topic Re: Users connect to Global Protect even with expired certificate. in General Topics

Users connect to Global Protect even with expired certificate.

SaulGlz — Mon, 07 Oct 2019 17:36:32 GMT

Hi.

I've been detecting that some users have their VPN certificate expired and still manage to connect to the Global Protect VPN.
The Global Protect settings are correct, since most users if their certificate is expired do not let them connect.

Globalprotect version: 4.1.9
PAN-OS version: 8.0.15

Will it be some configuration error?

Re: Users connect to Global Protect even with expired certificate.

S.Cantwell — Wed, 09 Oct 2019 02:06:45 GMT

In GP software 3.14, expired/self signed certs were not checked.

After 3.1,4, the GP portal will check if a cert is valid or not, and deny access.

You could download the software 3.1.4, and have all users install it, and it could be an acceptable solution.

But to answer your question...is it a configuration on the FW issue? No, it is not.

Re: Users connect to Global Protect even with expired certificate.

SaulGlz — Wed, 09 Oct 2019 17:02:32 GMT

Thank you,

What I want is that users who have an expired certificate cannot connect to GlobalProtect.

And know the root cause

Regards.