topic Re: Does Pre-logon for Global Protect use the Computer certificate as a client certificate? in General Topics

Does Pre-logon for Global Protect use the Computer certificate as a client certificate?

Wasfi.Bounni — Thu, 11 Apr 2019 04:02:53 GMT

Hi;

Prelogon Global Protect connection, does it use the Computer certificate as opposed to the user certificate to establish the tunnel? It seems that the only way to do it.

Kindly

Wasfi

Re: Does Pre-logon for Global Protect use the Computer certificate as a client certificate?

Mick_Ball — Thu, 11 Apr 2019 06:01:16 GMT

Yes it will use the certificate in the computers store, it cannot use the user cert until user logs in as GP will not have access to the user profile and how will GP know which user will be logging in.

is there another reason why you need user details on pre logon?

Re: Does Pre-logon for Global Protect use the Computer certificate as a client certificate?

Wasfi.Bounni — Thu, 11 Apr 2019 08:26:32 GMT

Thank you Mick.

There is no reason but I just wanted to understand the mechanism as one of the clients asked me about it.

Kindly

Wasfi

Re: Does Pre-logon for Global Protect use the Computer certificate as a client certificate?

Mick_Ball — Thu, 11 Apr 2019 08:30:23 GMT

sure, no problem but please note that its not a case of using a machine certificate, more using a certificate in the machine store.

you could import a cert for fred smiff into the machine store and it will happily use that if it matches the root cert on the palo config.

Re: Does Pre-logon for Global Protect use the Computer certificate as a client certificate?

BizBo — Fri, 12 Apr 2019 14:33:01 GMT

However GP Pre-logon from 9.0 and 9.0.1 is broken and is currently with TAC for investigation.