Oh man, we just went through this! Not sure if you have the same setup, but we use pre-logon/always on with machine certificates, LDAP authentication, and SSO enabled (for Windows clients).
Any other recommendations for dealing with this behavior? It has become very disruptive as it usually results in multiple locks per user (once when they try to use the new password, and the next day when the old saved password finally fails). Does GlobalProtect/Palo Alto Firewall cache AD credentials for a period of time? If so, is that timing adjustable or even something we can disable? Is there a downside to using real-time querying of creds from AD (if that is possible)?. Anyone seen an issue like this with GlobalProtect, Palo Alto Firewall (we are at 9.1.8), and Active Directory 2016 (we use the User-ID Agent 9.1.209 on both domain controllers)?. Usually that period of time is between that connection and their next one (next day most likely so within 12 hours). When this happens, the user can try their old password and it will work for a period of time. At that point we are seeing some users not being able to use the new password they just chose, and tested in Windows (which is querying the domain controllers in real-time so we know the change took). After that, we have them disconnect and sign out of GlobalProtect and then immediately connect GP again and sign in again. GLOBALPROTECT CHANGE PASSWORD UPDATE
When a user changes their password in AD, we have the user immediately lock and unlock Windows, to be sure the change took, and to force Windows to update the cached creds. We use Active Directory to authenticate GlobalProtect connections.
PANW - Press Releases & Public Statements. We are not officially supported by Palo Alto networks, or any of it's employees, however all are welcome to join and help each other on a journey to a more secure tomorrow.ĭo you have support related questions? Check the Support Site Company Information This subredditt is for those that administer, support, or want to learn more about Palo Alto Networks firewalls.
0 kommentar(er)
