How to configure VPN and Certificates to cut VPN access when the Certificate is revoked.

Alpalo — Thu, 14 Sep 2023 08:04:38 GMT

Hello team,

I need to know How to configure VPN and Certificates to cut VPN access when the Certificate is revoked.

I have revoked a certificate into the Firewall but I can connect anyway from VPN.... I am using on my GlobalProtect connection and the connections are working fine, I need to cut this connection when the certificate is revoked, can anyone help me?

Regards

Re: How to configure VPN and Certificates to cut VPN access when the Certificate is revoked.

A_Astardzhiev — Thu, 14 Sep 2023 08:39:32 GMT

Hi @Alpalo ,

The certificate are form of authentication. Which means they are used when user is initiating a connection to the firewall.

Revoking certificate does not affect currently established connection, the same way as disabling user account would disconnect the user if he has connected with username and password.

You need to manually disconnect the GP client from the gateway - if there is currently established session.

To prevent the user from connecting again you need to enable CRL or OCSP check in Ceritificate Profile that you assign for your GP Portal/Gateway. Look at section 8.Certificate Profile, step 7 on the following link - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFoCAK

7. (optional) Check CRL or OCSP if the portal/gateway needs to verify the client/machine cert's revocation status using CRL or OCSP. Please use this with caution as it can result in clients failing to connect if used in conjunction with 'Block session if certificate status is unknown'.

Note that above is assuming you are using internal PKI, to which firewall has access from its dedicated mgmt interface.

If you are using self-signed CA that is generated by the firewall you will need to enable OCSP reponder as described here - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIzCAK

topic How to configure VPN and Certificates to cut VPN access when the Certificate is revoked. in General Topics

How to configure VPN and Certificates to cut VPN access when the Certificate is revoked.

Re: How to configure VPN and Certificates to cut VPN access when the Certificate is revoked.