Okta AD Agent 3A.98516 (Customer) asked a question.
PaloAlto Global Protect fails authentication when connected on Guest Network
When users are connected via guest network at the office, and they try to connect to Okta via Global Protect VPN, the authentication via IWA fails and the error message "Couldn't reach to "IWA Agent.org"" appears. However, without VPN, they can go through. I have added the Public IPs to the Gateway IP list, but it does not seem to work. I also cannot see any attempted login events in the user logs.
Hello @Okta AD Agent 3A.98516 (Customer) Thank you for reacting out to our Community!
The culprit for this would be the Network zones, as the IP rages need to be added to the "Trusted Proxy IPs" as well. Once you add them there the authentication should go without a problem.
As per our doc "Enter the Gateway IP addresses and Proxy IP addresses. Separate IPs and IP ranges with a newline or comma. Single IPs, IP ranges or CIDR notation can be added."
Please also see our doc for this:
https://help.okta.com/en-us/Content/Topics/Security/network/define-iwa-network-zone.htm
The Okta Community Catalysts Program is now live. Collect online badges when you participate in the Okta Help Center Questions community. Learn more here.