topic Globalprotect client authenticate with a certificate not working anymore in General Topics

Globalprotect client authenticate with a certificate not working anymore

ZEBIT — Wed, 22 Jun 2016 06:32:33 GMT

Since we use our Palo Alto firewall, our users there Global Protect Client authenticate with the firewall through a certificate that is deployed thorugh Active Directory. Our Global Protect Client version is 3.0.2.

Since we updated our Pan-Os version to 7.0.6 this method of authentication does not work anymore.

THe client tries to authenticate and than there is a message: Enter username and password to login.

When to user fills in his credentials everything works, but this is not how we want it. The authentication need to go through the certificate.

I checked the Portal Gateway and it seems it has been modified with the update to 7.0.6. There is now a field SSL/TLS.

How can I fix this issue?

Re: Globalprotect client authenticate with a certificate not working anymore

Raido_Rattameister — Wed, 22 Jun 2016 06:52:53 GMT

But you have LDAP profile also chosen so it is expected that user/password is asked.

Re: Globalprotect client authenticate with a certificate not working anymore

ZEBIT — Wed, 22 Jun 2016 07:03:01 GMT

Our vendor did this and said it was a bckup in case the certificate does not work.

So how I can make everything work again?

Re: Globalprotect client authenticate with a certificate not working anymore

Raido_Rattameister — Wed, 22 Jun 2016 07:01:30 GMT

If both are chosen both are asked.

If cert fails then just login fails.

Maybe someone will correct me 🙂

Re: Globalprotect client authenticate with a certificate not working anymore

emr_1 — Wed, 22 Jun 2016 07:04:30 GMT

Raido, you are correct.

His configuration is two-factor auth. (cert and ldap)

Re: Globalprotect client authenticate with a certificate not working anymore

ZEBIT — Wed, 22 Jun 2016 07:06:36 GMT

It is no problem that the LDAP is the backup solution but if the client has the certificate no ldap is required.

Re: Globalprotect client authenticate with a certificate not working anymore

Raido_Rattameister — Wed, 22 Jun 2016 07:46:09 GMT

ZEBIT your current setup does not set LDAP as backup.

There is AND between those profiles.

You require certificate AND credentials.

Re: Globalprotect client authenticate with a certificate not working anymore

ZEBIT — Wed, 22 Jun 2016 08:04:34 GMT

Ok, than our vendor did a mis configuration. Strange that it worked before we updated to PAN OS 7.0.6.

How can I make it work when the client has the certificate it can authenticate?

Re: Globalprotect client authenticate with a certificate not working anymore

Raido_Rattameister — Wed, 22 Jun 2016 12:33:08 GMT

Your internal users who have cert use one portal address with portal/gateway config that authenticates with certificate and third parties use different portal id that points to different gateway. Portal/gateway set up for third parties who don't have client cert authenticate only using LDAP.

Re: Globalprotect client authenticate with a certificate not working anymore

ZEBIT — Thu, 23 Jun 2016 07:59:29 GMT

Yesterday we found the solution. Due the update the settings for cert authentication are a bit different.

In the certificate profile you need to choose on what detail in the cert it has to check: CN, Principel name, Email.

We check for the principel name, because the principel name has to be in a specific group before it can login through the certificate.

Now everything works.