Difference between 2FA certificate configuration methods

[bancomedia]

Hi folks - very grateful for some support on this one.

I've been led to believe that establishing 2FA on GlobalProtect using credentials and certificates as the authentication methods requires setting up a certificate profile and selecting "No" on the setting "Allow Authentication with User Credentials OR Client Certificate".

My questions is, should that setting be selected on the Portal, the Gateway, or both? Is there any real difference? If, for instance, I selected the setting on the Portal only, could that interfere with the ability to reset Windows passwords on endpoint devices?

Thank you!

[Claw4609]

Hello,

I would generally match the authentication between the gateway and the portal. If you dont want users to have to enter their credentials on both the gateway and the portal, you could do something like just requiring certificates for the gateway authentication otherwise you should look at GlobalProtect Cookie Authentication Cookie Authentication on the Portal or Gateway (paloaltonetworks.com)