Difference between 2FA certificate configuration methods

bancomedia — Thu, 29 Aug 2024 04:47:09 GMT

Hi folks - very grateful for some support on this one.

I've been led to believe that establishing 2FA on GlobalProtect using credentials and certificates as the authentication methods requires setting up a certificate profile and selecting "No" on the setting "Allow Authentication with User Credentials OR Client Certificate".

My questions is, should that setting be selected on the Portal, the Gateway, or both? Is there any real difference? If, for instance, I selected the setting on the Portal only, could that interfere with the ability to reset Windows passwords on endpoint devices?

Thank you!

Re: Difference between 2FA certificate configuration methods

Claw4609 — Tue, 03 Sep 2024 18:41:33 GMT

Hello,

I would generally match the authentication between the gateway and the portal. If you dont want users to have to enter their credentials on both the gateway and the portal, you could do something like just requiring certificates for the gateway authentication otherwise you should look at GlobalProtect Cookie Authentication Cookie Authentication on the Portal or Gateway (paloaltonetworks.com)

topic Re: Difference between 2FA certificate configuration methods in General Topics

Difference between 2FA certificate configuration methods

Re: Difference between 2FA certificate configuration methods