Global Protect with Client Certificate Authentication

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Global Protect with Client Certificate Authentication

L2 Linker

Hi all,

can somebody tell me if there is a manual or howto,
which describes in detail how to confígure this.

I read the "Quick Start Guide GP" and this thread

But I'm not getting it t work. When I connect to the portal site
with a browser I'm getting the message "Valid Client Certificate Required".

But I imported the cert.

I want to use a GP CA created on the PA itself,
and then create client certs which are signed with it.

In the new features for 4.1 I read that there is a limited GP for SSL
purposes only, so that you need no licenses. Does this mean I wouldn't
configure a portal and only a gateway and connect directly to the gateway?

If yes, can somebody explain how to do this. The GP agent give me a message "Wrong Portal"
when I try to connect directly to the gateway.



L3 Networker

The PAN can not take the role of an issuing CA for client certs.

You need to use an external CA.

Even in 4.1 you would still need a portal and a gateway. Both can be on the same box.

L4 Transporter

I suggest you go with PAN OS version 9.0 and latest GP client version.


Make sure under portal authentication is done using certificate.


looking at error it seems your certificate chain is not full.


take packet capture look at certificate sent cpature from client to check if it sending certiifcate.

SD-WAN | Cloud Networking | PCNSE | ICSI CNSS | MCNA | | CCNP | CCSA | SPSP | SPSX | F5-101 |
  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!