Global Protect Client 1.2.0

Reply
Highlighted

Global Protect Client 1.2.0

We are using a self-signed certificate on our PAN. The Global Protect clients before the latest version were fine with it. Now I am getting invalid certificate errors connecting with the latest client. What has changed with this new client?

Thanks


Accepted Solutions
Highlighted
L7 Applicator

In GlobalProtect version 1.1.7 (and all subsequent versions, including 1.2.0) we have implemented strict certificate chain checking. This is an enhanced security measure to ensure the clients trust the portal and gateway certificates when connecting. Here is the information from the 1.1.7 release notes:

GlobalProtect 1.1.7 implements enhanced checks for CA Server Certificates chain-of-trust. This change will cause some existing configurations to become invalid and may result in remote users receiving an error when connecting to the portal, or will not be able to connect if the certificate issue is present on the gateway. Before deploying the GlobalProtect Agent 1.1.7 to users, ensure that the Portal and all Gateway server certificates are valid and that the certificate Common Name (CN) fields match the FQDN or IP address of the portal and/or gateway that uses the certificate.

The SSL certificate that you use for the GlobalProtect portal/gateway should have a Common Name (CN) that matches what you configured in the portal settings. For example, if your certificate has the CN of gp.example.com, ensure that your portal configuration lists the gateway as gp.example.com and does not use an IP address and vice versa, otherwise when the GlobalProtect Agent tries to connect it will generate an error specifying that the certificate CN does not match.

Additionally, when the certificate is created, the Subject Alternative Name (SAN) must be exactly the same as the certificate's CN. If the certificate uses the CN of the DNS name, ensure that the SAN also uses the DNS name and not the IP address. A mismatch will cause the GlobalProtect Agent to recognize that the SAN is not the same as the CN and will also produce the certificate error.

If your certificates are generated by a public certificate authority, then this will be done correctly and you should not have any issues.

Refer to the following tech note for details on configuring server certificates: https://live.paloaltonetworks.com/docs/DOC-2020

View solution in original post


All Replies
Highlighted
L7 Applicator

In GlobalProtect version 1.1.7 (and all subsequent versions, including 1.2.0) we have implemented strict certificate chain checking. This is an enhanced security measure to ensure the clients trust the portal and gateway certificates when connecting. Here is the information from the 1.1.7 release notes:

GlobalProtect 1.1.7 implements enhanced checks for CA Server Certificates chain-of-trust. This change will cause some existing configurations to become invalid and may result in remote users receiving an error when connecting to the portal, or will not be able to connect if the certificate issue is present on the gateway. Before deploying the GlobalProtect Agent 1.1.7 to users, ensure that the Portal and all Gateway server certificates are valid and that the certificate Common Name (CN) fields match the FQDN or IP address of the portal and/or gateway that uses the certificate.

The SSL certificate that you use for the GlobalProtect portal/gateway should have a Common Name (CN) that matches what you configured in the portal settings. For example, if your certificate has the CN of gp.example.com, ensure that your portal configuration lists the gateway as gp.example.com and does not use an IP address and vice versa, otherwise when the GlobalProtect Agent tries to connect it will generate an error specifying that the certificate CN does not match.

Additionally, when the certificate is created, the Subject Alternative Name (SAN) must be exactly the same as the certificate's CN. If the certificate uses the CN of the DNS name, ensure that the SAN also uses the DNS name and not the IP address. A mismatch will cause the GlobalProtect Agent to recognize that the SAN is not the same as the CN and will also produce the certificate error.

If your certificates are generated by a public certificate authority, then this will be done correctly and you should not have any issues.

Refer to the following tech note for details on configuring server certificates: https://live.paloaltonetworks.com/docs/DOC-2020

View solution in original post

Highlighted

Thank you...that's what I needed to know.

Cheers,

Highlighted
L4 Transporter

Dear gwesson,

Thank you for the interesting details. The setup works for us if we use the same DNS name for the gateway as we have for the portal. But we want to have multiple gateways:

Portal is configured on gp.example.com (assume IP 100.1.1.1)

Gateway 1 is configured on another IP address (but same ISP as Portal): gp1.example.com (IP 100.1.1.2)

Gateway 2 is configured on another IPS interface with the IP 200.2.2.2 (no DNS name)

The portal certificate is issued for "gp.example.com" and signed by an internal "firewall issuing CA" which is installed on the PA firewall (including priv key).

Gateway 1 is issued for "gp1.example.com" and signed by the same CA as the portal.

Gateway 2 has no DNS name and is issued for "200.2.2.2" and signed by the same CA as the portal.

With this setup we get the error message attached. How can we achieve the setup above with no error message? To my understanding it must be possible to have multiple gateways configured in one portal... Or is it a constraint that at least one of the gateways need to be identical to the portal?


Thank you,

Oliver

Highlighted
L7 Applicator

Hi Oliver,

The name has to match the portal, but you can do that by using the Host Name field in the certificate. Just recreate the certs for each of your portals, and in the Host Name field type gp.example.com in addition to the IP or the gp1.example.com name. That should allow the check to pass correctly.

Regards,

Greg

Highlighted
L4 Transporter

Oh, I see. It works now. Thank you Greg.

Highlighted
L3 Networker

Greg,

Does this mean that wildcard certs will no longer work with GlobalProtect?  Or does one of the SAN entries simply have to match the CN (*.example.com)?

Highlighted
L1 Bithead

Was this question ever answered? Will wildcard certs work with GlobalProtect?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!