Global Protect w/ WHfB Cloud Kerberos trust deployment

whodge — Thu, 18 May 2023 12:32:56 GMT

What is the best method to configure Windows Hello for Business with Global Protect Always-On..

During our PoT we noticed GP SSO passthrough won't authenticate via WHfB....

Would an external authentication e.g. Set up Kerberos Authentication be the way to go?

User authentication functions are performed by external LDAP, Kerberos, TACACS+, SAML, or RADIUS services (including support for two-factor, token-based authentication mechanisms, such as one-time password (OTP) authentication). To enable external authentication:

Create a server profile with settings for access to the external authentication service.
Create an authentication profile that refers to the server profile.
Specify client authentication in the portal and gateway configurations and optionally specify the OS of the endpoint that will use these settings.

You can use different authentication profiles for each GlobalProtect component. See Set Up External Authentication for instructions. See Remote Access VPN (Authentication Profile) for an example configuration.

**Note

If you configure the portal or gateway to authenticate users through Kerberos authentication, users will not have the option to Sign Out of the GlobalProtect app if they authenticate successfully using this authentication method.

Thank you,

topic Global Protect w/ WHfB Cloud Kerberos trust deployment in GlobalProtect Discussions

Global Protect w/ WHfB Cloud Kerberos trust deployment