topic Globalprotect Smart Card configuration in General Topics

Globalprotect Smart Card configuration

j.bartha — Mon, 04 Nov 2019 20:36:57 GMT

So my company is working to setup a new PKI infrastructure with smart card logins for the users. I have looked at all the 2FA and associated articles about setting up the VPN but it leaves a lot to the imagination. I followed the steps creating the certificate profile and assigning it to the portal and gateway. But when i test it the issue i arrive at is the initial login to the vpn. If i were to sign into the workstation with my smart card and was already signed into the VPN it may or may not prompt for my pin. If i go into the menu and logout if the VPN it prompts for username and password.

This could either be a failure on my configuration or a simple lack of understanding on my part. Is an initial login required and then never used again so long as you dont logout? Did i configure things incorrectly and it should login automatically? For reference we are attempting to swap from the existiny LDAP setup that uses the users login credentials to also login to the VPN. Any help would be greatly appreciated.

Re: Globalprotect Smart Card configuration

j.bartha — Mon, 04 Nov 2019 20:41:53 GMT

These are the instructions I am referring to having followed.

https://docs.paloaltonetworks.com/globalprotect/8-1/globalprotect-admin/authentication/set-up-two-factor-authentication/enable-two-factor-authentication-using-smart-cards

Re: Globalprotect Smart Card configuration

j.bartha — Thu, 07 Nov 2019 16:00:43 GMT

I am still looking for any help that anyone could provide. Documentation, personal experience, or just to tell me it is not possible to remedy.

Re: Globalprotect Smart Card configuration

j.bartha — Tue, 26 Nov 2019 19:04:06 GMT

I'm still looking for anyone with experience with this issue. Or anyone with any reference or instructions that can help me narrow down the issue. The current work around we are going to go with involves enforcing smart card login by group policy. This retains the users login info allowing them to stay connected to the vpn. But this isnt the way we would like to do it. It is just the available alternative. If anyone knows of a solution to my problem please take the time to help out. I feel like its a simple solution that im just not seeing.

Re: Globalprotect Smart Card configuration

MansuSupportAcc — Wed, 03 Nov 2021 11:04:13 GMT

Hi @j.bartha ,

Did you finally found a solution?