topic Re: Certificate profile - option Block session if the certificate was not.. in GlobalProtect Discussions

Certificate profile - option Block session if the certificate was not....

Rene_Belloni — Tue, 12 May 2020 09:37:36 GMT

Basic GP setup, portal and gateway using certificate authentication only, certificates issues by internal CA, Palo Alto firewall is not involved in the certificate enrollment process.

Certificate profile used is configured with Root and intermediate certificate, set for using CRL and options (block session if certificate status cannot be retrieved within timeout, Block session if the certificate was not issued to the authenticating device and Block sessions with expired certificate) has been selected.

Clients now tries to connect, but fails with message (Client certificate could not be authenticated), if I then remove the option Block session if the certificate was not issued to the authenticating device, then the clients are able to authenticate and connect.

My question:

Is the option "Block session if the certificate was not issued to the authenticating device" only valid e.g can be used if the Palo Alto firewall handles the original certificate enrolment process, and shouldn't be used if this is done using other methods ?

Re: Certificate profile - option Block session if the certificate was not..

vathreya — Thu, 14 May 2020 22:37:18 GMT

Hi,

Did you ensure that serial number attribute in the subject of the client certificate matches the host ID that the GlobalProtect app reports for the endpoint?

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/certificate-management/configure-a-certificate-profile

Regards,

VRA

Re: Certificate profile - option Block session if the certificate was not..

Rene_Belloni — Fri, 22 May 2020 09:12:14 GMT

Dear Vathreya

Thank you for the reply, yes we added the IPAD UDID into the Common Name in the certificate, but it seems like in GP for IOS in version 5.0, the client isnt able any longer to grap the UDID straight from the IPAD, but needs to be specific configured via VPN profile to map the UDID with Mobile-ID in order to get the correct information sent in the HIP report to the gateway.

https://docs.paloaltonetworks.com/globalprotect/5-0/globalprotect-app-new-features/new-features-released-in-gp-agent-5_0/globalprotect-app-for-ios-user-experience-enhancements/mobile-device-management-changes.html#ide03e60d2-363a-4cec-9fb4-65e65bbb011f_id9b855032-eda8-4143-9da8-b66e22293559

Our MDM platform used is Intunes and so far we havent been able to find the ability to perform such a customization of the VPN profile.

I missed to include information in the orginal post that it was issue with IPAD's