topic Re: GP Agent Machine Certificate Check in GlobalProtect Discussions

GP Agent Machine Certificate Check

Michael.Martin — Thu, 27 Jul 2023 23:09:07 GMT

Hello,

I am trying to find out more information about a GP portal setting called Machine Certificate Check under Portal Configuration / Agent / Agent Config / Config Selection Criteria / Device Checks. I was hoping to use a machine certificate check outside of the authentication tab to allow or disallow machines based on user/user group, but I can't seem to get it to work. I get a "You are not authorized to connect to GlobalProtect Portal" message. If I set the same certificate profile in the authentication tab, it works just fine when the cert is installed in the machine store. GlobalProtect connects as it should.

My question is, what is the difference between setting it in the authentication tab and setting it as a device check? It is using the same certificate profile and same certificate issued by the CA. I would think it should work set in either place.

PA-220 running 10.2.4

This is a test portal/gateway configuration I am using.

Thanks in advance for any input.

Michael

Re: GP Agent Machine Certificate Check

Mick_Ball — Wed, 02 Aug 2023 13:06:41 GMT

I would say that the authentication tab just allows you to connect to the gateway... the device check will decide which config within the gateway agent setting you would get once authenticated, if you only have 1 config in the agent it would not really be of any use...

For user/group membership you will need to look at Device>User Identification>user mapping.

Re: GP Agent Machine Certificate Check

Merl — Mon, 19 Feb 2024 11:33:01 GMT

Hi, have you managed to solve this issue? Struggling with the same problem...

Re: GP Agent Machine Certificate Check

DKh Al Obaidi — Tue, 28 May 2024 19:05:45 GMT

Any idea what is the main idea from the above ( what is the difference between setting it in the authentication tab and setting it as a device check? It is using the same certificate profile and same certificate issued by the CA. I would think it should work set in either place) ?

Re: GP Agent Machine Certificate Check

Merl — Wed, 29 May 2024 09:53:03 GMT

Authentication may be shared for several user groups and with a disabled certificate option. But at the same time you might be needed to have several Agent options with different criteria. My personal case: one GW, single Authentication method without cert, several Agent options for different groups. Some users only need authentication, other users need 2FA with a machine cert.