https://live.paloaltonetworks.com/t5/globalprotect-discussions/allow-vpn-with-and-without-a-cert/m-p/325401#M80 <P>Resolved.</P><P>&nbsp;</P><P>I had to set the gateway authentication to "YES" (<SPAN>Allow Authentication with User Credentials OR Client Certificate) and then make sure the certificate profile to have a username field.</SPAN></P><P>&nbsp;</P><P><SPAN>Thank you for looking at this</SPAN></P><P>&nbsp;</P> Wed, 29 Apr 2020 19:26:26 GMT MatsApplesauce 2020-04-29T19:26:26Z https://live.paloaltonetworks.com/t5/globalprotect-discussions/allow-vpn-with-and-without-a-cert/m-p/325170#M77 <P>Hello</P><P>Is it possible to have one gateway with two agents, one that uses on-demand with leap user name and password (no cert) and another that uses pre-login with a cert?</P><P>When I follow the instructions I have to put the cert on the Gateway and when I do, any user without the cert can't connect.</P><P>&nbsp;</P><P>Since everyone is at home it's hard to push out a cert right now, but I would like to be able to test pre-login with a cert without breaking the VPN for everyone.</P><P>&nbsp;</P><P>Thank you</P><P>/Mats</P> Tue, 28 Apr 2020 14:14:53 GMT https://live.paloaltonetworks.com/t5/globalprotect-discussions/allow-vpn-with-and-without-a-cert/m-p/325170#M77 MatsApplesauce 2020-04-28T14:14:53Z https://live.paloaltonetworks.com/t5/globalprotect-discussions/allow-vpn-with-and-without-a-cert/m-p/325401#M80 <P>Resolved.</P><P>&nbsp;</P><P>I had to set the gateway authentication to "YES" (<SPAN>Allow Authentication with User Credentials OR Client Certificate) and then make sure the certificate profile to have a username field.</SPAN></P><P>&nbsp;</P><P><SPAN>Thank you for looking at this</SPAN></P><P>&nbsp;</P> Wed, 29 Apr 2020 19:26:26 GMT https://live.paloaltonetworks.com/t5/globalprotect-discussions/allow-vpn-with-and-without-a-cert/m-p/325401#M80 MatsApplesauce 2020-04-29T19:26:26Z