Certificate Error in Global Protect Portal

[smithkopel]

Hi All,

I'm trying to setup the Globalprotect VPN and have followed the (only partially helpful) GlobalProtect-Configuration-4.1.pdf to create certs and set everything up. When I try to connect to the portal site with my browser I get a certificate error - "Error code: sec_error_bad_signature".

It doesn't matter if I conect to the host name or the IP that I defined in the cert, I still get this error.

Does anyone know what the problem could be. Also, is there a way to actually see the certificates?

Thanks,

Kenton

[mbehlok]

Did you import the CA and the client cert to your browser?

I had that issue as well but importing "Installing" the CA and client certs to my browser fixed that issue.

Hope that helps.

[Telenet]

Please use the FQDN and not the host name or IP address.

With kind regards,

Olivier

[Ovan]

Dear

i also have the same Problem and not yet to figure out.

[smithkopel]

Do you mean use the FQDN when creating the certs? At this point my portal doesn't ahve a FQDN.

[smithkopel]

Thanks @mbehlok, that helped a bit, now I get a 404 error saying /uro/ was not found on this server. Must be more that I'm missing inthe setup I guess. Any thoughts?

[jambulo]

I too am getting this same error.  I followed the document "GlobalProtect Configuration for 4.1" as much as I could.  My Portal/Gateway does not have a FQDN, just an IP address.

Edit: Importing the Global Protect Gateway Cert allows my browser to reach the portal.  BUT, I can not log in, and I get a message on the portal saying "Invalid client certificate".

[ekerstetter]

I had a similar issue. I would get a certificate malformed error when trying to connect to the portal. I deleted all the certificates and started over. I was using underscores in the name for each certificate, I changed this to hyphens and made sure to fill out all the fields and it seemed to resolve the issue. Not sure why it did however and there is a chance that I had changed something else unknowingly during the process. It’s worth a shot I guess…

[Ovan]

Does anyone succeed in configuring Globalprotect with OS 4.1 ? please help sharing !!!!!

[mbehlok]

Ovan,

I actually got it to work, and it seems to work very well, at least once I got the certificates to work.

What can I do to help?  I can post up part of the configuration if that will help, or even some screen shots of the GUI.

Or if you want, get me access to the firewall if its in a lab environment and I can see if I can help out.

my direct email is mbehlok (at) sslmeetings.com

BTW, GP 1.1.2 is out, give that client a try as well as it seems to work better for me.

[Ovan]

Thanks mbehlok,

please help to post up your configuration guide with screenshots. I followed the " Configuring GlobalProtect 4.1 guide" But i didn't work.

[jambulo]

So I finally got Global Protect to work on 4.1.2.  Following the "Configuring GlobalProtect" guide won't get you anywhere.  Apparently using the Palo Alto as a CA server does not work  So the steps in the guide where it tells you to create a CA cert, and then the 2 other certs, do not apply.  I had a Palo Alto Support Engineer take a look at our setup.  What he did to make it work...

1) Generate a plain Cert in Palo Alto(Not signed and not a Certificate Authority)

2) Global Protect > Portals > Your Portal > Portal Configuration > Set "Client Certificate" and "Client Certificate Profile" to "None".  Set "Server Certificate" to the Cert you made in step 1.

3) Move to Client Configuration tab > Delete any Root CA's that are set.

4) Global Protect > Gateways > Your Gateway > General > Set "Server Certificate" to the Cert you created in step 1.  Set "Client Certificate Profile to "None".

[mbehlok]

Thanks for the update Jambulo.

I was actually able to get it to work by using the PA as the CA server.

I did have to upload the CA Cert and the Client certs to my client though in order for the client to connect, before that I kept getting cert errors.

I am on 4.1.2 PanOS and GP 1.1.2.

Glad you got it working though.

[smithkopel]

Using a single certificate also worked for me. I had an SE come in and go through all my configuration stuff and still ran into the same error. When we did it using the single cert, everything worked fine. Since the cert is only to secure the portal to login and get the client, a single certificate should be sufficient. This also means you don't have to install the client and root cert on every machine that is going to connect to the portal. This would also enable you to use a third-party web certificate to avoid the cert error on connecting to the portal.

Thanks everyone for your help.

Of course, none of this stuff negates the fact that the documentation for this whole process is bad and in many cases just plain wrong. I'm finding that this is a trend in the Palo Alto documentation.

[kamish]

This is an interesting thread.  I have been using GP since the original release.  I agree that the guide is very vague and doesn't help much.

Attached are screen shots of my config with OS 4.1.2 and GP client 1.1.2-9 and all works well.  We use a root CA and sign all of the server and client certs with the CA.

Hope this helps.