Global Protect with Client Certificate Authentication

[indevis]

Hi all,

can somebody tell me if there is a manual or howto,
which describes in detail how to confígure this.

I read the "Quick Start Guide GP" and this thread
https://live.paloaltonetworks.com/message/7126

But I'm not getting it t work. When I connect to the portal site
with a browser I'm getting the message "Valid Client Certificate Required".

But I imported the cert.

I want to use a GP CA created on the PA itself,
and then create client certs which are signed with it.

In the new features for 4.1 I read that there is a limited GP for SSL
purposes only, so that you need no licenses. Does this mean I wouldn't
configure a portal and only a gateway and connect directly to the gateway?

If yes, can somebody explain how to do this. The GP agent give me a message "Wrong Portal"
when I try to connect directly to the gateway.

Regards
Christian

[Bart_Jocque]

The PAN can not take the role of an issuing CA for client certs.

You need to use an external CA.

Even in 4.1 you would still need a portal and a gateway. Both can be on the same box.

[fatboy1607]

I suggest you go with PAN OS version 9.0 and latest GP client version.

Make sure under portal authentication is done using certificate.

looking at error it seems your certificate chain is not full.

take packet capture look at certificate sent cpature from client to check if it sending certiifcate.