topic Re: GlobalProtect with Certificate Profle in General Topics

GlobalProtect with Certificate Profle

ce1028 — Thu, 06 Sep 2018 21:31:44 GMT

I have configured GlobalProtect to use Authentication Profile using LDAP (sAMAccountName) and a Certificate profile.

I have user certificates pushed through Group Policy. The configuration works. However, I noticed a few things

1) If I login as UserA and delete the certificate from UserA's personal store, VPN will not connect (this is expected)

2) If I login as UserA, delete UsersA certificate and import UserB's cerificate, VPN connects! (this is unexpected)

The easy and obvious solution is don't allow export of certificates. I feel there should be a way to prevent this scenario from connecting, but haven't been able to figure it out.

Re: GlobalProtect with Certificate Profle

asilliker — Thu, 06 Sep 2018 23:54:09 GMT

Do you have a Username Field specified in your Certificate Profile?

If you do, the Username field in the GP Client should be locked and you would need to use UserB's password to log in.

Re: GlobalProtect with Certificate Profle

ce1028 — Fri, 07 Sep 2018 01:11:28 GMT

@asillikerI tried setting the username field in the certificate profile to Subject Alt, It surely fixes the username issue, as it will cause the username to be username@mydomain.com and is greyed out. The problem is it will never accept the user's password, even if it's the right username/password combo.

Re: GlobalProtect with Certificate Profle

ce1028 — Fri, 07 Sep 2018 01:24:07 GMT

duh me. I figured it out, my authenticaiton profile needed to be changed from sAMAccountName to userPrincipalName

Re: GlobalProtect with Certificate Profle

harevalo_eog — Fri, 14 Sep 2018 22:00:21 GMT

@ce1028 I am interested in getting the User certificate configured as well. Did you configure the user certificate yourself or was it done previously by someone else. Just curious if you have tips or a good reference guide to setup the user certificate correctly. I've only been able to setup device certificates with ADCS but I keep getting impersonation errors when trying to deploy user certificates. Any guide or reference point would be much appreciated.

Re: GlobalProtect with Certificate Profle

ce1028 — Wed, 19 Sep 2018 01:23:39 GMT

@harevalo_eog Yes, I did, it's been a long time since I've touched certificate services. See if this video helps you, at least from the ADCS side

https://www.youtube.com/watch?v=S7IFp8cGOLs