itself.

 
This action is performed on the GlobalProtect App on the end user's computer by clicking the hamburger menu (three horizontal bars) button at the top right corner.

Please see the following screenshot: 
image.png

 

To verify Disable/Disconnect with the Allow with Ticket

 

  • Click the hamburger menu and select the Disable/Disconnect button, see the following screenshot:

image.png

Clicking the disable/disconnect button will generate a Request Number that will need a corresponding Ticket from the GP Portal firewall to process the disable/disconnect operation. For example, the screenshot shows a Request Number: 5BCC-F75F and a blank Ticket field.

 
image.png
 
The end-user needs to send the Request Number to the GP Portal firewall admin to generate the corresponding Ticket and give it to the end-user.

NOTE: A Ticket works only for a corresponding Request Number (i.e. a Ticket does not work for any Request Number).

NOTE: The end-user is supposed to enter the corresponding Ticket number for the generated Request Number. If, for any reason, the end-user cancels the Request Number or the GP App changes the state such that the Request Number does not remain active, the end-user will have to click Disable again to obtain a new Request Number.
 
  • The GP Portal firewall administrator can generate a Ticket by following the steps:
    • Go to Network > GlobalProtect > Portals
    • Click the checkbox next to the GP Portal name
    • At the bottom of this same screen, select Generate Ticket
See the following screenshot:
image.png
 
  • Enter the Request Number, Duration in minutes, and click OK to generate the Ticket 
image.png
 
NOTE: The Request Number is case sensitive (i.e., enter the same ticket number letters that's on GP App)
 
NOTE: The Duration (min) is the time the GP App will remain in the Disabled/Disconnected state. The Duration of the Disabled/Disconnected state starts when the Ticket is applied on the GP App for the relevant Request Number
 
NOTE: The Duration (min) is not the Ticket validity time and it does not start with the Ticket generation. A Ticket can be used on the GP App as long as the corresponding Request Number is still alive (i.e., not cancelled by the end-user or GP App states)

NOTE: The Disable Timeout (min) (in latest PAN-OS versions: Disconnect Timeout (min)) under the Disable GlobalProtect App configuration and Duration of a Ticket work together, and the lower of the two values or the remaining lifetime of the Ticket is used for a single Disable/Disconnect event. For example:

  • The Disable/Disconnect Timeout (min) under the Disable GlobalProtect App is configured 5 minutes
  • A Ticket is generated with a Duration of 8 minutes
  • When the Ticket is used on the GP App, it will Disable/Disconnect the GP App for 5 minutes because that's the lower of the two values. After 5 minutes, the GP App will try to automatically connect to the GP Portal and Gateway
  • Notice, the 3 minutes of the Ticket's Duration (8 - 5 = 3) are remaining. If the end-user Disables/Disconnects the GP App again within the remaining 3-minute window, the GP App will NOT generate a new Request Number; instead, it will immediately Disable/Disconnect for the remaining 3 minutes.  
  • The firewall admin is supposed to send the Ticket number to the end-user
  • The end-user is supposed to enter the Ticket for the corresponding Request Number on the GP App and click OK to complete the Disable/Disconnect operation 
Please see the following screenshot:
image.png

The GP App will be Disabled/Disconnected for the duration of the Disable/Disconnect Timeout or the Duration of the Ticket (lower of the two values, as already explained)
 
Other users also viewed:
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wl9LCAQ&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail