topic Re: Global Protect Pre-Authentication driving me nuts in General Topics

Global Protect Pre-Authentication driving me nuts

darren_g — Sun, 06 Mar 2016 22:19:58 GMT

Hi.

I'm trying to configure pre-authentication on my Global Protect portal.

I've followed this document until I'm blue in the face, but every single time I attempt to logon to my test environment, I get

GlobalProtect portal user authentication failed. Login from: AAA.BBB.CCC.DDD, User name: , Reason: client cert invalid, Auth type: profile.	03/06 21:55:38
GlobalProtect portal user authentication failed. Login from: AAA.BBB.CCC.DDD, User name: , Reason: client cert invalid, Auth type: profile.	03/06 21:55:31

Anyone got any hints on getting this to work? The annoying thing is I've had this working previously, but the certificates expired between my test and now - so I renewed them, re-imported them into my test PC - no good.

Deleted the old ones, generated new ones (including a new CA certificate for the firewall), changed the required configutrations, imported the new certificates into my PC - nothing. Same error.

Is there some more debugging I can enable somewhere to figure out where this is going wrong?

Re: Global Protect Pre-Authentication driving me nuts

Raido_Rattameister — Mon, 07 Mar 2016 01:03:02 GMT

Maybe worth taking packet capture and drill into certificate parameters with Wireshark to verify which (if you have many) certificate client sends to firewall.

Re: Global Protect Pre-Authentication driving me nuts

darren_g — Mon, 07 Mar 2016 01:42:43 GMT

Done that, and as far as I can tell the certificates are the right ones - I've only got one set defined on my testbed firewall, so and the HTTPS connection (to the portal) appears to be encrypted fine - I just can't login (to download the client or connect with Global Protect).

Oh well. I'll keep plugging away at it.

Thanks

Re: Global Protect Pre-Authentication driving me nuts

tsrivastav — Mon, 07 Mar 2016 02:16:32 GMT

Try installing the certificate in the other accounts too

try with IE also

try installing the same in other accounts too