topic Re: HIPs check for Client Side Certificate in General Topics

HIPs check for Client Side Certificate

CZellars — Fri, 19 Jan 2018 19:36:45 GMT

Is it possible to use HIPs to verify the presence of a Client Side Certificate such as GlobalProtect cert for a computer and also check for cert on a mobile device? If the device has the cert then we would allow it through a firewall policy.

Re: HIPs check for Client Side Certificate

OtakarKlier — Fri, 19 Jan 2018 19:42:06 GMT

Hello,

Would this device you are attempting to check behind the firewall or connecting via a client VPN connection?

Regards,

Re: HIPs check for Client Side Certificate

CZellars — Fri, 19 Jan 2018 19:43:44 GMT

Thanks for replying and it would be connecting via a GlobalProtect VPN client.

Re: HIPs check for Client Side Certificate

OtakarKlier — Fri, 19 Jan 2018 19:49:14 GMT

Hello,

GP has a certificate it can use to verify the client. Check this article out and see if it meets your requirements.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-GlobalProtect-Portal-with-Client-Cert/tac-p/58923#M684

https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/get-started/enable-ssl-between-globalprotect-components/globalprotect-certificate-best-practices

Cheers!

Re: HIPs check for Client Side Certificate

CZellars — Fri, 19 Jan 2018 20:25:09 GMT

Thanks for that info. The issue is that we would need to check for a specfic certificate: the machine certificate and I cannot seem to find a registry entry that allows me to do that. I believe I need to open a case with Palo Alto Support and I will report back with results if possible. Thank You

Re: HIPs check for Client Side Certificate

CZellars — Wed, 24 Jan 2018 19:38:42 GMT

Well in the end we did not find a way to use HIPs custom checks in order to verify a machine certificate. The issue being that the certificate stuff is stored in the registry in blob format which doesnt allow parsing for specifics.

I have convinced the team to move forward by using GlobalProtect Certificate check against our PKI

Re: HIPs check for Client Side Certificate

jmsepulveda — Thu, 01 Sep 2022 20:42:11 GMT

hello, I have not found information associated with being able to implement any hip control associated with a particular certificate, I need to separate the external and internal users of a client but we need to validate the certificate, internal and external will have a different certificate, there will be some documentation available for Current versions? Is it possible for the globalprotect client to take the data from the certificate installed on the pc device and compare these data with the hip profile validate certificate and comply or not with the posture?
thanks

Re: HIPs check for Client Side Certificate

kiwi — Tue, 06 Sep 2022 09:30:29 GMT

Hi @jmsepulveda ,

As from PAN-OS 9.0, GlobalProtect introduced Certificate as an element in HIP Object.

This allows customers to identify managed devices and control access based on the device based on the specific machine certificate (including certificate attributes) present on the device.

source: https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-web-interface-help/globalprotect/objects-globalprotect-hip-objects/hip-objects-certificate-tab

Hope this helps,

-Kiwi.

Re: HIPs check for Client Side Certificate

jmsepulveda — Tue, 13 Sep 2022 15:40:36 GMT

Hello, but that kb does not provide much information, I had already seen it before, it does not indicate what type of certificates can be used and if

yo need to place this certificate in some other firewall configuration, the globalprotect agent is able to read the certificate information , whenever I look at the globalprotect I see the certificate section blank